| File name: | WannaCry.exe |
| Full analysis: | https://app.any.run/tasks/8dacdd10-8292-499c-9fb4-877c95ceaa6f |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | May 15, 2025, 00:06:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| MD5: | 5C7FB0927DB37372DA25F270708103A2 |
| SHA1: | 120ED9279D85CBFA56E5B7779FFA7162074F7A29 |
| SHA256: | BE22645C61949AD6A077373A7D6CD85E3FAE44315632F161ADC4C99D5A8E6844 |
| SSDEEP: | 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ |
MALICIOUS
Changes the autorun value in the registry
- WannaCry.exe (PID: 1132)
WANNACRY mutex has been found
- WannaCry.exe (PID: 1132)
WannaCry Ransomware is detected
- WannaCry.exe (PID: 1132)
- cmd.exe (PID: 7204)
RANSOMWARE has been detected
- WannaCry.exe (PID: 1132)
Writes a file to the Word startup folder
- WannaCry.exe (PID: 1132)
Modifies files in the Chrome extension folder
- WannaCry.exe (PID: 1132)
Drops known malicious image
- WannaCry.exe (PID: 1132)
Deletes shadow copies
- cmd.exe (PID: 7580)
SUSPICIOUS
Starts a Microsoft application from unusual location
- WannaCry.exe (PID: 1132)
- !WannaDecryptor!.exe (PID: 728)
- !WannaDecryptor!.exe (PID: 2568)
- !WannaDecryptor!.exe (PID: 7984)
- !WannaDecryptor!.exe (PID: 3176)
- WannaCry.exe (PID: 6456)
- WannaCry.exe (PID: 8144)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 5576)
- WannaCry.exe (PID: 616)
- WannaCry.exe (PID: 5556)
- WannaCry.exe (PID: 7640)
- WannaCry.exe (PID: 7564)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 5428)
- WannaCry.exe (PID: 5216)
- WannaCry.exe (PID: 7184)
- WannaCry.exe (PID: 7276)
- WannaCry.exe (PID: 4272)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 7668)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 8120)
- WannaCry.exe (PID: 6004)
- WannaCry.exe (PID: 6136)
- WannaCry.exe (PID: 444)
- WannaCry.exe (PID: 6324)
- WannaCry.exe (PID: 6112)
- WannaCry.exe (PID: 1128)
- WannaCry.exe (PID: 4452)
- WannaCry.exe (PID: 6676)
- WannaCry.exe (PID: 4424)
- WannaCry.exe (PID: 7196)
- WannaCry.exe (PID: 4180)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 5776)
- WannaCry.exe (PID: 1116)
- WannaCry.exe (PID: 2064)
- WannaCry.exe (PID: 8028)
- WannaCry.exe (PID: 7512)
- WannaCry.exe (PID: 632)
- WannaCry.exe (PID: 7788)
- WannaCry.exe (PID: 6908)
- WannaCry.exe (PID: 7560)
- WannaCry.exe (PID: 7172)
- WannaCry.exe (PID: 7356)
- WannaCry.exe (PID: 2084)
- WannaCry.exe (PID: 7252)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 924)
- WannaCry.exe (PID: 7856)
- WannaCry.exe (PID: 7136)
- WannaCry.exe (PID: 2108)
- WannaCry.exe (PID: 3180)
- WannaCry.exe (PID: 3024)
- WannaCry.exe (PID: 1164)
- WannaCry.exe (PID: 1228)
- WannaCry.exe (PID: 5124)
- WannaCry.exe (PID: 872)
- WannaCry.exe (PID: 8024)
- WannaCry.exe (PID: 2392)
- WannaCry.exe (PID: 1072)
- WannaCry.exe (PID: 7508)
- WannaCry.exe (PID: 812)
- WannaCry.exe (PID: 7864)
- WannaCry.exe (PID: 7000)
- WannaCry.exe (PID: 7880)
- WannaCry.exe (PID: 6960)
- WannaCry.exe (PID: 4728)
- WannaCry.exe (PID: 7596)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 8040)
- WannaCry.exe (PID: 1004)
- WannaCry.exe (PID: 7444)
- WannaCry.exe (PID: 6572)
- WannaCry.exe (PID: 1852)
- WannaCry.exe (PID: 7736)
- WannaCry.exe (PID: 7320)
- WannaCry.exe (PID: 8144)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 5008)
- WannaCry.exe (PID: 4464)
- WannaCry.exe (PID: 7416)
- WannaCry.exe (PID: 7752)
- WannaCry.exe (PID: 6824)
- WannaCry.exe (PID: 7484)
- WannaCry.exe (PID: 5216)
- WannaCry.exe (PID: 3268)
- WannaCry.exe (PID: 8100)
- WannaCry.exe (PID: 7244)
- WannaCry.exe (PID: 7768)
- WannaCry.exe (PID: 7724)
- WannaCry.exe (PID: 5204)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 8124)
- WannaCry.exe (PID: 8000)
- WannaCry.exe (PID: 7636)
- WannaCry.exe (PID: 6576)
- WannaCry.exe (PID: 444)
- WannaCry.exe (PID: 736)
- WannaCry.exe (PID: 2644)
- WannaCry.exe (PID: 8128)
- WannaCry.exe (PID: 4348)
- WannaCry.exe (PID: 7048)
- WannaCry.exe (PID: 6068)
- WannaCry.exe (PID: 1388)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 5228)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 5484)
- WannaCry.exe (PID: 7696)
- WannaCry.exe (PID: 808)
- WannaCry.exe (PID: 1152)
- WannaCry.exe (PID: 4352)
- WannaCry.exe (PID: 6272)
- WannaCry.exe (PID: 6476)
- WannaCry.exe (PID: 4724)
- WannaCry.exe (PID: 7528)
- WannaCry.exe (PID: 4208)
- WannaCry.exe (PID: 828)
- WannaCry.exe (PID: 6480)
- WannaCry.exe (PID: 2780)
- WannaCry.exe (PID: 7700)
- WannaCry.exe (PID: 4572)
- WannaCry.exe (PID: 1664)
- WannaCry.exe (PID: 5180)
- WannaCry.exe (PID: 680)
- WannaCry.exe (PID: 3976)
- WannaCry.exe (PID: 5280)
- WannaCry.exe (PID: 4224)
- WannaCry.exe (PID: 7704)
- WannaCry.exe (PID: 8012)
- WannaCry.exe (PID: 5512)
- WannaCry.exe (PID: 2204)
- WannaCry.exe (PID: 2084)
- WannaCry.exe (PID: 6852)
- WannaCry.exe (PID: 5720)
- WannaCry.exe (PID: 7864)
- WannaCry.exe (PID: 7000)
- WannaCry.exe (PID: 7340)
- WannaCry.exe (PID: 5416)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 6384)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 7440)
- WannaCry.exe (PID: 1240)
- WannaCry.exe (PID: 7424)
- WannaCry.exe (PID: 4464)
- WannaCry.exe (PID: 7756)
- WannaCry.exe (PID: 5600)
- WannaCry.exe (PID: 5176)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 6712)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7684)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7876)
- WannaCry.exe (PID: 3080)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 7552)
- WannaCry.exe (PID: 7960)
- WannaCry.exe (PID: 7588)
- WannaCry.exe (PID: 208)
- WannaCry.exe (PID: 4300)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 7904)
- WannaCry.exe (PID: 132)
- WannaCry.exe (PID: 1804)
- WannaCry.exe (PID: 5400)
- WannaCry.exe (PID: 5640)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 4424)
- WannaCry.exe (PID: 7308)
- WannaCry.exe (PID: 4180)
- WannaCry.exe (PID: 780)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 4488)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 5304)
- WannaCry.exe (PID: 5588)
- WannaCry.exe (PID: 4276)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 7696)
- WannaCry.exe (PID: 7512)
- WannaCry.exe (PID: 7292)
- WannaCry.exe (PID: 7784)
- WannaCry.exe (PID: 980)
- WannaCry.exe (PID: 3156)
- WannaCry.exe (PID: 3020)
- WannaCry.exe (PID: 4000)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 7972)
- WannaCry.exe (PID: 7856)
- WannaCry.exe (PID: 1504)
- WannaCry.exe (PID: 1328)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 3744)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 7980)
- WannaCry.exe (PID: 8180)
- WannaCry.exe (PID: 7804)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 7704)
- WannaCry.exe (PID: 7716)
- WannaCry.exe (PID: 1532)
