Technical Information
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'discord' = '%LOCALAPPDATA%\discord.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UpdateTask' = '%APPDATA%\svchost.exe'
- %WINDIR%\taskse.exe
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- System Restore (SR)
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state on
- '%WINDIR%\syswow64\netsh.exe' advfirewall set allprofiles state off
- '%WINDIR%\syswow64\taskkill.exe' /F /IM BackupExecAgentBrowser*
- '%WINDIR%\syswow64\taskkill.exe' /F /IM BackupExecDiveciMediaService*
- '%WINDIR%\syswow64\taskkill.exe' /F /IM BackupExecJobEngine*
- '%WINDIR%\syswow64\taskkill.exe' /F /IM BackupExecManagementService*
- '%WINDIR%\syswow64\taskkill.exe' /F /IM vss*
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\taskkill.exe' /F /IM sql*
- '%WINDIR%\syswow64\netsh.exe' advfirewall set domainprofile state off
- '%WINDIR%\syswow64\taskkill.exe' /F /IM svc$*
- '%WINDIR%\syswow64\netsh.exe' advfirewall set privateprofile state off
- %WINDIR%\syswow64\netsh.exe
- firefox.exe
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\tileimage.bmp
- %WINDIR%\1v.exe
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx.wncryt
- %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt
- %HOMEPATH%\desktop\applicantform_en.doc.wncryt
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt
- %HOMEPATH%\desktop\3.jpeg.wncryt
- %HOMEPATH%\desktop\1189.jpeg.wncryt
- %WINDIR%\@please_read_me@.txt
- %WINDIR%\88041726243125.bat
- %WINDIR%\@wanadecryptor@.exe
- %WINDIR%\00000000.res
- %WINDIR%\00000000.eky
- %WINDIR%\00000000.pky
- %WINDIR%\slam_mbr.exe
- %WINDIR%\u.wnry
- %WINDIR%\t.wnry
- %WINDIR%\taskdl.exe
- %APPDATA%\uac_location
- %HOMEPATH%\desktop\parnas_01.jpeg.wncryt
- D:\readme.txt
- D:\$recycle.bin\readme.txt
- %APPDATA%\id
- %APPDATA%\svchost.exe
- %WINDIR%\@wanadecryptor@.exe.lnk
- %APPDATA%\vcruntime140d.dll
- %APPDATA%\ucrtbased.dll
- %APPDATA%\uac.exe
- %WINDIR%\msg\m_polish.wnry
- <Current directory>\bouncycastle.crypto.dll
- %HOMEPATH%\desktop\correct.avi.wncryt
- %HOMEPATH%\desktop\@wanadecryptor@.exe
- %HOMEPATH%\desktop\@please_read_me@.txt
- %HOMEPATH%\desktop\weeklysheet1215.doc.wncryt
- %WINDIR%\m.vbs
- %HOMEPATH%\desktop\sdszfo.docx.wncryt
- %WINDIR%\nudes.exe
- %WINDIR%\s.wnry
- %WINDIR%\r.wnry
- %WINDIR%\msg\m_dutch.wnry
- %WINDIR%\msg\m_danish.wnry
- %WINDIR%\msg\m_czech.wnry
- %WINDIR%\msg\m_croatian.wnry
- %WINDIR%\msg\m_chinese (traditional).wnry
- %WINDIR%\msg\m_chinese (simplified).wnry
- %WINDIR%\msg\m_bulgarian.wnry
- %WINDIR%\c.wnry
- %WINDIR%\b.wnry
- %WINDIR%\nigger.exe
- %WINDIR%\gayshit.exe
- %WINDIR%\endermanch@wannacrypt0r.exe
- %WINDIR%\1233.exe
- %WINDIR%\23x.exe
- %WINDIR%\msg\m_filipino.wnry
- %WINDIR%\msg\m_finnish.wnry
- %WINDIR%\msg\m_english.wnry
- %WINDIR%\msg\m_french.wnry
- %WINDIR%\msg\m_vietnamese.wnry
- %WINDIR%\msg\m_german.wnry
- %WINDIR%\msg\m_turkish.wnry
- %WINDIR%\msg\m_swedish.wnry
- %WINDIR%\msg\m_spanish.wnry
- %WINDIR%\msg\m_slovak.wnry
- %WINDIR%\msg\m_russian.wnry
- %WINDIR%\msg\m_romanian.wnry
- %APPDATA%\ogl2cylhxbvgsfyb5glduvmcz3nmtx.exe
- %TEMP%\0cb67e2f\45ca.tmp
- %WINDIR%\msg\m_norwegian.wnry
- %WINDIR%\msg\m_latvian.wnry
- %WINDIR%\msg\m_korean.wnry
- %WINDIR%\msg\m_japanese.wnry
- %WINDIR%\msg\m_italian.wnry
- %WINDIR%\msg\m_indonesian.wnry
- %WINDIR%\msg\m_greek.wnry
- %WINDIR%\msg\m_portuguese.wnry
- %TEMP%\0cb67e2f\dc95.tmp
- <Current directory>\bouncycastle.crypto.dll
- %WINDIR%\m.vbs
- %APPDATA%\svchost.exe
- from %HOMEPATH%\desktop\1189.jpeg.wncryt to %HOMEPATH%\desktop\1189.jpeg.wncry
- from %HOMEPATH%\desktop\3.jpeg.wncryt to %HOMEPATH%\desktop\3.jpeg.wncry
- from %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.wncry
- from %HOMEPATH%\desktop\applicantform_en.doc.wncryt to %HOMEPATH%\desktop\applicantform_en.doc.wncry
- from %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt to %HOMEPATH%\desktop\february_catalogue__2015.doc.wncry