- WannaCry.exe (PID: 3300)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 6168)
- WannaCry.exe (PID: 6944)
- WannaCry.exe (PID: 6192)
- WannaCry.exe (PID: 2148)
- WannaCry.exe (PID: 3684)
- WannaCry.exe (PID: 5780)
- WannaCry.exe (PID: 7660)
- WannaCry.exe (PID: 1004)
- WannaCry.exe (PID: 7404)
- WannaCry.exe (PID: 7476)
- WannaCry.exe (PID: 7760)
- WannaCry.exe (PID: 7432)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 7648)
- WannaCry.exe (PID: 6032)
- WannaCry.exe (PID: 800)
- WannaCry.exe (PID: 3080)
- WannaCry.exe (PID: 616)
- WannaCry.exe (PID: 7412)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 7732)
- WannaCry.exe (PID: 7724)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 240)
- WannaCry.exe (PID: 6760)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 4688)
- WannaCry.exe (PID: 5260)
- WannaCry.exe (PID: 7020)
- WannaCry.exe (PID: 5048)
- WannaCry.exe (PID: 856)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 2088)
- WannaCry.exe (PID: 8056)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 6112)
- WannaCry.exe (PID: 7480)
- WannaCry.exe (PID: 7840)
- WannaCry.exe (PID: 8188)
- WannaCry.exe (PID: 7620)
- WannaCry.exe (PID: 1116)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 2772)
- WannaCry.exe (PID: 7568)
- WannaCry.exe (PID: 832)
- WannaCry.exe (PID: 4152)
- WannaCry.exe (PID: 4924)
- WannaCry.exe (PID: 2216)
- WannaCry.exe (PID: 7696)
- WannaCry.exe (PID: 7520)
- WannaCry.exe (PID: 7800)
- WannaCry.exe (PID: 7720)
- WannaCry.exe (PID: 8068)
- WannaCry.exe (PID: 2320)
- WannaCry.exe (PID: 7988)
- WannaCry.exe (PID: 7360)
- WannaCry.exe (PID: 6480)
- WannaCry.exe (PID: 4000)
- WannaCry.exe (PID: 7856)
- WannaCry.exe (PID: 5180)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 3744)
- WannaCry.exe (PID: 8048)
- WannaCry.exe (PID: 7860)
- WannaCry.exe (PID: 7176)
- WannaCry.exe (PID: 5244)
- WannaCry.exe (PID: 2664)
- WannaCry.exe (PID: 5780)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 6276)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 5720)
- WannaCry.exe (PID: 2148)
- WannaCry.exe (PID: 6248)
- WannaCry.exe (PID: 5480)
- WannaCry.exe (PID: 7924)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 4944)
- WannaCry.exe (PID: 4436)
- WannaCry.exe (PID: 4608)
- WannaCry.exe (PID: 7084)
- WannaCry.exe (PID: 7404)
- WannaCry.exe (PID: 1188)
- WannaCry.exe (PID: 2332)
- WannaCry.exe (PID: 7432)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 5376)
- WannaCry.exe (PID: 5072)
- WannaCry.exe (PID: 1176)
- WannaCry.exe (PID: 5576)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7824)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 2908)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 684)
- WannaCry.exe (PID: 6712)
- WannaCry.exe (PID: 7264)
- WannaCry.exe (PID: 6324)
- WannaCry.exe (PID: 7200)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 1452)
- WannaCry.exe (PID: 7248)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 2416)
- WannaCry.exe (PID: 5964)
- WannaCry.exe (PID: 6112)
- WannaCry.exe (PID: 8168)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 4220)
- WannaCry.exe (PID: 1388)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 2772)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 5588)
- WannaCry.exe (PID: 7484)
- WannaCry.exe (PID: 4280)
- WannaCry.exe (PID: 7644)
- WannaCry.exe (PID: 4200)
- WannaCry.exe (PID: 7136)
- WannaCry.exe (PID: 3020)
- WannaCry.exe (PID: 6264)
- WannaCry.exe (PID: 7392)
- WannaCry.exe (PID: 7936)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 7708)
- WannaCry.exe (PID: 6392)
- WannaCry.exe (PID: 3264)
- WannaCry.exe (PID: 5084)
- WannaCry.exe (PID: 7956)
- WannaCry.exe (PID: 300)
- WannaCry.exe (PID: 3744)
- WannaCry.exe (PID: 7800)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 2392)
- WannaCry.exe (PID: 1164)
- WannaCry.exe (PID: 5056)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 4732)
- WannaCry.exe (PID: 4184)
- WannaCry.exe (PID: 4408)
- WannaCry.exe (PID: 1180)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 3684)
- WannaCry.exe (PID: 7648)
- WannaCry.exe (PID: 5416)
- WannaCry.exe (PID: 1280)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 4348)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 2780)
- WannaCry.exe (PID: 1852)
- WannaCry.exe (PID: 4948)
- WannaCry.exe (PID: 1584)
- WannaCry.exe (PID: 7812)
- WannaCry.exe (PID: 7712)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 6388)
- WannaCry.exe (PID: 6216)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 5504)
- WannaCry.exe (PID: 7876)
- WannaCry.exe (PID: 1072)
- WannaCry.exe (PID: 5216)
- WannaCry.exe (PID: 1672)
- WannaCry.exe (PID: 7768)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 7824)
- WannaCry.exe (PID: 2088)
- WannaCry.exe (PID: 728)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 6964)
- WannaCry.exe (PID: 6584)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 240)
- WannaCry.exe (PID: 2140)
- WannaCry.exe (PID: 6156)
- WannaCry.exe (PID: 7300)
- WannaCry.exe (PID: 8080)
- WannaCry.exe (PID: 4172)
- WannaCry.exe (PID: 6256)
- WannaCry.exe (PID: 7840)
- WannaCry.exe (PID: 7784)
- WannaCry.exe (PID: 4336)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 7512)
- WannaCry.exe (PID: 868)
- WannaCry.exe (PID: 5484)
- WannaCry.exe (PID: 1328)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 8096)
- WannaCry.exe (PID: 7720)
- WannaCry.exe (PID: 5552)
- WannaCry.exe (PID: 5944)
- WannaCry.exe (PID: 7580)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 5164)
- WannaCry.exe (PID: 7312)
- WannaCry.exe (PID: 5180)
- WannaCry.exe (PID: 8136)
- WannaCry.exe (PID: 5996)
- WannaCry.exe (PID: 6132)
- WannaCry.exe (PID: 1532)
- WannaCry.exe (PID: 5280)
- WannaCry.exe (PID: 7836)
- WannaCry.exe (PID: 7516)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 680)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 7292)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 540)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 1748)
- WannaCry.exe (PID: 776)
- WannaCry.exe (PID: 1280)
- WannaCry.exe (PID: 7780)
- WannaCry.exe (PID: 968)
- WannaCry.exe (PID: 3012)
- WannaCry.exe (PID: 8004)
- WannaCry.exe (PID: 1176)
- WannaCry.exe (PID: 4104)
- WannaCry.exe (PID: 7396)
- WannaCry.exe (PID: 7228)
- WannaCry.exe (PID: 8024)
- WannaCry.exe (PID: 7084)
- WannaCry.exe (PID: 7756)
- WannaCry.exe (PID: 6760)
- WannaCry.exe (PID: 3164)
- WannaCry.exe (PID: 4376)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 7412)
- WannaCry.exe (PID: 4884)
- WannaCry.exe (PID: 7184)
- WannaCry.exe (PID: 4272)
- WannaCry.exe (PID: 7960)
- WannaCry.exe (PID: 6944)
- WannaCry.exe (PID: 8140)
- WannaCry.exe (PID: 7748)
- WannaCry.exe (PID: 728)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 5400)
- WannaCry.exe (PID: 8000)
- WannaCry.exe (PID: 7872)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 7588)
- WannaCry.exe (PID: 448)
- WannaCry.exe (PID: 8168)
- WannaCry.exe (PID: 2040)
- WannaCry.exe (PID: 7728)
- WannaCry.exe (PID: 6512)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 7468)
- WannaCry.exe (PID: 7672)
- WannaCry.exe (PID: 4336)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 3008)
- WannaCry.exe (PID: 832)
- WannaCry.exe (PID: 4424)
- WannaCry.exe (PID: 7524)
- WannaCry.exe (PID: 7632)
- WannaCry.exe (PID: 7808)
- WannaCry.exe (PID: 8072)
- WannaCry.exe (PID: 7252)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 6004)
- WannaCry.exe (PID: 5024)
- WannaCry.exe (PID: 7360)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 4120)
- WannaCry.exe (PID: 5936)
- WannaCry.exe (PID: 3436)
- WannaCry.exe (PID: 7220)
- WannaCry.exe (PID: 7972)
- WannaCry.exe (PID: 2392)
- WannaCry.exe (PID: 6472)
- WannaCry.exe (PID: 2664)
- WannaCry.exe (PID: 7832)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 2284)
- WannaCry.exe (PID: 6276)
- WannaCry.exe (PID: 6620)
- WannaCry.exe (PID: 3156)
- WannaCry.exe (PID: 6640)
- WannaCry.exe (PID: 3612)
- WannaCry.exe (PID: 3012)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 4276)
- WannaCry.exe (PID: 5624)
- WannaCry.exe (PID: 8004)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 7980)
- WannaCry.exe (PID: 3960)
- WannaCry.exe (PID: 7396)
- WannaCry.exe (PID: 5136)
- WannaCry.exe (PID: 7376)
- WannaCry.exe (PID: 7736)
- WannaCry.exe (PID: 1516)
- WannaCry.exe (PID: 7176)
- WannaCry.exe (PID: 6216)
- WannaCry.exe (PID: 8152)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7824)
- WannaCry.exe (PID: 7984)
- WannaCry.exe (PID: 7244)
- WannaCry.exe (PID: 1188)
- WannaCry.exe (PID: 208)
- WannaCry.exe (PID: 1012)
- WannaCry.exe (PID: 4692)
- WannaCry.exe (PID: 8164)
- WannaCry.exe (PID: 3416)
- WannaCry.exe (PID: 6612)
- WannaCry.exe (PID: 4528)
- WannaCry.exe (PID: 7552)
- WannaCry.exe (PID: 7320)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 7872)
- WannaCry.exe (PID: 6028)
- WannaCry.exe (PID: 1912)
- WannaCry.exe (PID: 7760)
- WannaCry.exe (PID: 6516)
- WannaCry.exe (PID: 7440)
- WannaCry.exe (PID: 5776)
- WannaCry.exe (PID: 7556)
- WannaCry.exe (PID: 7468)
- WannaCry.exe (PID: 7848)
- WannaCry.exe (PID: 5552)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 1700)
- WannaCry.exe (PID: 7728)
- WannaCry.exe (PID: 2028)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 7800)
- WannaCry.exe (PID: 8096)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 6700)
- WannaCry.exe (PID: 4112)
- WannaCry.exe (PID: 6572)
- WannaCry.exe (PID: 2812)
- WannaCry.exe (PID: 1152)
- WannaCry.exe (PID: 5024)
- WannaCry.exe (PID: 7484)
- WannaCry.exe (PID: 7944)
- WannaCry.exe (PID: 4268)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 8104)
- WannaCry.exe (PID: 3024)
- WannaCry.exe (PID: 4572)
- WannaCry.exe (PID: 5380)
- WannaCry.exe (PID: 6436)
- WannaCry.exe (PID: 2664)
- WannaCry.exe (PID: 6676)
- WannaCry.exe (PID: 5188)
- WannaCry.exe (PID: 6384)
- WannaCry.exe (PID: 7052)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 5124)
- WannaCry.exe (PID: 4452)
- WannaCry.exe (PID: 8048)
- WannaCry.exe (PID: 8004)
- WannaCry.exe (PID: 7668)
- WannaCry.exe (PID: 5308)
- WannaCry.exe (PID: 2476)
- WannaCry.exe (PID: 7232)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 4352)
- WannaCry.exe (PID: 7228)
- WannaCry.exe (PID: 7488)
- WannaCry.exe (PID: 5512)
- WannaCry.exe (PID: 7664)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 3160)
- WannaCry.exe (PID: 6216)
- WannaCry.exe (PID: 7768)
- WannaCry.exe (PID: 8100)
- WannaCry.exe (PID: 7804)
- WannaCry.exe (PID: 2692)
- WannaCry.exe (PID: 7412)
- WannaCry.exe (PID: 8064)
- WannaCry.exe (PID: 7636)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 5968)
- WannaCry.exe (PID: 7452)
- WannaCry.exe (PID: 7572)
- WannaCry.exe (PID: 7584)
- WannaCry.exe (PID: 3008)
- WannaCry.exe (PID: 744)
- WannaCry.exe (PID: 8000)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 3968)
- WannaCry.exe (PID: 616)
- WannaCry.exe (PID: 4380)
- WannaCry.exe (PID: 7364)
- WannaCry.exe (PID: 4688)
- WannaCry.exe (PID: 5228)
- WannaCry.exe (PID: 7952)
- WannaCry.exe (PID: 8052)
- WannaCry.exe (PID: 2028)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 7848)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 4284)
- WannaCry.exe (PID: 5204)
- WannaCry.exe (PID: 2216)
- WannaCry.exe (PID: 1328)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 8068)
- WannaCry.exe (PID: 828)
- WannaCry.exe (PID: 5436)
- WannaCry.exe (PID: 5408)
- WannaCry.exe (PID: 632)
- WannaCry.exe (PID: 4560)
- WannaCry.exe (PID: 3124)
- WannaCry.exe (PID: 5484)
- WannaCry.exe (PID: 7580)
- WannaCry.exe (PID: 4268)
- WannaCry.exe (PID: 7048)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 7316)
- WannaCry.exe (PID: 4924)
- WannaCry.exe (PID: 5708)
- WannaCry.exe (PID: 300)
- WannaCry.exe (PID: 5020)
- WannaCry.exe (PID: 6436)
- WannaCry.exe (PID: 1504)
- WannaCry.exe (PID: 6244)
- WannaCry.exe (PID: 6904)
- WannaCry.exe (PID: 7780)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 4276)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 8048)
- WannaCry.exe (PID: 7764)
- WannaCry.exe (PID: 5212)
- WannaCry.exe (PID: 7660)
- WannaCry.exe (PID: 1516)
- WannaCry.exe (PID: 8172)
- WannaCry.exe (PID: 7232)
- WannaCry.exe (PID: 7860)
- WannaCry.exe (PID: 3276)
- WannaCry.exe (PID: 4000)
- WannaCry.exe (PID: 4352)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 8040)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 2692)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 4728)
- WannaCry.exe (PID: 7132)
- WannaCry.exe (PID: 1672)
- WannaCry.exe (PID: 800)
- WannaCry.exe (PID: 7404)
- WannaCry.exe (PID: 6240)
- WannaCry.exe (PID: 448)
- WannaCry.exe (PID: 6124)
- WannaCry.exe (PID: 7584)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 7884)
- WannaCry.exe (PID: 2368)
- WannaCry.exe (PID: 5728)
- WannaCry.exe (PID: 7328)
- WannaCry.exe (PID: 6156)
- WannaCry.exe (PID: 7872)
- WannaCry.exe (PID: 1584)
- WannaCry.exe (PID: 7284)
- WannaCry.exe (PID: 4172)
- WannaCry.exe (PID: 1388)
- WannaCry.exe (PID: 4380)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 8016)
- WannaCry.exe (PID: 7528)
- WannaCry.exe (PID: 7680)
- WannaCry.exe (PID: 1760)
- WannaCry.exe (PID: 536)
- WannaCry.exe (PID: 6512)
- WannaCry.exe (PID: 4220)
- WannaCry.exe (PID: 1700)
- WannaCry.exe (PID: 2320)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 5260)
- WannaCry.exe (PID: 8096)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 7576)
- WannaCry.exe (PID: 7436)
- WannaCry.exe (PID: 8072)