- from %HOMEPATH%\desktop\holycrosschurchinstructions.docx.wncryt to %HOMEPATH%\desktop\holycrosschurchinstructions.docx.wncry
- from %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt to %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncry
- from %HOMEPATH%\desktop\parnas_01.jpeg.wncryt to %HOMEPATH%\desktop\parnas_01.jpeg.wncry
- from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
- from %HOMEPATH%\desktop\weeklysheet1215.doc.wncryt to %HOMEPATH%\desktop\weeklysheet1215.doc.wncry
- from %HOMEPATH%\desktop\correct.avi.wncryt to %HOMEPATH%\desktop\correct.avi.wncry
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\correct.avi
- '93.#07.12.0':6893
- '87.##.178.142':6893
- '87.##.178.143':6893
- '87.##.178.144':6893
- '87.##.178.145':6893
- '87.##.178.146':6893
- '87.##.178.147':6893
- '87.##.178.148':6893
- '87.##.178.149':6893
- '87.##.178.150':6893
- '87.##.178.151':6893
- '87.##.178.152':6893
- '87.##.178.153':6893
- '87.##.178.154':6893
- '87.##.178.171':6893
- '87.##.178.141':6893
- '87.##.178.140':6893
- '87.##.178.158':6893
- '87.##.178.159':6893
- '87.##.178.160':6893
- '87.##.178.161':6893
- '87.##.178.162':6893
- '87.##.178.163':6893
- '87.##.178.164':6893
- '87.##.178.165':6893
- '87.##.178.166':6893
- '87.##.178.167':6893
- '87.##.178.168':6893
- '87.##.178.169':6893
- '87.##.178.170':6893
- '87.##.178.155':6893
- '87.##.178.157':6893
- '87.##.178.106':6893
- '87.##.178.156':6893
- '87.##.178.122':6893
- '87.##.178.108':6893
- '87.##.178.109':6893
- '87.##.178.110':6893
- '87.##.178.111':6893
- '87.##.178.112':6893
- '87.##.178.113':6893
- '87.##.178.114':6893
- '87.##.178.115':6893
- '87.##.178.116':6893
- '87.##.178.117':6893
- '87.##.178.118':6893
- '87.##.178.119':6893
- '87.##.178.120':6893
- '87.##.178.137':6893
- '87.##.178.139':6893
- '87.##.178.138':6893
- '87.##.178.124':6893
- '87.##.178.125':6893
- '87.##.178.126':6893
- '87.##.178.127':6893
- '87.##.178.128':6893
- '87.##.178.129':6893
- '87.##.178.130':6893
- '87.##.178.131':6893
- '87.##.178.132':6893
- '87.##.178.133':6893
- '87.##.178.134':6893
- '87.##.178.135':6893
- '87.##.178.136':6893
- '87.##.178.121':6893
- '87.##.178.123':6893
- '87.##.178.107':6893
- '87.##.178.172':6893
- '87.##.178.176':6893
- '87.##.178.210':6893
- '87.##.178.211':6893
- '87.##.178.212':6893
- '87.##.178.213':6893
- '87.##.178.214':6893
- '87.##.178.215':6893
- '87.##.178.216':6893
- '87.##.178.217':6893
- '87.##.178.218':6893
- '87.##.178.219':6893
- '87.##.178.220':6893
- '87.##.178.221':6893
- '87.##.178.222':6893
- '87.##.178.208':6893
- '87.##.178.209':6893
- '87.##.178.223':6893
- '87.##.178.224':6893
- '87.##.178.238':6893
- '87.##.178.237':6893
- '87.##.178.236':6893
- '87.##.178.235':6893
- '87.##.178.234':6893
- '87.##.178.240':6893
- '87.##.178.233':6893
- '87.##.178.231':6893
- '87.##.178.230':6893
- '87.##.178.229':6893
- '87.##.178.228':6893
- '87.##.178.227':6893
- '87.##.178.226':6893
- '87.##.178.225':6893
- '87.##.178.174':6893
- '87.##.178.173':6893
- '87.##.178.205':6893
- '87.##.178.177':6893
- '87.##.178.178':6893
- '87.##.178.179':6893
- '87.##.178.180':6893
- '87.##.178.181':6893
- '87.##.178.182':6893
- '87.##.178.183':6893
- '87.##.178.184':6893
- '87.##.178.185':6893
- '87.##.178.186':6893
- '87.##.178.187':6893
- '87.##.178.188':6893
- '87.##.178.206':6893
- '87.##.178.175':6893
- '87.##.178.207':6893
- '87.##.178.189':6893
- '87.##.178.193':6893
- '87.##.178.194':6893
- '87.##.178.195':6893
- '87.##.178.196':6893
- '87.##.178.197':6893
- '87.##.178.198':6893
- '87.##.178.199':6893
- '87.##.178.200':6893
- '87.##.178.201':6893
- '87.##.178.202':6893
- '87.##.178.203':6893
- '87.##.178.204':6893
- '87.##.178.190':6893
- '87.##.178.191':6893
- '87.##.178.192':6893
- '87.##.178.232':6893
- '87.##.178.239':6893
- '87.##.178.103':6893
- '87.#8.178.7':6893
- '87.#8.178.8':6893
- '87.#8.178.9':6893
- '87.##.178.10':6893
- '87.##.178.11':6893