- WannaCry.exe (PID: 6392)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 8080)
- WannaCry.exe (PID: 6620)
- WannaCry.exe (PID: 4268)
- WannaCry.exe (PID: 5556)
- WannaCry.exe (PID: 4924)
- WannaCry.exe (PID: 7312)
- WannaCry.exe (PID: 7392)
- WannaCry.exe (PID: 5708)
- WannaCry.exe (PID: 7700)
- WannaCry.exe (PID: 7292)
- WannaCry.exe (PID: 7832)
- WannaCry.exe (PID: 868)
- WannaCry.exe (PID: 5996)
- WannaCry.exe (PID: 3800)
- WannaCry.exe (PID: 3032)
- WannaCry.exe (PID: 6372)
- WannaCry.exe (PID: 1300)
- WannaCry.exe (PID: 7500)
- WannaCry.exe (PID: 872)
- WannaCry.exe (PID: 8108)
- WannaCry.exe (PID: 2516)
- WannaCry.exe (PID: 3016)
- WannaCry.exe (PID: 6876)
- WannaCry.exe (PID: 7752)
- WannaCry.exe (PID: 4436)
- WannaCry.exe (PID: 7692)
- WannaCry.exe (PID: 7176)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 5376)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 7736)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 3876)
- WannaCry.exe (PID: 3960)
- WannaCry.exe (PID: 8100)
- WannaCry.exe (PID: 2692)
- WannaCry.exe (PID: 7424)
- WannaCry.exe (PID: 4528)
- WannaCry.exe (PID: 3884)
- WannaCry.exe (PID: 800)
- WannaCry.exe (PID: 3796)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 5400)
- WannaCry.exe (PID: 8160)
- WannaCry.exe (PID: 5728)
- WannaCry.exe (PID: 7608)
- WannaCry.exe (PID: 7300)
- WannaCry.exe (PID: 660)
- WannaCry.exe (PID: 2616)
- WannaCry.exe (PID: 2800)
- WannaCry.exe (PID: 7188)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 3676)
- WannaCry.exe (PID: 8060)
- WannaCry.exe (PID: 4040)
- WannaCry.exe (PID: 8016)
- WannaCry.exe (PID: 4336)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 7848)
- WannaCry.exe (PID: 7680)
- WannaCry.exe (PID: 7732)
- WannaCry.exe (PID: 4172)
- WannaCry.exe (PID: 536)
- WannaCry.exe (PID: 7436)
- WannaCry.exe (PID: 8072)
- WannaCry.exe (PID: 8176)
- WannaCry.exe (PID: 1168)
- WannaCry.exe (PID: 4280)
- WannaCry.exe (PID: 6264)
- WannaCry.exe (PID: 6964)
- WannaCry.exe (PID: 5204)
- WannaCry.exe (PID: 6228)
- WannaCry.exe (PID: 632)
- WannaCry.exe (PID: 7748)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 5952)
- WannaCry.exe (PID: 6132)
- WannaCry.exe (PID: 7324)
- WannaCry.exe (PID: 8168)
- WannaCry.exe (PID: 7672)
- WannaCry.exe (PID: 7468)
- WannaCry.exe (PID: 5124)
- WannaCry.exe (PID: 2084)
- WannaCry.exe (PID: 6676)
- WannaCry.exe (PID: 968)
- WannaCry.exe (PID: 6904)
- WannaCry.exe (PID: 7684)
- WannaCry.exe (PID: 5280)
- WannaCry.exe (PID: 1532)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 7488)
- WannaCry.exe (PID: 1300)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 7596)
- WannaCry.exe (PID: 5780)
- WannaCry.exe (PID: 8108)
- WannaCry.exe (PID: 5404)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 7712)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 6760)
- WannaCry.exe (PID: 8040)
- WannaCry.exe (PID: 7944)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 6700)
- WannaCry.exe (PID: 736)
- WannaCry.exe (PID: 5600)
- WannaCry.exe (PID: 4692)
- WannaCry.exe (PID: 2192)
- WannaCry.exe (PID: 5720)
- WannaCry.exe (PID: 6240)
- WannaCry.exe (PID: 2896)
- WannaCry.exe (PID: 4728)
- WannaCry.exe (PID: 4452)
- WannaCry.exe (PID: 7444)
- WannaCry.exe (PID: 7544)
- WannaCry.exe (PID: 5728)
- WannaCry.exe (PID: 7212)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 776)
- WannaCry.exe (PID: 4224)
- WannaCry.exe (PID: 7640)
- WannaCry.exe (PID: 7980)
- WannaCry.exe (PID: 7624)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 1136)
- WannaCry.exe (PID: 1228)
- WannaCry.exe (PID: 4220)
- WannaCry.exe (PID: 7308)
- WannaCry.exe (PID: 8028)
- WannaCry.exe (PID: 6516)
- WannaCry.exe (PID: 7896)
- WannaCry.exe (PID: 6004)
- WannaCry.exe (PID: 1168)
- WannaCry.exe (PID: 536)
- WannaCry.exe (PID: 7332)
- WannaCry.exe (PID: 2140)
- WannaCry.exe (PID: 4672)
- WannaCry.exe (PID: 8024)
- WannaCry.exe (PID: 4284)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 1244)
- WannaCry.exe (PID: 7360)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 4280)
- WannaCry.exe (PID: 3240)
Process drops legitimate windows executable
- WannaCry.exe (PID: 1132)
- WannaCry.exe (PID: 6456)
Executable content was dropped or overwritten
- WannaCry.exe (PID: 1132)
- WannaCry.exe (PID: 6456)
Executing commands from a ".bat" file
- WannaCry.exe (PID: 1132)
The process executes VB scripts
- cmd.exe (PID: 4880)
Uses TASKKILL.EXE to kill process
- WannaCry.exe (PID: 1132)
Reads security settings of Internet Explorer
- !WannaDecryptor!.exe (PID: 728)
Starts CMD.EXE for commands execution
- WannaCry.exe (PID: 1132)
- !WannaDecryptor!.exe (PID: 2568)
Executes as Windows Service
- VSSVC.exe (PID: 3760)
INFO
Checks supported languages
- WannaCry.exe (PID: 1132)
- !WannaDecryptor!.exe (PID: 728)
The sample compiled with english language support
- WannaCry.exe (PID: 1132)
- WannaCry.exe (PID: 6456)
Reads the computer name
- WannaCry.exe (PID: 1132)
- !WannaDecryptor!.exe (PID: 728)
Reads the machine GUID from the registry
- WannaCry.exe (PID: 1132)
Reads security settings of Internet Explorer
- cscript.exe (PID: 4628)
Creates files or folders in the user directory
- WannaCry.exe (PID: 1132)
Create files in a temporary directory
- WannaCry.exe (PID: 1132)
Creates files in the program directory
- WannaCry.exe (PID: 1132)
Manual execution by a user
- firefox.exe (PID: 6080)
- WannaCry.exe (PID: 6456)
- WannaCry.exe (PID: 5576)
- WannaCry.exe (PID: 8144)
- WannaCry.exe (PID: 616)
- WannaCry.exe (PID: 5556)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 7640)
- firefox.exe (PID: 7972)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 5216)
- WannaCry.exe (PID: 7184)
- WannaCry.exe (PID: 7276)
- WannaCry.exe (PID: 7564)
- WannaCry.exe (PID: 5428)
- WannaCry.exe (PID: 4272)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 8120)
- WannaCry.exe (PID: 6136)
- WannaCry.exe (PID: 444)
- WannaCry.exe (PID: 7668)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 6004)
- WannaCry.exe (PID: 6112)
- WannaCry.exe (PID: 6676)
- WannaCry.exe (PID: 4424)
- WannaCry.exe (PID: 6324)
- WannaCry.exe (PID: 1128)
- WannaCry.exe (PID: 4452)
- WannaCry.exe (PID: 7196)
- WannaCry.exe (PID: 4180)
- WannaCry.exe (PID: 5776)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 1116)
- WannaCry.exe (PID: 2064)
- WannaCry.exe (PID: 8028)
- WannaCry.exe (PID: 632)
- WannaCry.exe (PID: 7512)
- WannaCry.exe (PID: 7788)
- WannaCry.exe (PID: 7172)
- WannaCry.exe (PID: 7856)
- WannaCry.exe (PID: 6908)
- WannaCry.exe (PID: 7136)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 7252)
- WannaCry.exe (PID: 2084)
- WannaCry.exe (PID: 7356)
- WannaCry.exe (PID: 872)
- WannaCry.exe (PID: 2108)
- WannaCry.exe (PID: 7560)
- WannaCry.exe (PID: 924)
- WannaCry.exe (PID: 3180)
- WannaCry.exe (PID: 2392)