- '87.##.178.12':6893
- '87.##.178.13':6893
- '87.##.178.14':6893
- '87.##.178.15':6893
- '87.##.178.16':6893
- '87.##.178.17':6893
- '87.##.178.18':6893
- '87.#8.178.4':6893
- '87.#8.178.3':6893
- '87.#8.178.6':6893
- '87.##.178.19':6893
- '87.##.178.23':6893
- '87.##.178.24':6893
- '87.##.178.25':6893
- '87.##.178.26':6893
- '87.##.178.27':6893
- '87.##.178.28':6893
- '87.##.178.29':6893
- '87.##.178.30':6893
- '87.##.178.31':6893
- '87.##.178.32':6893
- '87.##.178.33':6893
- '87.##.178.34':6893
- '87.##.178.20':6893
- '87.##.178.21':6893
- '87.##.178.22':6893
- '87.#8.178.5':6893
- '87.##.178.35':6893
- '87.##.178.104':6893
- '87.##.177.229':6893
- '87.##.177.230':6893
- '87.##.177.231':6893
- '87.##.177.232':6893
- '87.##.177.233':6893
- '87.##.177.234':6893
- '87.##.177.235':6893
- '87.##.177.236':6893
- '87.##.177.237':6893
- '87.##.177.238':6893
- '87.##.177.239':6893
- '87.##.177.240':6893
- '87.#8.178.2':6893
- '87.##.177.227':6893
- '87.#8.178.1':6893
- '87.##.177.241':6893
- '87.##.177.245':6893
- '87.##.177.246':6893
- '87.##.177.247':6893
- '87.##.177.248':6893
- '87.##.177.249':6893
- '87.##.177.250':6893
- '87.##.177.251':6893
- '87.##.177.252':6893
- '87.##.177.253':6893
- '87.##.177.254':6893
- '87.##.177.255':6893
- '87.#8.178.0':6893
- '87.##.177.242':6893
- '87.##.177.243':6893
- '87.##.177.244':6893
- '87.##.178.105':6893
- '87.##.178.36':6893
- '87.##.178.40':6893
- '87.##.178.75':6893
- '87.##.178.76':6893
- '87.##.178.77':6893
- '87.##.178.78':6893
- '87.##.178.79':6893
- '87.##.178.80':6893
- '87.##.178.81':6893
- '87.##.178.82':6893
- '87.##.178.83':6893
- '87.##.178.84':6893
- '87.##.178.85':6893
- '87.##.178.86':6893
- '87.##.178.72':6893
- '87.##.178.71':6893
- '87.##.178.74':6893
- '87.##.178.87':6893
- '87.##.178.91':6893
- '87.##.178.92':6893
- '87.##.178.93':6893
- '87.##.178.94':6893
- '87.##.178.95':6893
- '87.##.178.96':6893
- '87.##.178.97':6893
- '87.##.178.98':6893
- '87.##.178.99':6893
- '87.##.178.100':6893
- '87.##.178.101':6893
- '87.##.178.102':6893
- '87.##.178.88':6893
- '87.##.178.89':6893
- '87.##.178.90':6893
- '87.##.178.73':6893
- '87.##.178.37':6893
- '87.##.178.38':6893
- '87.##.178.41':6893
- '87.##.178.42':6893
- '87.##.178.43':6893
- '87.##.178.44':6893
- '87.##.178.45':6893
- '87.##.178.46':6893
- '87.##.178.47':6893
- '87.##.178.48':6893
- '87.##.178.49':6893
- '87.##.178.50':6893
- '87.##.178.51':6893
- '87.##.178.52':6893
- '87.##.178.70':6893
- '87.##.178.39':6893
- '87.##.178.69':6893
- '87.##.178.53':6893
- '87.##.178.57':6893
- '87.##.178.58':6893
- '87.##.178.59':6893
- '87.##.178.60':6893
- '87.##.178.61':6893
- '87.##.178.62':6893
- '87.##.178.63':6893
- '87.##.178.64':6893
- '87.##.178.65':6893
- '87.##.178.66':6893
- '87.##.178.67':6893
- '87.##.178.68':6893
- '87.##.178.54':6893
- '87.##.178.55':6893
- '87.##.178.56':6893
- '87.##.177.45':6893
- '87.##.178.241':6893
- '87.##.179.158':6893
- '87.##.179.160':6893
- '87.##.179.161':6893
- '87.##.179.162':6893
- '87.##.179.163':6893
- '87.##.179.164':6893
- '87.##.179.165':6893
- '87.##.179.166':6893
- '87.##.179.167':6893
- '87.##.179.168':6893
- '87.##.179.169':6893
- '87.##.179.170':6893
- '87.##.179.171':6893
- '87.##.179.157':6893
- '87.##.179.156':6893
- '87.##.179.159':6893
- '87.##.179.172':6893
- '87.##.179.176':6893
- '87.##.179.177':6893
- '87.##.179.178':6893
- '87.##.179.179':6893
- '87.##.179.180':6893
- '87.##.179.181':6893
- '87.##.179.182':6893
- '87.##.179.183':6893
- '87.##.179.184':6893
- '87.##.179.185':6893
- '87.##.179.186':6893
- '87.##.179.187':6893
- '87.##.179.173':6893
- '87.##.179.174':6893
- '87.##.179.175':6893
- '87.##.179.189':6893
- '87.##.179.188':6893
- '87.##.179.123':6893
- '87.##.179.126':6893
- '87.##.179.127':6893
- '87.##.179.128':6893
- '87.##.179.129':6893
- '87.##.179.130':6893
- '87.##.179.131':6893
- '87.##.179.132':6893
- '87.##.179.133':6893
- '87.##.179.134':6893
- '87.##.179.135':6893
- '87.##.179.136':6893
- '87.##.179.137':6893
- '87.##.179.155':6893
- '87.##.179.124':6893
- '87.##.179.154':6893
- '87.##.179.138':6893
- '87.##.179.142':6893
- '87.##.179.143':6893
- '87.##.179.144':6893
- '87.##.179.145':6893
- '87.##.179.146':6893
- '87.##.179.147':6893
- '87.##.179.148':6893
- '87.##.179.149':6893
- '87.##.179.150':6893
- '87.##.179.151':6893
- '87.##.179.152':6893
- '87.##.179.153':6893
- '87.##.179.139':6893
- '87.##.179.140':6893
- '87.##.179.141':6893
- '87.##.179.125':6893
- '87.##.179.191':6893
- '87.##.179.194':6893
- '87.##.179.228':6893
- '87.##.179.229':6893
- '87.##.179.230':6893
- '87.##.179.231':6893
- '87.##.179.232':6893
- '87.##.179.233':6893
- '87.##.179.234':6893
- '87.##.179.235':6893
- '87.##.179.236':6893
- '87.##.179.237':6893
- '87.##.179.238':6893
- '87.##.179.239':6893
- '87.##.179.225':6893
- '87.##.179.240':6893
- '87.##.179.227':6893
- '87.##.179.242':6893
- '87.##.179.190':6893
- '87.##.179.241':6893
- '87.##.179.255':6893
- '87.##.179.254':6893
- '87.##.179.253':6893
- '87.##.179.252':6893
- '87.##.178.242':6893
- '87.##.179.251':6893
- '87.##.179.249':6893
- '87.##.179.248':6893
- '87.##.179.247':6893
- '87.##.179.246':6893
- '87.##.179.245':6893
- '87.##.179.244':6893
- '87.##.179.243':6893
- '87.##.179.226':6893
- '87.##.179.224':6893
- '87.##.179.192':6893
- '87.##.179.195':6893
- '87.##.179.196':6893
- '87.##.179.197':6893
- '87.##.179.198':6893
- '87.##.179.199':6893
- '87.##.179.200':6893
- '87.##.179.201':6893
- '87.##.179.202':6893
- '87.##.179.203':6893
- '87.##.179.204':6893
- '87.##.179.205':6893
- '87.##.179.223':6893
- '87.##.179.206':6893
- '87.##.179.193':6893
- '87.##.179.222':6893
- '87.##.179.208':6893
- '87.##.179.211':6893
- '87.##.179.212':6893
- '87.##.179.213':6893
- '87.##.179.214':6893
- '87.##.179.215':6893
- '87.##.179.216':6893
- '87.##.179.217':6893
- '87.##.179.218':6893
- '87.##.179.219':6893
- '87.##.179.220':6893
- '87.##.179.221':6893
- '87.##.179.207':6893
- '87.##.179.122':6893
- '87.##.179.209':6893
- '87.##.179.210':6893
- '87.##.179.121':6893
- '87.##.179.120':6893
- '87.##.179.21':6893
- '87.##.179.23':6893
- '87.##.179.24':6893
- '87.##.179.25':6893
- '87.##.179.26':6893
- '87.##.179.27':6893
- '87.##.179.28':6893
- '87.##.179.29':6893
- '87.##.179.30':6893
- '87.##.179.31':6893
- '87.##.179.32':6893
- '87.##.179.33':6893
- '87.##.179.34':6893
- '87.##.179.20':6893
- '87.##.179.35':6893
- '87.##.179.19':6893
- '87.##.179.17':6893
- '87.##.179.39':6893
- '87.##.179.40':6893
- '87.##.179.41':6893
- '87.##.179.42':6893
- '87.##.179.43':6893
- '87.##.179.44':6893
- '87.##.179.45':6893
- '87.##.179.46':6893
- '87.##.179.47':6893
- '87.##.179.48':6893
- '87.##.179.49':6893
- '87.##.179.50':6893
- '87.##.179.36':6893
- '87.##.179.51':6893
- '87.##.179.37':6893
- '87.##.179.38':6893
- '87.##.178.243':6893
- '87.#8.179.4':6893
- '87.##.178.245':6893
- '87.##.178.246':6893
- '87.##.178.247':6893
- '87.##.178.248':6893
- '87.##.178.249':6893
- '87.##.178.250':6893
- '87.##.178.251':6893
- '87.##.178.252':6893
- '87.##.178.253':6893
- '87.##.178.254':6893
- '87.##.178.255':6893
- '87.#8.179.0':6893
- '87.##.179.18':6893
- '87.#8.179.1':6893
- '87.##.179.53':6893
- '87.##.178.244':6893
- '87.#8.179.5':6893
- '87.#8.179.6':6893
- '87.#8.179.7':6893
- '87.#8.179.8':6893
- '87.#8.179.9':6893
- '87.##.179.10':6893
- '87.##.179.11':6893
- '87.##.179.12':6893
- '87.##.179.13':6893
- '87.##.179.14':6893
- '87.##.179.15':6893
- '87.##.179.16':6893
- '87.#8.179.2':6893
- '87.##.179.52':6893
- '87.#8.179.3':6893
- '87.##.179.22':6893
- '87.##.179.54':6893
- '87.##.179.91':6893
- '87.##.179.93':6893
- '87.##.179.94':6893
- '87.##.179.95':6893
- '87.##.179.96':6893
- '87.##.179.97':6893
- '87.##.179.98':6893
- '87.##.179.99':6893
- '87.##.179.100':6893
- '87.##.179.101':6893
- '87.##.179.102':6893
- '87.##.179.103':6893
- '87.##.179.89':6893
- '87.##.179.104':6893
- '87.##.179.86':6893
- '87.##.179.92':6893