- WannaCry.exe (PID: 1072)
- WannaCry.exe (PID: 1164)
- WannaCry.exe (PID: 1228)
- WannaCry.exe (PID: 5124)
- WannaCry.exe (PID: 8024)
- WannaCry.exe (PID: 3024)
- WannaCry.exe (PID: 4728)
- WannaCry.exe (PID: 7000)
- WannaCry.exe (PID: 7508)
- WannaCry.exe (PID: 7880)
- WannaCry.exe (PID: 6960)
- WannaCry.exe (PID: 812)
- WannaCry.exe (PID: 7864)
- WannaCry.exe (PID: 7596)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 6572)
- WannaCry.exe (PID: 1852)
- WannaCry.exe (PID: 5008)
- WannaCry.exe (PID: 8040)
- WannaCry.exe (PID: 7444)
- WannaCry.exe (PID: 1004)
- WannaCry.exe (PID: 7752)
- WannaCry.exe (PID: 8144)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 4464)
- WannaCry.exe (PID: 7416)
- WannaCry.exe (PID: 7736)
- WannaCry.exe (PID: 7320)
- WannaCry.exe (PID: 7724)
- WannaCry.exe (PID: 7484)
- WannaCry.exe (PID: 3268)
- WannaCry.exe (PID: 8100)
- WannaCry.exe (PID: 7244)
- WannaCry.exe (PID: 7768)
- WannaCry.exe (PID: 6824)
- WannaCry.exe (PID: 5216)
- WannaCry.exe (PID: 5204)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 736)
- WannaCry.exe (PID: 8124)
- WannaCry.exe (PID: 7636)
- WannaCry.exe (PID: 6576)
- WannaCry.exe (PID: 444)
- WannaCry.exe (PID: 2644)
- WannaCry.exe (PID: 4348)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 7048)
- WannaCry.exe (PID: 8128)
- WannaCry.exe (PID: 6068)
- WannaCry.exe (PID: 1388)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 8000)
- WannaCry.exe (PID: 5228)
- WannaCry.exe (PID: 4724)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 7696)
- WannaCry.exe (PID: 7528)
- WannaCry.exe (PID: 5484)
- WannaCry.exe (PID: 808)
- WannaCry.exe (PID: 1152)
- WannaCry.exe (PID: 4352)
- WannaCry.exe (PID: 6476)
- WannaCry.exe (PID: 828)
- WannaCry.exe (PID: 6480)
- WannaCry.exe (PID: 2780)
- WannaCry.exe (PID: 7700)
- WannaCry.exe (PID: 4572)
- WannaCry.exe (PID: 1664)
- WannaCry.exe (PID: 5180)
- WannaCry.exe (PID: 680)
- WannaCry.exe (PID: 6272)
- WannaCry.exe (PID: 4208)
- WannaCry.exe (PID: 2084)
- WannaCry.exe (PID: 3976)
- WannaCry.exe (PID: 5280)
- WannaCry.exe (PID: 6852)
- WannaCry.exe (PID: 4224)
- WannaCry.exe (PID: 7704)
- WannaCry.exe (PID: 5512)
- WannaCry.exe (PID: 8012)
- WannaCry.exe (PID: 2204)
- WannaCry.exe (PID: 6384)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 5720)
- WannaCry.exe (PID: 7864)
- WannaCry.exe (PID: 7340)
- WannaCry.exe (PID: 7000)
- WannaCry.exe (PID: 5416)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 1240)
- WannaCry.exe (PID: 7440)
- WannaCry.exe (PID: 7424)
- WannaCry.exe (PID: 4464)
- WannaCry.exe (PID: 7756)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 5176)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 5600)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7684)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7876)
- WannaCry.exe (PID: 3080)
- WannaCry.exe (PID: 6712)
- WannaCry.exe (PID: 7588)
- WannaCry.exe (PID: 7960)
- WannaCry.exe (PID: 4300)
- WannaCry.exe (PID: 1804)
- WannaCry.exe (PID: 208)
- WannaCry.exe (PID: 4488)
- WannaCry.exe (PID: 7904)
- WannaCry.exe (PID: 132)
- WannaCry.exe (PID: 7552)
- WannaCry.exe (PID: 5400)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 4424)
- WannaCry.exe (PID: 7308)
- WannaCry.exe (PID: 4180)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 5640)
- WannaCry.exe (PID: 780)
- WannaCry.exe (PID: 7784)
- WannaCry.exe (PID: 5304)
- WannaCry.exe (PID: 5588)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 7512)
- WannaCry.exe (PID: 7696)
- WannaCry.exe (PID: 4276)
- WannaCry.exe (PID: 7292)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 980)
- WannaCry.exe (PID: 3156)
- WannaCry.exe (PID: 7972)
- WannaCry.exe (PID: 3020)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 4000)
- WannaCry.exe (PID: 7856)
- WannaCry.exe (PID: 1504)
- WannaCry.exe (PID: 7716)
- WannaCry.exe (PID: 1328)
- WannaCry.exe (PID: 3744)
- WannaCry.exe (PID: 8180)
- WannaCry.exe (PID: 7804)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 7980)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 1532)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 5780)
- WannaCry.exe (PID: 3300)
- WannaCry.exe (PID: 6168)
- WannaCry.exe (PID: 6944)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 2148)
- WannaCry.exe (PID: 6192)
- WannaCry.exe (PID: 7648)
- WannaCry.exe (PID: 3684)
- WannaCry.exe (PID: 7704)
- WannaCry.exe (PID: 7404)
- WannaCry.exe (PID: 6032)
- WannaCry.exe (PID: 7760)
- WannaCry.exe (PID: 7476)
- WannaCry.exe (PID: 800)
- WannaCry.exe (PID: 7432)
- WannaCry.exe (PID: 6760)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 7660)
- WannaCry.exe (PID: 1004)
- WannaCry.exe (PID: 3080)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 616)
- WannaCry.exe (PID: 7412)
- WannaCry.exe (PID: 7724)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 240)
- WannaCry.exe (PID: 7732)
- WannaCry.exe (PID: 2088)
- WannaCry.exe (PID: 8056)
- WannaCry.exe (PID: 4688)
- WannaCry.exe (PID: 7020)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 5048)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 856)
- WannaCry.exe (PID: 5260)
- WannaCry.exe (PID: 7840)
- WannaCry.exe (PID: 7480)
- WannaCry.exe (PID: 7620)
- WannaCry.exe (PID: 8188)
- WannaCry.exe (PID: 1116)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 2772)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 6112)
- WannaCry.exe (PID: 832)
- WannaCry.exe (PID: 7568)
- WannaCry.exe (PID: 4924)
- WannaCry.exe (PID: 7696)
- WannaCry.exe (PID: 2216)
- WannaCry.exe (PID: 8068)
- WannaCry.exe (PID: 7520)
- WannaCry.exe (PID: 7800)
- WannaCry.exe (PID: 7720)
- WannaCry.exe (PID: 4152)
- WannaCry.exe (PID: 7360)
- WannaCry.exe (PID: 6480)
- WannaCry.exe (PID: 4000)
- WannaCry.exe (PID: 7856)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 5180)
- WannaCry.exe (PID: 3744)
- WannaCry.exe (PID: 2320)
- WannaCry.exe (PID: 7988)
- WannaCry.exe (PID: 8048)
- WannaCry.exe (PID: 6276)
- WannaCry.exe (PID: 7860)
- WannaCry.exe (PID: 2664)
- WannaCry.exe (PID: 5244)
- WannaCry.exe (PID: 5780)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 7176)
- WannaCry.exe (PID: 4436)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 5720)
- WannaCry.exe (PID: 2148)
- WannaCry.exe (PID: 6248)
- WannaCry.exe (PID: 7924)
- WannaCry.exe (PID: 5480)
- WannaCry.exe (PID: 5072)
- WannaCry.exe (PID: 4944)
- WannaCry.exe (PID: 1176)
- WannaCry.exe (PID: 4608)
- WannaCry.exe (PID: 7084)
- WannaCry.exe (PID: 7404)
- WannaCry.exe (PID: 1188)
- WannaCry.exe (PID: 2332)
- WannaCry.exe (PID: 7432)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 7824)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 2908)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 684)
- WannaCry.exe (PID: 5964)