- '87.##.179.106':6893
- '87.##.179.109':6893
- '87.##.179.110':6893
- '87.##.179.111':6893
- '87.##.179.112':6893
- '87.##.179.113':6893
- '87.##.179.114':6893
- '87.##.179.115':6893
- '87.##.179.116':6893
- '87.##.179.117':6893
- '87.##.179.118':6893
- '87.##.179.119':6893
- '87.##.179.105':6893
- '87.##.179.88':6893
- '87.##.179.107':6893
- '87.##.179.108':6893
- '87.##.179.87':6893
- '87.##.179.55':6893
- '87.##.179.90':6893
- '87.##.179.57':6893
- '87.##.179.58':6893
- '87.##.179.59':6893
- '87.##.179.60':6893
- '87.##.179.61':6893
- '87.##.179.62':6893
- '87.##.179.63':6893
- '87.##.179.64':6893
- '87.##.179.65':6893
- '87.##.179.66':6893
- '87.##.179.67':6893
- '87.##.179.68':6893
- '87.##.179.69':6893
- '87.##.179.70':6893
- '87.##.179.56':6893
- '87.##.179.71':6893
- '87.##.179.84':6893
- '87.##.179.85':6893
- '87.##.179.78':6893
- '87.##.179.72':6893
- '87.##.179.73':6893
- '87.##.179.74':6893
- '87.##.179.75':6893
- '87.##.177.228':6893
- '87.##.179.76':6893
- '87.##.179.79':6893
- '87.##.177.226':6893
- '87.##.179.80':6893
- '87.##.179.81':6893
- '87.##.179.82':6893
- '87.##.179.83':6893
- '87.##.179.77':6893
- '87.##.177.225':6893
- '87.##.177.224':6893
- '87.##.177.223':6893
- '87.##.176.110':6893
- '87.##.176.111':6893
- '87.##.176.112':6893
- '87.##.176.113':6893
- '87.##.176.114':6893
- '87.##.176.115':6893
- '87.##.176.116':6893
- '87.##.176.117':6893
- '87.##.176.118':6893
- '87.##.176.119':6893
- '87.##.176.120':6893
- '87.##.176.121':6893
- '87.##.176.107':6893
- '87.##.176.106':6893
- '87.##.176.109':6893
- '87.##.176.122':6893
- '87.##.176.126':6893
- '87.##.176.127':6893
- '87.##.176.128':6893
- '87.##.176.129':6893
- '87.##.176.130':6893
- '87.##.176.131':6893
- '87.##.176.132':6893
- '87.##.176.133':6893
- '87.##.176.134':6893
- '87.##.176.135':6893
- '87.##.176.136':6893
- '87.##.176.137':6893
- '87.##.176.123':6893
- '87.##.176.124':6893
- '87.##.176.125':6893
- '87.##.176.71':6893
- '87.##.176.138':6893
- '87.##.176.73':6893
- '87.##.176.76':6893
- '87.##.176.77':6893
- '87.##.176.78':6893
- '87.##.176.79':6893
- '87.##.176.80':6893
- '87.##.176.81':6893
- '87.##.176.82':6893
- '87.##.176.83':6893
- '87.##.176.84':6893
- '87.##.176.85':6893
- '87.##.176.86':6893
- '87.##.176.87':6893
- '87.##.176.105':6893
- '87.##.176.74':6893
- '87.##.176.104':6893
- '87.##.176.88':6893
- '87.##.176.92':6893
- '87.##.176.93':6893
- '87.##.176.94':6893
- '87.##.176.95':6893
- '87.##.176.96':6893
- '87.##.176.97':6893
- '87.##.176.98':6893
- '87.##.176.99':6893
- '87.##.176.100':6893
- '87.##.176.101':6893
- '87.##.176.102':6893
- '87.##.176.103':6893
- '87.##.176.89':6893
- '87.##.176.90':6893
- '87.##.176.91':6893
- '87.##.176.75':6893
- '87.##.176.139':6893
- '87.##.176.143':6893
- '87.##.176.178':6893
- '87.##.176.179':6893
- '87.##.176.180':6893
- '87.##.176.181':6893
- '87.##.176.182':6893
- '87.##.176.183':6893
- '87.##.176.184':6893
- '87.##.176.185':6893
- '87.##.176.186':6893
- '87.##.176.187':6893
- '87.##.176.188':6893
- '87.##.176.189':6893
- '87.##.176.175':6893
- '87.##.176.174':6893
- '87.##.176.177':6893
- '87.##.176.190':6893
- '87.##.176.194':6893
- '87.##.176.195':6893
- '87.##.176.196':6893
- '87.##.176.197':6893
- '87.##.176.198':6893
- '87.##.176.199':6893
- '87.##.176.200':6893
- '87.##.176.201':6893
- '87.##.176.202':6893
- '87.##.176.203':6893
- '87.##.176.204':6893
- '87.##.176.205':6893
- '87.##.176.191':6893
- '87.##.176.192':6893
- '87.##.176.193':6893
- '87.##.176.176':6893
- '87.##.176.140':6893
- '87.##.176.141':6893
- '87.##.176.144':6893
- '87.##.176.145':6893
- '87.##.176.146':6893
- '87.##.176.147':6893
- '87.##.176.148':6893
- '87.##.176.149':6893
- '87.##.176.150':6893
- '87.##.176.151':6893
- '87.##.176.152':6893
- '87.##.176.153':6893
- '87.##.176.154':6893
- '87.##.176.155':6893
- '87.##.176.173':6893
- '87.##.176.142':6893
- '87.##.176.172':6893
- '87.##.176.156':6893
- '87.##.176.160':6893
- '87.##.176.161':6893
- '87.##.176.162':6893
- '87.##.176.163':6893
- '87.##.176.164':6893
- '87.##.176.165':6893
- '87.##.176.166':6893
- '87.##.176.167':6893
- '87.##.176.168':6893
- '87.##.176.169':6893
- '87.##.176.170':6893
- '87.##.176.171':6893
- '87.##.176.157':6893
- '87.##.176.158':6893
- '87.##.176.159':6893
- '87.##.176.72':6893
- '87.##.176.70':6893
- '87.##.176.28':6893
- '95.#.200.4':6893
- '95.#.200.5':6893
- '95.#.200.6':6893
- '95.#.200.7':6893
- '95.#.200.8':6893
- '95.#.200.9':6893
- '95.#.200.10':6893
- '95.#.200.11':6893
- '95.#.200.12':6893
- '95.#.200.13':6893
- '95.#.200.14':6893
- '95.#.200.15':6893
- '95.#.200.16':6893
- '95.#.200.2':6893
- '87.#8.176.1':6893
- '95.#.200.1':6893
- '95.#.200.20':6893
- '95.#.200.21':6893
- '95.#.200.22':6893
- '95.#.200.23':6893
- '95.#.200.24':6893
- '95.#.200.25':6893
- '95.#.200.26':6893
- '95.#.200.27':6893
- '95.#.200.28':6893
- '95.#.200.29':6893
- '95.#.200.30':6893
- '95.#.200.31':6893
- '87.#8.176.0':6893
- '95.#.200.18':6893
- '95.#.200.17':6893
- '95.#.200.19':6893
- '93.##7.12.31':6893
- '93.##7.12.17':6893
- '93.#07.12.2':6893
- '93.#07.12.3':6893
- '93.#07.12.4':6893
- '93.#07.12.5':6893
- '93.#07.12.6':6893
- '93.#07.12.7':6893
- '93.#07.12.8':6893
- '93.#07.12.9':6893
- '93.##7.12.10':6893
- '93.##7.12.11':6893
- '93.##7.12.12':6893
- '93.##7.12.13':6893
- '93.##7.12.14':6893
- '95.#.200.0':6893
- '87.#8.176.2':6893
- '93.#07.12.1':6893
- '93.##7.12.18':6893
- '93.##7.12.19':6893
- '93.##7.12.20':6893
- '93.##7.12.21':6893
- '93.##7.12.22':6893
- '93.##7.12.23':6893
- '93.##7.12.24':6893
- '93.##7.12.25':6893
- '93.##7.12.26':6893
- '93.##7.12.27':6893
- '93.##7.12.28':6893
- '93.##7.12.29':6893
- '93.##7.12.30':6893
- '93.##7.12.16':6893
- '93.##7.12.15':6893
- '95.#.200.3':6893
- '87.#8.176.3':6893
- '87.##.176.40':6893
- '87.##.176.42':6893
- '87.##.176.43':6893
- '87.##.176.44':6893
- '87.##.176.45':6893
- '87.##.176.46':6893
- '87.##.176.47':6893
- '87.##.176.48':6893
- '87.##.176.49':6893
- '87.##.176.50':6893
- '87.##.176.51':6893
- '87.##.176.52':6893
- '87.##.176.53':6893
- '87.##.176.39':6893
- '87.##.176.37':6893
- '87.##.176.41':6893
- '87.##.176.54':6893
- '87.##.176.58':6893
- '87.##.176.59':6893
- '87.##.176.60':6893
- '87.##.176.61':6893
- '87.##.176.62':6893
- '87.##.176.63':6893
- '87.##.176.64':6893
- '87.##.176.65':6893
- '87.##.176.66':6893
- '87.##.176.67':6893
- '87.##.176.68':6893
- '87.##.176.69':6893
- '87.##.176.55':6893
- '87.##.176.56':6893
- '87.##.176.57':6893
- '87.##.176.38':6893
- '87.##.176.36':6893
- '87.#8.176.4':6893
- '87.#8.176.6':6893
- '87.#8.176.7':6893
- '87.#8.176.8':6893
- '87.#8.176.9':6893
- '87.##.176.10':6893
- '87.##.176.11':6893
- '87.##.176.12':6893
- '87.##.176.13':6893
- '87.##.176.14':6893
- '87.##.176.15':6893
- '87.##.176.16':6893
- '87.##.176.17':6893
- '87.##.176.18':6893
- '87.##.176.19':6893
- '87.#8.176.5':6893
- '87.##.176.20':6893
- '87.##.176.35':6893
- '87.##.176.21':6893
- '87.##.176.22':6893
- '87.##.176.23':6893
- '87.##.176.24':6893
- '87.##.176.25':6893
- '87.##.176.26':6893
- 'localhost':61289
- '87.##.176.27':6893
- '87.##.176.206':6893
- '87.##.176.30':6893
- '87.##.176.31':6893
- '87.##.176.32':6893
- '87.##.176.33':6893
- '87.##.176.34':6893
- '87.##.176.29':6893
- '87.##.179.250':6893
- '87.##.176.207':6893
- '87.##.176.211':6893
- '87.##.177.127':6893
- '87.##.177.128':6893
- '87.##.177.129':6893
- '87.##.177.130':6893
- '87.##.177.131':6893
- '87.##.177.132':6893
- '87.##.177.133':6893
- '87.##.177.134':6893
- '87.##.177.135':6893
- '87.##.177.136':6893
- '87.##.177.137':6893
- '87.##.177.138':6893
- '87.##.177.155':6893
- '87.##.177.124':6893
- '87.##.177.126':6893
- '87.##.177.141':6893
- '87.##.177.143':6893
- '87.##.177.144':6893
- '87.##.177.145':6893
- '87.##.177.146':6893
- '87.##.177.147':6893
- '87.##.177.148':6893
- '87.##.177.149':6893
- '87.##.177.150':6893
- '87.##.177.151':6893
- '87.##.177.152':6893