- WannaCry.exe (PID: 6712)
- WannaCry.exe (PID: 5376)
- WannaCry.exe (PID: 5576)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7264)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 1452)
- WannaCry.exe (PID: 7248)
- WannaCry.exe (PID: 2416)
- WannaCry.exe (PID: 6324)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 7200)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 8168)
- WannaCry.exe (PID: 1388)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 4220)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 2772)
- WannaCry.exe (PID: 6112)
- WannaCry.exe (PID: 5588)
- WannaCry.exe (PID: 7644)
- WannaCry.exe (PID: 7136)
- WannaCry.exe (PID: 4200)
- WannaCry.exe (PID: 7392)
- WannaCry.exe (PID: 7484)
- WannaCry.exe (PID: 3020)
- WannaCry.exe (PID: 7800)
- WannaCry.exe (PID: 6264)
- WannaCry.exe (PID: 4280)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 5084)
- WannaCry.exe (PID: 7708)
- WannaCry.exe (PID: 6392)
- WannaCry.exe (PID: 3264)
- WannaCry.exe (PID: 7956)
- WannaCry.exe (PID: 300)
- WannaCry.exe (PID: 7936)
- WannaCry.exe (PID: 2392)
- WannaCry.exe (PID: 5056)
- WannaCry.exe (PID: 1164)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 4732)
- WannaCry.exe (PID: 4184)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 3744)
- WannaCry.exe (PID: 4408)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 1180)
- WannaCry.exe (PID: 3684)
- WannaCry.exe (PID: 5416)
- WannaCry.exe (PID: 7648)
- WannaCry.exe (PID: 1280)
- WannaCry.exe (PID: 4348)
- WannaCry.exe (PID: 6388)
- WannaCry.exe (PID: 1852)
- WannaCry.exe (PID: 2780)
- WannaCry.exe (PID: 7812)
- WannaCry.exe (PID: 4948)
- WannaCry.exe (PID: 1584)
- WannaCry.exe (PID: 6216)
- WannaCry.exe (PID: 7712)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 7768)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 7876)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 5504)
- WannaCry.exe (PID: 7824)
- WannaCry.exe (PID: 1072)
- WannaCry.exe (PID: 1672)
- WannaCry.exe (PID: 2140)
- WannaCry.exe (PID: 728)
- WannaCry.exe (PID: 6964)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 5156)
- WannaCry.exe (PID: 6584)
- WannaCry.exe (PID: 5216)
- WannaCry.exe (PID: 240)
- WannaCry.exe (PID: 2088)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 7300)
- WannaCry.exe (PID: 8080)
- WannaCry.exe (PID: 4172)
- WannaCry.exe (PID: 7784)
- WannaCry.exe (PID: 6256)
- WannaCry.exe (PID: 7840)
- WannaCry.exe (PID: 4336)
- WannaCry.exe (PID: 6156)
- WannaCry.exe (PID: 5552)
- WannaCry.exe (PID: 7512)
- WannaCry.exe (PID: 868)
- WannaCry.exe (PID: 1328)
- WannaCry.exe (PID: 5484)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 8096)
- WannaCry.exe (PID: 7720)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 8136)
- WannaCry.exe (PID: 5996)
- WannaCry.exe (PID: 5164)
- WannaCry.exe (PID: 7580)
- WannaCry.exe (PID: 5944)
- WannaCry.exe (PID: 7312)
- WannaCry.exe (PID: 5180)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 680)
- WannaCry.exe (PID: 5280)
- WannaCry.exe (PID: 6132)
- WannaCry.exe (PID: 7836)
- WannaCry.exe (PID: 7516)
- WannaCry.exe (PID: 7780)
- WannaCry.exe (PID: 1532)
- WannaCry.exe (PID: 7292)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 3012)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 8004)
- WannaCry.exe (PID: 1748)
- WannaCry.exe (PID: 776)
- WannaCry.exe (PID: 1280)
- WannaCry.exe (PID: 4104)
- WannaCry.exe (PID: 968)
- WannaCry.exe (PID: 540)
- WannaCry.exe (PID: 8024)
- WannaCry.exe (PID: 7396)
- WannaCry.exe (PID: 1176)
- WannaCry.exe (PID: 7228)
- WannaCry.exe (PID: 7084)
- WannaCry.exe (PID: 7756)
- WannaCry.exe (PID: 3164)
- WannaCry.exe (PID: 6760)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 4884)
- WannaCry.exe (PID: 7184)
- WannaCry.exe (PID: 7412)
- WannaCry.exe (PID: 4272)
- WannaCry.exe (PID: 7588)
- WannaCry.exe (PID: 7960)
- WannaCry.exe (PID: 6944)
- WannaCry.exe (PID: 4376)
- WannaCry.exe (PID: 448)
- WannaCry.exe (PID: 728)
- WannaCry.exe (PID: 8140)
- WannaCry.exe (PID: 8000)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 5400)
- WannaCry.exe (PID: 7872)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 7748)
- WannaCry.exe (PID: 8168)
- WannaCry.exe (PID: 2040)
- WannaCry.exe (PID: 6512)
- WannaCry.exe (PID: 7468)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 4336)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 3008)
- WannaCry.exe (PID: 7728)
- WannaCry.exe (PID: 7524)
- WannaCry.exe (PID: 7632)
- WannaCry.exe (PID: 7808)
- WannaCry.exe (PID: 6004)
- WannaCry.exe (PID: 8072)
- WannaCry.exe (PID: 4424)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 7672)
- WannaCry.exe (PID: 832)
- WannaCry.exe (PID: 5024)
- WannaCry.exe (PID: 7360)
- WannaCry.exe (PID: 4120)
- WannaCry.exe (PID: 5936)
- WannaCry.exe (PID: 3436)
- WannaCry.exe (PID: 7220)
- WannaCry.exe (PID: 6276)
- WannaCry.exe (PID: 7252)
- WannaCry.exe (PID: 7972)
- WannaCry.exe (PID: 3956)
- WannaCry.exe (PID: 6620)
- WannaCry.exe (PID: 3156)
- WannaCry.exe (PID: 2392)
- WannaCry.exe (PID: 6640)
- WannaCry.exe (PID: 6472)
- WannaCry.exe (PID: 2664)
- WannaCry.exe (PID: 7832)
- WannaCry.exe (PID: 2284)
- WannaCry.exe (PID: 4276)
- WannaCry.exe (PID: 3012)
- WannaCry.exe (PID: 8004)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 5624)
- WannaCry.exe (PID: 1516)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 3612)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 7980)
- WannaCry.exe (PID: 7176)
- WannaCry.exe (PID: 7984)
- WannaCry.exe (PID: 7396)
- WannaCry.exe (PID: 5136)
- WannaCry.exe (PID: 7376)
- WannaCry.exe (PID: 7736)
- WannaCry.exe (PID: 3960)
- WannaCry.exe (PID: 8152)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7824)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 4528)
- WannaCry.exe (PID: 1188)
- WannaCry.exe (PID: 7244)
- WannaCry.exe (PID: 6216)
- WannaCry.exe (PID: 7552)
- WannaCry.exe (PID: 1012)
- WannaCry.exe (PID: 4692)
- WannaCry.exe (PID: 8164)
- WannaCry.exe (PID: 6612)
- WannaCry.exe (PID: 208)
- WannaCry.exe (PID: 3416)
- WannaCry.exe (PID: 7320)
- WannaCry.exe (PID: 6028)
- WannaCry.exe (PID: 7260)
- WannaCry.exe (PID: 7208)
- WannaCry.exe (PID: 7760)
- WannaCry.exe (PID: 7872)
- WannaCry.exe (PID: 1912)
- WannaCry.exe (PID: 7440)
- WannaCry.exe (PID: 6516)
- WannaCry.exe (PID: 5776)
- WannaCry.exe (PID: 7728)
- WannaCry.exe (PID: 2028)
- WannaCry.exe (PID: 1700)
- WannaCry.exe (PID: 7848)
- WannaCry.exe (PID: 5552)
- WannaCry.exe (PID: 7556)
- WannaCry.exe (PID: 6488)
- WannaCry.exe (PID: 6572)
- WannaCry.exe (PID: 7468)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 8096)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 7800)
- WannaCry.exe (PID: 6700)
- WannaCry.exe (PID: 4112)
- WannaCry.exe (PID: 2812)
- WannaCry.exe (PID: 1152)