- '87.##.177.153':6893
- '87.##.177.154':6893
- '87.##.177.139':6893
- '87.##.177.90':6893
- '87.##.177.142':6893
- '87.##.177.156':6893
- '87.##.177.125':6893
- '87.##.177.123':6893
- '87.##.177.93':6893
- '87.##.177.94':6893
- '87.##.177.95':6893
- '87.##.177.96':6893
- '87.##.177.97':6893
- '87.##.177.98':6893
- '87.##.177.99':6893
- '87.##.177.100':6893
- '87.##.177.101':6893
- '87.##.177.102':6893
- '87.##.177.103':6893
- '87.##.177.104':6893
- '87.##.177.121':6893
- '87.##.177.122':6893
- '87.##.177.140':6893
- '87.##.177.107':6893
- '87.##.177.109':6893
- '87.##.177.110':6893
- '87.##.177.111':6893
- '87.##.177.112':6893
- '87.##.177.113':6893
- '87.##.177.114':6893
- '87.##.177.115':6893
- '87.##.177.116':6893
- '87.##.177.117':6893
- '87.##.177.118':6893
- '87.##.177.119':6893
- '87.##.177.120':6893
- '87.##.177.105':6893
- '87.##.177.106':6893
- '87.##.177.108':6893
- '87.##.177.92':6893
- '87.##.177.158':6893
- '87.##.177.161':6893
- '87.##.177.195':6893
- '87.##.177.196':6893
- '87.##.177.197':6893
- '87.##.177.198':6893
- '87.##.177.199':6893
- '87.##.177.200':6893
- '87.##.177.201':6893
- '87.##.177.202':6893
- '87.##.177.203':6893
- '87.##.177.204':6893
- '87.##.177.205':6893
- '87.##.177.206':6893
- '87.##.177.192':6893
- '87.##.177.207':6893
- '87.##.177.194':6893
- '87.##.177.209':6893
- '87.##.177.222':6893
- '87.##.177.221':6893
- '87.##.177.220':6893
- '87.##.177.219':6893
- '87.##.177.218':6893
- '87.##.176.108':6893
- '87.##.177.217':6893
- '87.##.177.215':6893
- '87.##.177.214':6893
- '87.##.177.213':6893
- '87.##.177.212':6893
- '87.##.177.211':6893
- '87.##.177.210':6893
- '87.##.177.216':6893
- '87.##.177.208':6893
- '87.##.177.160':6893
- '87.##.177.193':6893
- '87.##.177.191':6893
- '87.##.177.162':6893
- '87.##.177.163':6893
- '87.##.177.164':6893
- '87.##.177.165':6893
- '87.##.177.166':6893
- '87.##.177.167':6893
- '87.##.177.168':6893
- '87.##.177.169':6893
- '87.##.177.170':6893
- '87.##.177.171':6893
- '87.##.177.172':6893
- '87.##.177.190':6893
- '87.##.177.159':6893
- '87.##.177.173':6893
- '87.##.177.157':6893
- '87.##.177.176':6893
- '87.##.177.178':6893
- '87.##.177.179':6893
- '87.##.177.180':6893
- '87.##.177.181':6893
- '87.##.177.182':6893
- '87.##.177.183':6893
- '87.##.177.184':6893
- '87.##.177.185':6893
- '87.##.177.186':6893
- '87.##.177.187':6893
- '87.##.177.188':6893
- '87.##.177.174':6893
- '87.##.177.175':6893
- '87.##.177.189':6893
- '87.##.177.177':6893
- '87.##.177.91':6893
- '87.##.177.89':6893
- '87.##.177.88':6893
- '87.##.176.246':6893
- '87.##.176.247':6893
- '87.##.176.248':6893
- '87.##.176.249':6893
- '87.##.176.250':6893
- '87.##.176.251':6893
- '87.##.176.252':6893
- '87.##.176.253':6893
- '87.##.176.254':6893
- '87.##.176.255':6893
- '87.#8.177.0':6893
- '87.#8.177.1':6893
- '87.##.176.243':6893
- '87.##.176.242':6893
- '87.##.176.245':6893
- '87.#8.177.2':6893
- '87.#8.177.6':6893
- '87.#8.177.7':6893
- '87.#8.177.8':6893
- '87.#8.177.9':6893
- '87.##.177.10':6893
- '87.##.177.11':6893
- '87.##.177.12':6893
- '87.##.177.13':6893
- '87.##.177.14':6893
- '87.##.177.15':6893
- '87.##.177.16':6893
- '87.##.177.17':6893
- '87.#8.177.3':6893
- '87.#8.177.4':6893
- '87.#8.177.5':6893
- '87.##.176.244':6893
- '87.##.177.18':6893
- '87.##.177.19':6893
- '87.##.176.212':6893
- '87.##.176.213':6893
- '87.##.176.214':6893
- '87.##.176.215':6893
- '87.##.176.216':6893
- '87.##.176.217':6893
- '87.##.176.218':6893
- '87.##.176.219':6893
- '87.##.176.220':6893
- '87.##.176.221':6893
- '87.##.176.222':6893
- '87.##.176.223':6893
- '87.##.176.241':6893
- '87.##.176.210':6893
- '87.##.176.240':6893
- '87.##.176.224':6893
- '87.##.176.228':6893
- '87.##.176.229':6893
- '87.##.176.230':6893
- '87.##.176.231':6893
- '87.##.176.232':6893
- '87.##.176.233':6893
- '87.##.176.234':6893
- '87.##.176.235':6893
- '87.##.176.236':6893
- '87.##.176.237':6893
- '87.##.176.238':6893
- '87.##.176.239':6893
- '87.##.176.225':6893