- WannaCry.exe (PID: 7944)
- WannaCry.exe (PID: 8104)
- WannaCry.exe (PID: 4268)
- WannaCry.exe (PID: 7484)
- WannaCry.exe (PID: 3024)
- WannaCry.exe (PID: 4572)
- WannaCry.exe (PID: 5380)
- WannaCry.exe (PID: 5024)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 6436)
- WannaCry.exe (PID: 6384)
- WannaCry.exe (PID: 5188)
- WannaCry.exe (PID: 7052)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 5124)
- WannaCry.exe (PID: 4452)
- WannaCry.exe (PID: 2664)
- WannaCry.exe (PID: 6676)
- WannaCry.exe (PID: 8004)
- WannaCry.exe (PID: 7668)
- WannaCry.exe (PID: 7232)
- WannaCry.exe (PID: 5308)
- WannaCry.exe (PID: 2476)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 8048)
- WannaCry.exe (PID: 4352)
- WannaCry.exe (PID: 7228)
- WannaCry.exe (PID: 7488)
- WannaCry.exe (PID: 7664)
- WannaCry.exe (PID: 7768)
- WannaCry.exe (PID: 3160)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 6216)
- WannaCry.exe (PID: 8100)
- WannaCry.exe (PID: 7804)
- WannaCry.exe (PID: 5512)
- WannaCry.exe (PID: 2692)
- WannaCry.exe (PID: 7412)
- WannaCry.exe (PID: 8064)
- WannaCry.exe (PID: 7636)
- WannaCry.exe (PID: 5968)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7452)
- WannaCry.exe (PID: 7572)
- WannaCry.exe (PID: 4688)
- WannaCry.exe (PID: 7584)
- WannaCry.exe (PID: 5228)
- WannaCry.exe (PID: 744)
- WannaCry.exe (PID: 8000)
- WannaCry.exe (PID: 3968)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 616)
- WannaCry.exe (PID: 4380)
- WannaCry.exe (PID: 3008)
- WannaCry.exe (PID: 7364)
- WannaCry.exe (PID: 8052)
- WannaCry.exe (PID: 2028)
- WannaCry.exe (PID: 5868)
- WannaCry.exe (PID: 2216)
- WannaCry.exe (PID: 7848)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 4284)
- WannaCry.exe (PID: 5204)
- WannaCry.exe (PID: 7952)
- WannaCry.exe (PID: 8068)
- WannaCry.exe (PID: 828)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 5436)
- WannaCry.exe (PID: 5408)
- WannaCry.exe (PID: 632)
- WannaCry.exe (PID: 4560)
- WannaCry.exe (PID: 3124)
- WannaCry.exe (PID: 5484)
- WannaCry.exe (PID: 1328)
- WannaCry.exe (PID: 7048)
- WannaCry.exe (PID: 7472)
- WannaCry.exe (PID: 7316)
- WannaCry.exe (PID: 4268)
- WannaCry.exe (PID: 4924)
- WannaCry.exe (PID: 5708)
- WannaCry.exe (PID: 300)
- WannaCry.exe (PID: 5020)
- WannaCry.exe (PID: 7580)
- WannaCry.exe (PID: 6904)
- WannaCry.exe (PID: 1504)
- WannaCry.exe (PID: 6244)
- WannaCry.exe (PID: 7780)
- WannaCry.exe (PID: 7764)
- WannaCry.exe (PID: 8112)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 4276)
- WannaCry.exe (PID: 8048)
- WannaCry.exe (PID: 6436)
- WannaCry.exe (PID: 7660)
- WannaCry.exe (PID: 1516)
- WannaCry.exe (PID: 5212)
- WannaCry.exe (PID: 8172)
- WannaCry.exe (PID: 7860)
- WannaCry.exe (PID: 7232)
- WannaCry.exe (PID: 3276)
- WannaCry.exe (PID: 4000)
- WannaCry.exe (PID: 4352)
- WannaCry.exe (PID: 8040)
- WannaCry.exe (PID: 1672)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 2384)
- WannaCry.exe (PID: 4728)
- WannaCry.exe (PID: 2692)
- WannaCry.exe (PID: 7132)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 7404)
- WannaCry.exe (PID: 7884)
- WannaCry.exe (PID: 2368)
- WannaCry.exe (PID: 6240)
- WannaCry.exe (PID: 6124)
- WannaCry.exe (PID: 7584)
- WannaCry.exe (PID: 5728)
- WannaCry.exe (PID: 800)
- WannaCry.exe (PID: 448)
- WannaCry.exe (PID: 4172)
- WannaCry.exe (PID: 7872)
- WannaCry.exe (PID: 7284)
- WannaCry.exe (PID: 1388)
- WannaCry.exe (PID: 7268)
- WannaCry.exe (PID: 7328)
- WannaCry.exe (PID: 6156)
- WannaCry.exe (PID: 1584)
- WannaCry.exe (PID: 8016)
- WannaCry.exe (PID: 4220)
- WannaCry.exe (PID: 7528)
- WannaCry.exe (PID: 7680)
- WannaCry.exe (PID: 1760)
- WannaCry.exe (PID: 536)
- WannaCry.exe (PID: 4380)
- WannaCry.exe (PID: 6512)
- WannaCry.exe (PID: 4696)
- WannaCry.exe (PID: 8072)
- WannaCry.exe (PID: 5260)
- WannaCry.exe (PID: 4776)
- WannaCry.exe (PID: 2320)
- WannaCry.exe (PID: 8096)
- WannaCry.exe (PID: 5348)
- WannaCry.exe (PID: 7436)
- WannaCry.exe (PID: 1700)
- WannaCry.exe (PID: 3304)
- WannaCry.exe (PID: 7392)
- WannaCry.exe (PID: 8080)
- WannaCry.exe (PID: 6620)
- WannaCry.exe (PID: 5556)
- WannaCry.exe (PID: 4268)
- WannaCry.exe (PID: 7576)
- WannaCry.exe (PID: 7312)
- WannaCry.exe (PID: 6392)
- WannaCry.exe (PID: 7700)
- WannaCry.exe (PID: 868)
- WannaCry.exe (PID: 7292)
- WannaCry.exe (PID: 7832)
- WannaCry.exe (PID: 5996)
- WannaCry.exe (PID: 3800)
- WannaCry.exe (PID: 4924)
- WannaCry.exe (PID: 3032)
- WannaCry.exe (PID: 5708)
- WannaCry.exe (PID: 4436)
- WannaCry.exe (PID: 1300)
- WannaCry.exe (PID: 7500)
- WannaCry.exe (PID: 872)
- WannaCry.exe (PID: 3016)
- WannaCry.exe (PID: 2516)
- WannaCry.exe (PID: 8108)
- WannaCry.exe (PID: 6876)
- WannaCry.exe (PID: 7752)
- WannaCry.exe (PID: 6372)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 3960)
- WannaCry.exe (PID: 3100)
- WannaCry.exe (PID: 7692)
- WannaCry.exe (PID: 5376)
- WannaCry.exe (PID: 7736)
- WannaCry.exe (PID: 6500)
- WannaCry.exe (PID: 7420)
- WannaCry.exe (PID: 7176)
- WannaCry.exe (PID: 4528)
- WannaCry.exe (PID: 800)
- WannaCry.exe (PID: 3884)
- WannaCry.exe (PID: 7424)
- WannaCry.exe (PID: 3796)
- WannaCry.exe (PID: 7236)
- WannaCry.exe (PID: 7188)
- WannaCry.exe (PID: 3876)
- WannaCry.exe (PID: 8100)
- WannaCry.exe (PID: 2692)
- WannaCry.exe (PID: 7608)
- WannaCry.exe (PID: 5728)
- WannaCry.exe (PID: 7300)
- WannaCry.exe (PID: 2616)
- WannaCry.exe (PID: 660)
- WannaCry.exe (PID: 2800)
- WannaCry.exe (PID: 7732)
- WannaCry.exe (PID: 5400)
- WannaCry.exe (PID: 8160)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 3676)
- WannaCry.exe (PID: 4040)
- WannaCry.exe (PID: 4336)
- WannaCry.exe (PID: 8060)
- WannaCry.exe (PID: 7352)
- WannaCry.exe (PID: 8016)
- WannaCry.exe (PID: 7680)
- WannaCry.exe (PID: 4172)
- WannaCry.exe (PID: 7848)
- WannaCry.exe (PID: 536)
- WannaCry.exe (PID: 7436)
- WannaCry.exe (PID: 5204)
- WannaCry.exe (PID: 8072)
- WannaCry.exe (PID: 8176)
- WannaCry.exe (PID: 1168)
- WannaCry.exe (PID: 4280)
- WannaCry.exe (PID: 6264)
- WannaCry.exe (PID: 4304)
- WannaCry.exe (PID: 632)
- WannaCry.exe (PID: 7748)
- WannaCry.exe (PID: 5952)
- WannaCry.exe (PID: 6132)
- WannaCry.exe (PID: 8168)
- WannaCry.exe (PID: 7324)
- WannaCry.exe (PID: 7672)
- WannaCry.exe (PID: 6964)
- WannaCry.exe (PID: 6228)
- WannaCry.exe (PID: 5280)
- WannaCry.exe (PID: 7468)
- WannaCry.exe (PID: 5124)
- WannaCry.exe (PID: 1532)
- WannaCry.exe (PID: 7348)
- WannaCry.exe (PID: 6676)
- WannaCry.exe (PID: 968)
- WannaCry.exe (PID: 2084)
- WannaCry.exe (PID: 7684)
- WannaCry.exe (PID: 6904)
- WannaCry.exe (PID: 7496)
- WannaCry.exe (PID: 6744)
- WannaCry.exe (PID: 1300)
- WannaCry.exe (PID: 7596)
- WannaCry.exe (PID: 7488)
- WannaCry.exe (PID: 5780)
- WannaCry.exe (PID: 8108)
- WannaCry.exe (PID: 5404)
- WannaCry.exe (PID: 7712)
- WannaCry.exe (PID: 736)