- '87.##.176.226':6893
- '87.##.176.227':6893
- '87.##.177.20':6893
- '87.##.177.57':6893
- '87.##.177.23':6893
- '87.##.177.60':6893
- '87.##.177.61':6893
- '87.##.177.62':6893
- '87.##.177.63':6893
- '87.##.177.64':6893
- '87.##.177.65':6893
- '87.##.177.66':6893
- '87.##.177.67':6893
- '87.##.177.68':6893
- '87.##.177.69':6893
- '87.##.177.70':6893
- '87.##.177.56':6893
- '87.##.177.54':6893
- '87.##.177.71':6893
- '87.##.177.59':6893
- '87.##.177.74':6893
- '87.##.177.76':6893
- '87.##.177.77':6893
- '87.##.177.78':6893
- '87.##.177.79':6893
- '87.##.177.80':6893
- '87.##.177.81':6893
- '87.##.177.82':6893
- '87.##.177.83':6893
- '87.##.177.84':6893
- '87.##.177.85':6893
- '87.##.177.86':6893
- '87.##.177.72':6893
- '87.##.177.73':6893
- '87.##.177.87':6893
- '87.##.177.75':6893
- '87.##.177.58':6893
- '87.##.177.55':6893
- '87.##.177.53':6893
- '87.##.177.24':6893
- '87.##.177.25':6893
- '87.##.177.26':6893
- '87.##.177.27':6893
- '87.##.177.28':6893
- '87.##.177.29':6893
- '87.##.177.30':6893
- '87.##.177.31':6893
- '87.##.177.32':6893
- '87.##.177.33':6893
- '87.##.177.34':6893
- '87.##.177.35':6893
- '87.##.177.36':6893
- '87.##.177.22':6893
- '87.##.177.37':6893
- '87.##.177.52':6893
- '87.##.177.51':6893
- '87.##.177.21':6893
- '87.##.177.38':6893
- '87.##.177.39':6893
- '87.##.177.40':6893
- '87.##.177.41':6893
- '87.##.177.42':6893
- '87.##.176.209':6893
- '87.##.177.43':6893
- '87.##.177.46':6893
- '87.##.176.208':6893
- '87.##.177.47':6893
- '87.##.177.48':6893
- '87.##.177.49':6893
- '87.##.177.50':6893
- '87.##.177.44':6893
- 'localhost':59535
- ClassName: '' WindowName: ''
- '%WINDIR%\1v.exe'
- '%WINDIR%\23x.exe'
- '%WINDIR%\1233.exe'
- '%WINDIR%\endermanch@wannacrypt0r.exe'
- '%WINDIR%\gayshit.exe'
- '%WINDIR%\nigger.exe'
- '%WINDIR%\nudes.exe'
- '%WINDIR%\slam_mbr.exe'
- '%WINDIR%\taskdl.exe'
- '%APPDATA%\uac.exe' 34 %APPDATA%\ogl2CYLhxBvgsfYb5gLDuvmcZ3nmTX.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHcAcgBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbQBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '%WINDIR%\syswow64\cmd.exe' /c cd %appdata% & uac.exe 34 %APPDATA%\ogl2CYLhxBvgsfYb5gLDuvmcZ3nmTX.exe
- '<SYSTEM32>\cmd.exe' /C wbadmin delete catalog -quiet
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /I...
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set allprofiles state off & netsh advfirewall set currentprofile state off & netsh advfirewall set domainprofile state off & netsh advfirewall set privateprofile state off ...
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\netsh.exe' advfirewall reset
- '%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
- '<SYSTEM32>\wbengine.exe'
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\attrib.exe' +h .
- '%WINDIR%\syswow64\cmd.exe' /c 88041726243125.bat
- '<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\slam_mbr.exe' ' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHcAcgBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAbQBwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%WINDIR%\1v.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\23x.exe' ' (with hidden window)
- '%WINDIR%\1233.exe' ' (with hidden window)
- '%WINDIR%\taskdl.exe' ' (with hidden window)
- '%WINDIR%\endermanch@wannacrypt0r.exe' ' (with hidden window)
- '%WINDIR%\gayshit.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd %appdata% & uac.exe 34 %APPDATA%\ogl2CYLhxBvgsfYb5gLDuvmcZ3nmTX.exe' (with hidden window)
- '%WINDIR%\nigger.exe' ' (with hidden window)
- '%WINDIR%\nudes.exe' ' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /I...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set allprofiles state off & netsh advfirewall set currentprofile state off & netsh advfirewall set domainprofile state off & netsh advfirewall set privateprofile state off ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c 88041726243125.bat' (with hidden window)