- WannaCry.exe (PID: 6760)
- WannaCry.exe (PID: 5600)
- WannaCry.exe (PID: 8040)
- WannaCry.exe (PID: 7944)
- WannaCry.exe (PID: 7772)
- WannaCry.exe (PID: 6700)
- WannaCry.exe (PID: 4920)
- WannaCry.exe (PID: 6240)
- WannaCry.exe (PID: 5720)
- WannaCry.exe (PID: 7444)
- WannaCry.exe (PID: 2192)
- WannaCry.exe (PID: 4692)
- WannaCry.exe (PID: 6208)
- WannaCry.exe (PID: 4728)
- WannaCry.exe (PID: 4452)
- WannaCry.exe (PID: 4736)
- WannaCry.exe (PID: 7212)
- WannaCry.exe (PID: 5728)
- WannaCry.exe (PID: 7544)
- WannaCry.exe (PID: 6516)
- WannaCry.exe (PID: 776)
- WannaCry.exe (PID: 2896)
- WannaCry.exe (PID: 4224)
- WannaCry.exe (PID: 7640)
- WannaCry.exe (PID: 7980)
- WannaCry.exe (PID: 7624)
- WannaCry.exe (PID: 6820)
- WannaCry.exe (PID: 8028)
- WannaCry.exe (PID: 1228)
- WannaCry.exe (PID: 4220)
- WannaCry.exe (PID: 7896)
- WannaCry.exe (PID: 1136)
- WannaCry.exe (PID: 7308)
- WannaCry.exe (PID: 536)
- WannaCry.exe (PID: 4284)
- WannaCry.exe (PID: 6004)
- WannaCry.exe (PID: 7776)
- WannaCry.exe (PID: 7332)
- WannaCry.exe (PID: 4672)
- WannaCry.exe (PID: 8024)
- WannaCry.exe (PID: 2140)
- WannaCry.exe (PID: 1568)
- WannaCry.exe (PID: 1244)
- WannaCry.exe (PID: 7360)
- WannaCry.exe (PID: 1168)
- WannaCry.exe (PID: 4280)
- WannaCry.exe (PID: 3240)
Application launched itself
- firefox.exe (PID: 6080)
- firefox.exe (PID: 6512)
- firefox.exe (PID: 7280)
- firefox.exe (PID: 7972)
Reads the software policy settings
- slui.exe (PID: 660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2009:07:14 00:03:18+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 28672 |
| InitializedDataSize: | 196608 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6f9a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.1.7600.16385 |
| ProductVersionNumber: | 6.1.7600.16385 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | dvdplay placeholder Application |
| FileVersion: | 6.1.7600.16385 (win7_rtm.090713-1255) |
| InternalName: | dvdplay |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | dvdplay |
| ProductName: | Microsoft® Windows® Operating System |
| ProductVersion: | 6.1.7600.16385 |
Total processes
1 035
Monitored processes
900
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 132 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 208 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 208 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 240 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 240 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 300 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 300 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 444 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 444 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 448 | "C:\Users\admin\Desktop\WannaCry.exe" | C:\Users\admin\Desktop\WannaCry.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: dvdplay placeholder Application Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
52 163
Read events
52 153
Write events
10
Delete events
0
Modification events
| (PID) Process: | (1132) WannaCry.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WannaCryptor |
| Operation: | write | Name: | wd |
Value: C:\Users\admin\Desktop | |||
| (PID) Process: | (1132) WannaCry.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Microsoft Update Task Scheduler |
Value: "C:\Users\admin\Desktop\WannaCry.exe" /r | |||
| (PID) Process: | (728) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (728) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (728) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (6512) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (7984) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7984) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7984) !WannaDecryptor!.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7280) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
Executable files
7
Suspicious files
1 932
Text files
329
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4880 | cmd.exe | C:\Users\admin\Desktop\c.vbs | text | |
MD5:2C69421394B3CF1E8531E5BA60824C2F | SHA256:89CDEBC8A19455D87815A80CEE66AE366C3391D6A776F21753248CF2DC857554 | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\00000000.res | binary | |
MD5:75E7377EA587CFCF0AC8B608F9E1C9D5 | SHA256:F975391B7B3047CB11525AC492B7778BC089E93404B96C8A0D0B2185C725A820 | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\awardyears.rtf.WCRYT | binary | |
MD5:B306C6D0BC6679406E982B774BC3CDBD | SHA256:4C9A50C2096B264D49C6AF37FE5BD7AD5017EB91D8168E777397BD2D4BDA135F | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\awardyears.rtf | binary | |
MD5:311F39900F4A1F411CAA46BB07F72F60 | SHA256:70DB545CB746448102445397ED85418816F465EA36FBB6419C1DD9274928BDBD | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\00000000.pky | binary | |
MD5:D4D37A4B9882E82062924C0EE2B66309 | SHA256:287D900FE8C294A3E8C6161398A68D88EEA720A4F05F7BE22BA97514BCF58F40 | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\!WannaDecryptor!.exe | executable | |
MD5:CF1416074CD7791AB80A18F9E7E219D9 | SHA256:78E3F87F31688355C0F398317B2D87D803BD87EE3656C5A7C80F0561EC8606DF | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\!Please Read Me!.txt | text | |
MD5:AFA18CF4AA2660392111763FB93A8C3D | SHA256:227082C719FD4394C1F2311A0877D8A302C5B092BCC49F853A5CF3D2945F42B0 | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\u.wry | executable | |
MD5:CF1416074CD7791AB80A18F9E7E219D9 | SHA256:78E3F87F31688355C0F398317B2D87D803BD87EE3656C5A7C80F0561EC8606DF | |||
| 4628 | cscript.exe | C:\Users\admin\Desktop\!WannaDecryptor!.exe.lnk | binary | |
MD5:7FC4443AF9AA919F4FED1A7A81E2253D | SHA256:20B93F3561BE2E1637A4B1077C302B36A9735EEB96D54ACBEFC433D2CEEE300E | |||
| 1132 | WannaCry.exe | C:\Users\admin\Desktop\createmodule.rtf.WCRYT | binary | |
MD5:ED444432EDD8368FBED23C4F699E7EFD | SHA256:E86EDA728A802DEE6A59D70A2923B6BE36FBA52CB92DFE7BA135B6D1D1627F42 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
107
DNS requests
160
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6512 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6512 | firefox.exe | POST | 200 | 23.32.238.27:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
6512 | firefox.exe | POST | 200 | 23.32.238.27:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
6512 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
6512 | firefox.exe | POST | 200 | 23.32.238.27:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
6512 | firefox.exe | POST | — | 142.250.185.131:80 | http://o.pki.goog/s/wr3/3H4 | unknown | — | — | whitelisted |
5116 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5116 | SIHClient.exe | 20.12.23.50:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |