Resubmissions
14-04-2023 14:41
230414-r2x9vsbg51 1014-04-2023 09:35
230414-lkb3eaag51 113-04-2023 17:57
230413-wj3tvadb67 1013-04-2023 15:30
230413-sxtasadf7v 1010-02-2023 19:20
230210-x2eqeagd91 1029-01-2023 00:49
230129-a6f3pshb27 1028-01-2023 23:56
230128-3y9dhagh93 1023-01-2023 04:57
230123-flqz3add9z 10Analysis
-
max time kernel
1799s -
max time network
1586s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
14-04-2023 14:41
General
-
Target
Word.exe
-
Size
3.6MB
-
MD5
e8340564caba7a2635af2c79cb7103eb
-
SHA1
8c62c79508abe5ffa36608d1846dcb20b2a27137
-
SHA256
acd5f35bfcc91c197d8ea08afe588454233114500255ed842b0589dc194ec466
-
SHA512
b6dc6dfeff210222ee904ad9c8dc832e4bf9c27a84298d2817e320bd9308e6d647a5efcf6845a0ed2b0cebdb6539257cd07428bbdce3d5d5db23e8614503d9d2
-
SSDEEP
98304:/uWtmPx3xiobns6osz1gyQ4BL995Bt9JWpVi6q:/9m5hi0HBtQ4P95L9g3i6q
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Modifies extensions of user files 30 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 14 IoCs
-
Loads dropped DLL 25 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Sets desktop wallpaper using registry 2 TTPs 3 IoCs
-
Drops file in Program Files directory 42 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Word.exe"C:\Users\Admin\AppData\Local\Temp\Word.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"2⤵
- Modifies extensions of user files
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 301151681490581.bat3⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs4⤵
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe co3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @WanaDecryptor@.exe vs3⤵
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe vs4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "iqtbqgmcp904" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "iqtbqgmcp904" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f4⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.0.1359783945\1964430102" -parentBuildID 20221007134813 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b12e9bfb-4798-4aaa-be19-7ab2e0ad3510} 244 "\\.\pipe\gecko-crash-server-pipe.244" 1936 16ea4be8858 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.1.1312966835\902377110" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4ccb1a5-dac9-4557-9582-288029658542} 244 "\\.\pipe\gecko-crash-server-pipe.244" 2316 16e97d6fb58 socket3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.2.597814378\1388009807" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2992 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12e4866e-aa7d-42a0-80e6-ab224e82d4fb} 244 "\\.\pipe\gecko-crash-server-pipe.244" 2908 16ea87f2758 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.3.1036667502\231348438" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {148812da-53b6-46f3-9c29-58ca81b6ec79} 244 "\\.\pipe\gecko-crash-server-pipe.244" 1440 16ea72e4158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.4.291535466\1176612467" -childID 3 -isForBrowser -prefsHandle 3764 -prefMapHandle 3760 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bee1e036-3689-4a20-bc3f-2ecf93cf7cab} 244 "\\.\pipe\gecko-crash-server-pipe.244" 3772 16e97d6e858 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.5.856363191\2028864105" -childID 4 -isForBrowser -prefsHandle 5076 -prefMapHandle 5064 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42133551-613d-426d-9e9c-d3c8e4fa238a} 244 "\\.\pipe\gecko-crash-server-pipe.244" 5124 16eaab4d758 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.7.1185057323\1991944850" -childID 6 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a872ba81-9d16-4e7f-a4ba-ad4c85f02726} 244 "\\.\pipe\gecko-crash-server-pipe.244" 5448 16eaaf93158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.6.335726345\446337791" -childID 5 -isForBrowser -prefsHandle 5264 -prefMapHandle 5268 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {deb37d4a-4711-4f38-8982-e5761f80175d} 244 "\\.\pipe\gecko-crash-server-pipe.244" 5256 16eaaf94658 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.8.1954685144\307476570" -childID 7 -isForBrowser -prefsHandle 5856 -prefMapHandle 1644 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86d774b9-1df7-4924-bd37-f0c424b50d59} 244 "\\.\pipe\gecko-crash-server-pipe.244" 5860 16ead298f58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.9.195010506\28800748" -parentBuildID 20221007134813 -prefsHandle 3416 -prefMapHandle 3492 -prefsLen 26851 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03b7a287-02ea-4677-85b4-c56500b1579f} 244 "\\.\pipe\gecko-crash-server-pipe.244" 3540 16ead929b58 rdd3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.10.1215563940\679614571" -childID 8 -isForBrowser -prefsHandle 6180 -prefMapHandle 6176 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53d856e9-7f73-4eb9-aeeb-5022c9f7c09d} 244 "\\.\pipe\gecko-crash-server-pipe.244" 6192 16ea98d0f58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.11.1840346633\545038977" -childID 9 -isForBrowser -prefsHandle 5468 -prefMapHandle 6336 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0114365e-41b0-4151-962b-5b24d03ee655} 244 "\\.\pipe\gecko-crash-server-pipe.244" 5340 16eaca8bd58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.12.828065030\956815115" -childID 10 -isForBrowser -prefsHandle 7164 -prefMapHandle 9932 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f32754d3-4f0c-4490-aaa3-9729e3c912b9} 244 "\\.\pipe\gecko-crash-server-pipe.244" 7160 16ea96ec558 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.13.1223511945\2089347517" -childID 11 -isForBrowser -prefsHandle 7108 -prefMapHandle 7056 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3220d0b4-0bb7-40a9-828f-32cb3fe2b743} 244 "\\.\pipe\gecko-crash-server-pipe.244" 7088 16ea8df7b58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.14.742568249\607315454" -childID 12 -isForBrowser -prefsHandle 6952 -prefMapHandle 6948 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {684dd2d5-4e12-4319-9994-e507d8858cfd} 244 "\\.\pipe\gecko-crash-server-pipe.244" 7076 16ea967b158 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.15.1515298778\1424143871" -childID 13 -isForBrowser -prefsHandle 5816 -prefMapHandle 5820 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43f1f4e7-7a5a-410f-86db-fdff7e27ffe0} 244 "\\.\pipe\gecko-crash-server-pipe.244" 6700 16eacf46858 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.17.1994901193\162617817" -childID 15 -isForBrowser -prefsHandle 9644 -prefMapHandle 6904 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {564ce507-fc49-497c-8380-7aed64c35e2d} 244 "\\.\pipe\gecko-crash-server-pipe.244" 9656 16eacf48658 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.16.823053331\2022891592" -childID 14 -isForBrowser -prefsHandle 6888 -prefMapHandle 6892 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d5a5a67-19d0-4b72-b3b8-e968889eb691} 244 "\\.\pipe\gecko-crash-server-pipe.244" 6880 16eacf47a58 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="244.18.1982720044\1260018051" -childID 16 -isForBrowser -prefsHandle 9240 -prefMapHandle 9284 -prefsLen 26851 -prefMapSize 232675 -jsInitHandle 1508 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01e3d773-be01-4c55-80aa-e0f5927d3353} 244 "\\.\pipe\gecko-crash-server-pipe.244" 9224 16ea967d258 tab3⤵
-
C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-R7KRF.tmp\processhacker-2.39-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-R7KRF.tmp\processhacker-2.39-setup.tmp" /SL5="$50250,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Process Hacker 2\ProcessHacker.exe"C:\Program Files\Process Hacker 2\ProcessHacker.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff59789758,0x7fff59789768,0x7fff597897782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4572 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4848 --field-trial-handle=1876,i,8727957301224914641,18442933838546957856,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\@Please_Read_Me@.txt1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\@WanaDecryptor@.exe"C:\@WanaDecryptor@.exe"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 5068 -ip 50681⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5068 -s 28881⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Process Hacker 2\ProcessHacker.exeFilesize
1.6MB
MD5b365af317ae730a67c936f21432b9c71
SHA1a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA256bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
SHA512cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
-
C:\Program Files\Process Hacker 2\ProcessHacker.exeFilesize
1.6MB
MD5b365af317ae730a67c936f21432b9c71
SHA1a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA256bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
SHA512cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
-
C:\Program Files\Process Hacker 2\ProcessHacker.exeFilesize
1.6MB
MD5b365af317ae730a67c936f21432b9c71
SHA1a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA256bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
SHA512cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
-
C:\Program Files\Process Hacker 2\ProcessHacker.sigFilesize
64B
MD52ccb4420d40893846e1f88a2e82834da
SHA1ef29efec7e3e0616948f9fe1fd016e43b6c971de
SHA256519c2c2ca0caf00db5b3eb2b79dfe42e6128161c13aeb4b4d8b86fbffc67e3d4
SHA512b2a000b33d4a9b2e886208fc78aeb3a986f7bd379fb6910da9f6577603aa6e8237cb552eabca70445f37b427419beeff0b061090cb952331b8db322ce2e58bc6
-
C:\Program Files\Process Hacker 2\plugins\DotNetTools.dllFilesize
132KB
MD5b16ce8ba8e7f0ee83ec1d49f2d0af0a7
SHA1cdf17a7beb537853fae6214d028754ce98e2e860
SHA256b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
SHA51232de59c95d1690f4221b236376e282c8be1bb7f5d567592b935dcd798b36b80e86da81741c5845fa280386f75f6eafc9bbd41035362984150b134d24aede61eb
-
C:\Program Files\Process Hacker 2\plugins\DotNetTools.dllFilesize
132KB
MD5b16ce8ba8e7f0ee83ec1d49f2d0af0a7
SHA1cdf17a7beb537853fae6214d028754ce98e2e860
SHA256b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
SHA51232de59c95d1690f4221b236376e282c8be1bb7f5d567592b935dcd798b36b80e86da81741c5845fa280386f75f6eafc9bbd41035362984150b134d24aede61eb
-
C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dllFilesize
140KB
MD5be4dc4d2d1d05001ab0bb2bb8659bfad
SHA1c0ed9e375b447b61c07c0b00c93bb81c87bcfc2e
SHA25661e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
SHA51231389e268fe3bf1175fa3c251ca026f77dc59361b8425c9826f31d18c5174e6de68c6092aef187f2bd2c92d89b3093a660b2fe6189af369293c1117c856b5cdf
-
C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dllFilesize
140KB
MD5be4dc4d2d1d05001ab0bb2bb8659bfad
SHA1c0ed9e375b447b61c07c0b00c93bb81c87bcfc2e
SHA25661e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
SHA51231389e268fe3bf1175fa3c251ca026f77dc59361b8425c9826f31d18c5174e6de68c6092aef187f2bd2c92d89b3093a660b2fe6189af369293c1117c856b5cdf
-
C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dllFilesize
136KB
MD54858bdb7731bf0b46b247a1f01f4a282
SHA1de2f9cbcec1e1fa891d9693fb3cadfdd4cfe1f60
SHA2565ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
SHA51241b39560e15d620733ca29dc37f55a939a653f99686ac86643ccc67fbb807ad95d1996b867319d98506f3b8a30772fff3c3317bbcc205987f48031923f674d9a
-
C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dllFilesize
136KB
MD54858bdb7731bf0b46b247a1f01f4a282
SHA1de2f9cbcec1e1fa891d9693fb3cadfdd4cfe1f60
SHA2565ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
SHA51241b39560e15d620733ca29dc37f55a939a653f99686ac86643ccc67fbb807ad95d1996b867319d98506f3b8a30772fff3c3317bbcc205987f48031923f674d9a
-
C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dllFilesize
196KB
MD5bc61e6fb02fbbfe16fb43cc9f4e949f1
SHA1307543fcef62c6f8c037e197703446fcb543424a
SHA256f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
SHA5120bbfe53e1dd933a3080d9775ad890fcbd73f9820885efa6b69e9664261249f34eaae3870f74de8511734fc9a0114f36e1bfc529a032d303a8e3e583e37a506c6
-
C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dllFilesize
196KB
MD5bc61e6fb02fbbfe16fb43cc9f4e949f1
SHA1307543fcef62c6f8c037e197703446fcb543424a
SHA256f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
SHA5120bbfe53e1dd933a3080d9775ad890fcbd73f9820885efa6b69e9664261249f34eaae3870f74de8511734fc9a0114f36e1bfc529a032d303a8e3e583e37a506c6
-
C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dllFilesize
180KB
MD5a46c8bb886e0b9290e5dbc6ca524d61f
SHA1cfc1b93dc894b27477fc760dfcfb944cb849cb48
SHA256acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
SHA5125a4d2e0fa7a1a14bc4c94a0c144bfbfcef1ecabe4dc15f668605d27f37f531934778f53e7377bab0ff83531732dc15e9fc40b16f2d1f7e925429681bd5bdca73
-
C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dllFilesize
180KB
MD5a46c8bb886e0b9290e5dbc6ca524d61f
SHA1cfc1b93dc894b27477fc760dfcfb944cb849cb48
SHA256acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
SHA5125a4d2e0fa7a1a14bc4c94a0c144bfbfcef1ecabe4dc15f668605d27f37f531934778f53e7377bab0ff83531732dc15e9fc40b16f2d1f7e925429681bd5bdca73
-
C:\Program Files\Process Hacker 2\plugins\NetworkTools.dllFilesize
134KB
MD5d6bed1d6fdbed480e32fdd2dd4c13352
SHA1544567d030a19e779629eed65d2334827dcda141
SHA256476aa6af14dd0b268786e32543b9a6917a298d4d90e1015dac6fb2b522cf5d2e
SHA51289362a7b675651f44649f0ea231f039e0b91aba9f84c91545f15e187c6cbd07bbf3648a4e232dfe5122cf5636e67c458f4f7dab49ed4de3f3a303aa396c41d1c
-
C:\Program Files\Process Hacker 2\plugins\NetworkTools.dllFilesize
134KB
MD5d6bed1d6fdbed480e32fdd2dd4c13352
SHA1544567d030a19e779629eed65d2334827dcda141
SHA256476aa6af14dd0b268786e32543b9a6917a298d4d90e1015dac6fb2b522cf5d2e
SHA51289362a7b675651f44649f0ea231f039e0b91aba9f84c91545f15e187c6cbd07bbf3648a4e232dfe5122cf5636e67c458f4f7dab49ed4de3f3a303aa396c41d1c
-
C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dllFilesize
222KB
MD512c25fb356e51c3fd81d2d422a66be89
SHA17cc763f8dc889a4ec463aaba38f6e6f65dbdbb8c
SHA2567336d66588bbcfea63351a2eb7c8d83bbd49b5d959ba56a94b1fe2e905a5b5de
SHA512927d785d03c1ee44b5e784b35a09168978b652f37fb73a1a2eeecd3583c28595fb030e8c1f87ab9a20beac4622775777820d1a2ad7219ba8b9ae8b6fbc4568a0
-
C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dllFilesize
222KB
MD512c25fb356e51c3fd81d2d422a66be89
SHA17cc763f8dc889a4ec463aaba38f6e6f65dbdbb8c
SHA2567336d66588bbcfea63351a2eb7c8d83bbd49b5d959ba56a94b1fe2e905a5b5de
SHA512927d785d03c1ee44b5e784b35a09168978b652f37fb73a1a2eeecd3583c28595fb030e8c1f87ab9a20beac4622775777820d1a2ad7219ba8b9ae8b6fbc4568a0
-
C:\Program Files\Process Hacker 2\plugins\SbieSupport.dllFilesize
95KB
MD537cbfa73883e7e361d3fa67c16d0f003
SHA1ffa24756cdc37dfd24dc97ba7a42d0399e59960a
SHA25657c56f7b312dc1f759e6ad039aac3f36ce5130d259eb9faad77239083398308b
SHA5126e0bfab9ff44f580f302cabd06fc537a9e24432effd94b50ab696b35f57a61772072b7f9045a9e99fa4bf3bc316f43ea25ab6c87517242e7957eb86575203bed
-
C:\Program Files\Process Hacker 2\plugins\SbieSupport.dllFilesize
95KB
MD537cbfa73883e7e361d3fa67c16d0f003
SHA1ffa24756cdc37dfd24dc97ba7a42d0399e59960a
SHA25657c56f7b312dc1f759e6ad039aac3f36ce5130d259eb9faad77239083398308b
SHA5126e0bfab9ff44f580f302cabd06fc537a9e24432effd94b50ab696b35f57a61772072b7f9045a9e99fa4bf3bc316f43ea25ab6c87517242e7957eb86575203bed
-
C:\Program Files\Process Hacker 2\plugins\ToolStatus.dllFilesize
243KB
MD53788efff135f8b17a179d02334d505e6
SHA1d6c965ba09b626d7d157372756ea1ec52a43f6b7
SHA2565713d40dec146dbc819230daefe1b886fa6d6f6dbd619301bb8899562195cbab
SHA512215d6c3665323901d41ae5151908c4e084a04a1558617016f0788194304e066410b92943bd6c119339727037ee02cfda893b9baf5603b2870d9fc5ae0c77ca7e
-
C:\Program Files\Process Hacker 2\plugins\ToolStatus.dllFilesize
243KB
MD53788efff135f8b17a179d02334d505e6
SHA1d6c965ba09b626d7d157372756ea1ec52a43f6b7
SHA2565713d40dec146dbc819230daefe1b886fa6d6f6dbd619301bb8899562195cbab
SHA512215d6c3665323901d41ae5151908c4e084a04a1558617016f0788194304e066410b92943bd6c119339727037ee02cfda893b9baf5603b2870d9fc5ae0c77ca7e
-
C:\Program Files\Process Hacker 2\plugins\Updater.dllFilesize
110KB
MD56976b57c6391f54dbd2828a45ca81100
SHA1a8c312a56ede6f4852c34c316c01080762aa5498
SHA2560c11cdc3765ffb53ba9707b6f99ec17ae4f7334578a935ba7bcbbc9c7bdeed2e
SHA51254d8b39457f516d921bb907615ff60a46b6031e1444a443c9657e06d78c9fb0f637ae4756bb7b884e4dca2f55902372ad4ddba1d020abe02e0a381702ae270cc
-
C:\Program Files\Process Hacker 2\plugins\Updater.dllFilesize
110KB
MD56976b57c6391f54dbd2828a45ca81100
SHA1a8c312a56ede6f4852c34c316c01080762aa5498
SHA2560c11cdc3765ffb53ba9707b6f99ec17ae4f7334578a935ba7bcbbc9c7bdeed2e
SHA51254d8b39457f516d921bb907615ff60a46b6031e1444a443c9657e06d78c9fb0f637ae4756bb7b884e4dca2f55902372ad4ddba1d020abe02e0a381702ae270cc
-
C:\Program Files\Process Hacker 2\plugins\UserNotes.dllFilesize
114KB
MD5e48c789c425f966f5e5ee3187934174f
SHA196f85a86a56cbf55ebd547039eb1f8b0db9d9d8d
SHA256fc9d0d0482c63ab7f238bc157c3c0fed97951ccf2d2e45be45c06c426c72cb52
SHA512efdb42e4a1993ee6aa5c0c525bd58316d6c92fbc5cebbc3a66a26e2cf0c69fe68d19bc9313656ad1d38c4aef33131924684e226f88ef920e0e2cd607054a857c
-
C:\Program Files\Process Hacker 2\plugins\UserNotes.dllFilesize
114KB
MD5e48c789c425f966f5e5ee3187934174f
SHA196f85a86a56cbf55ebd547039eb1f8b0db9d9d8d
SHA256fc9d0d0482c63ab7f238bc157c3c0fed97951ccf2d2e45be45c06c426c72cb52
SHA512efdb42e4a1993ee6aa5c0c525bd58316d6c92fbc5cebbc3a66a26e2cf0c69fe68d19bc9313656ad1d38c4aef33131924684e226f88ef920e0e2cd607054a857c
-
C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dllFilesize
133KB
MD50e8d04159c075f0048b89270d22d2dbb
SHA1d0fa2367d329909b6c9efcb3cc2c2902d8cf9b22
SHA256282696487ea5dc781788d5d8477b977f72b7c70f201c2af0cfe7e1a9fd8d749a
SHA51256440f3feddc124574debfe3789e14d908982d4d8e9516f42fab7db7bcecdd3badd2f75e005016a7b9d87a00d5646b8df722bae8fba3932198babbe5335cf197
-
C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dllFilesize
133KB
MD50e8d04159c075f0048b89270d22d2dbb
SHA1d0fa2367d329909b6c9efcb3cc2c2902d8cf9b22
SHA256282696487ea5dc781788d5d8477b977f72b7c70f201c2af0cfe7e1a9fd8d749a
SHA51256440f3feddc124574debfe3789e14d908982d4d8e9516f42fab7db7bcecdd3badd2f75e005016a7b9d87a00d5646b8df722bae8fba3932198babbe5335cf197
-
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@WanaDecryptor@.exe.lnkFilesize
1KB
MD5e9798b8ed8cdc1a505235b021cde514a
SHA1ad8787b7b0192c3a3f97c6309ad9b505e290b00b
SHA256942e67c5c64a3f433c7f1d5bf344894154487e2c4edb21b4756e7ce291c9fe56
SHA51295b94f775358e97cb869473abcf441c6501d282b7c56a183ef1b61685a3bf74ae55a64cdc22f3c3778206333fdf0779309284cc1e43b3e1e03b69bcd1b0b8019
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD534ad13cf76194283940ebcd44f3d91e2
SHA191405b7ca9c18441fc21e67c42bbffa1e5f1dd6f
SHA2560b737d6db619f13f8dbdf5e17bd32c4a2558c82ed85cbbe47b56ea3feb042e27
SHA51205c2ac964649317d94c1592c56c5d4d85fda4326c3ac908d275f269ea5ac46eb4a2b0d47e4488090e4ee3d00574e1a83c5a1ed44b4d8af8f4dd743e8ac133516
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
371B
MD5ef8b9d02be5bbc06b89a20765de2a00d
SHA18ba0b5115b6ee9e04dce76900348639c670aabfa
SHA2564135538679214579b844252e1b451ec5a6872fcdaa7ffd4dbc52540d4415521c
SHA5129d2a6fdd9b52b43bcd28d85fcba4e6d558d62e7059ce491ec0fa7c5fe43ce980c160d2cc9dec66d77bcbe04fdfcb77e604b8ab29efb6d03d1b15e8ce4bbb3b85
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5a1fb88cc656e6e2242b27b5b5347e60d
SHA15b46660a3a103e51a64d217e60a67f9435b12add
SHA256dccab4c6cc1fe117a62394b4991875995c79f8af9d44b689af240872f77f4c2c
SHA5122b87792cead87b18d01092aa8569ddf8c9075999b5ea91cdd0f16f882c5e24b410c4e7f7e07466470176fda18ab2e4efc2ac3a02fffc12ed0b580a3b7c2db829
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5163313bb8fc3f0679005f0a0926da75f
SHA14dd986d1c6ed83a6b46f0fe29ec7bf27d7b86f80
SHA256e50837d52b861c95f7f0c38ea410bf0f330b6353d152f64d7306b4e28f1c8ef4
SHA512192a25d48d2bd98ec0df92eb90cdff1b244697f07e1726656186046c89b76b545a1a8cfddd51b5fb68193b7905574c9c73d962e2cb2d997a13bfb5c5d232beac
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
72KB
MD597737e2cd2b27cac5044f4f963659ee5
SHA16bd9dd73bf39fb316a7b28293ccbedcbe3bc7477
SHA256354b17604a14cfa30e68512fc2ef9799b2dd9eebf88cc91c96b4999d8906cd2e
SHA5126786a62a4d6f09a83849ffec550d7dc8c7f6a08eb2e8fbb9ed2db82dcfabdfae4a99a1eda0eda291f3876b7985a91ded51858e34e6adaa60b45c837aded7d20b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
200KB
MD5aa1187976cf463be41e361fdf08df06b
SHA1909475ee2128129b54d1b02cea7455c26ba235f6
SHA256f4fa2e535607bbd4d6f52e76b3852df5d51cf47ab20b52f984356eace77544d8
SHA512a13f3272c1fa7f56ccc97b274cd1d973615a4f8dbe0df8cd350bd6ef9f2bed7c0745c6cfdfd601a9dcc802ae5d57eedc5438ee5f707b4601eb3905de5e053107
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\activity-stream.discovery_stream.json.tmpFilesize
142KB
MD571190e5d91b08f136e36e468c14c5aeb
SHA1f0049c738083336bd1e205d514056c3afdcd15ca
SHA2565db5eb30535c5071e66361b7190381d3edd6f06528446c8c864d29c896070bd1
SHA512ecbb95ab29c14ce34949678aa710c3b20f061970c365c00fb6da3bfd817b39764f7f328b8bc2a72e624094a0747329947752674110def686a65d29df2d95e589
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\17087Filesize
15KB
MD58b654130834dee43b856ffea44d2af9c
SHA1574b0ced8b2bdb0ff07ddf89859d9d3e6e35fe9f
SHA2567795b94c21c3413d8c5ea13a9aa3fea0eb73576a8a61964bc39c976aa70c2213
SHA5123186aa4290aed5e6b97d8de5f4d9b6ef22e1f17d8357477f52d4204d3c6c8bbe649558a7dd4af59b79d75444951797ba128769a893c2cfb00d4c8a7e869c0503
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\18486Filesize
15KB
MD58f5974e6ce81559244d4caca16a7b138
SHA1d3536cbbd1bda2e67fe098054c329e3673b6629c
SHA256c34b429fa12dfdac509048545fa8fd548cba359c061e2d14bfd115678cc2b7fc
SHA51219e5eb4e1f95c2e9ef70d654dd06dd0745aca50d1d0f4ae548d315ce406f50db98c51937480a2f6cf6b404a3de5e6c378d51792d292f2c86f3f8181348a5e225
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\21183Filesize
14KB
MD536fcac899aa11467ef811eec9f01015b
SHA1c78aac47f6062d961c496e9782efd8f411364a14
SHA256f34c54bbac43f2b31269242e386db2d80322f80d258a057d411500ef80e8123a
SHA512cd024f2576fd45c334fdbc5679237bef74f82186fd7345a9cb2db9e2f923bffe9b11dea488be219dd3d0b21f67668d1ed6f9b7607eb41de35434e6b2e9a6cf8d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\29859Filesize
14KB
MD53351fb7e6fe18d35ef35a219ed6553c3
SHA1e44d398579cf5fe6fd952ed4022db73b09e2653e
SHA25648703c2135f83b952054c3b1b8385c49081541f6100653e90571295b6b36ac97
SHA51245d5d628c2a28fbbaa4b7b49c2d0b9994d86a14edd11901419f498592c490b5242afc5413514736c5869a3c76a9c64826f8cea42904fbf2568d592873af1f802
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\3622Filesize
14KB
MD521f4a80641f30965e632888c1ba71f73
SHA1deca4464aa0c17fdb11ddd6e9a72029109cd1f23
SHA25651db8aef443091a42dbaf623d91be8382f13e09f363661f23f42415ac46407f5
SHA512075a87e274efc48c0225d8e9ebf35cd5d7479e1ad3df6ea304e5e733333940d9fdcfe0c80dfff55cdace41d1c41724eb969781b4b0bc7fd303000413f5893157
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\67DD5D86A2362AECDAFCF7FA511F13D9DF389AB7Filesize
116KB
MD5a88f037d7be5bef05f0959b5a5bc09a9
SHA108363ab9176810133e87d3a66999942ebfa25f0e
SHA256e51a652ce3cf9d6d948612f38b589e3949de54c58a38ed47c3b879fa9cd6e355
SHA51296c965561e1c2f61852d8bc8499763ecc034bf5ebc5ba4c9de3afed9f1ae702cd9baea99cf79cc32f6b81b60478c520217293c08ed6b3e6f9900b015bc5f0388
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\entries\6E1895B33D5F91F34072ECC4DEA16128B135F807Filesize
809KB
MD539a9b84811bdf8d624868a58570f5240
SHA1a43e1e2c6e33cca32c6ad711fd9612f57175d619
SHA2566045a6929e4838e4c9dcd22d43b11283e4a1399045d8e83c4cafe4b60140891d
SHA512fad193d26a824523150d09becf120549501c3fa164b4613f7751594be4dde0cf23c9ee01ab044468318941c75b144ecd07f8b160d922c27b82bf06c5750cae35
-
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txtFilesize
933B
MD57a2726bb6e6a79fb1d092b7f2b688af0
SHA1b3effadce8b76aee8cd6ce2eccbb8701797468a2
SHA256840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
SHA5124e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exeFilesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\AppData\Local\Temp\MEMZ.exeFilesize
16KB
MD51d5ad9c8d3fee874d0feb8bfac220a11
SHA1ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA2563872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
SHA512c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\tor.exeFilesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
C:\Users\Admin\AppData\Local\Temp\b.wnryFilesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
C:\Users\Admin\AppData\Local\Temp\c.wnryFilesize
780B
MD58124a611153cd3aceb85a7ac58eaa25d
SHA1c1d5cd8774261d810dca9b6a8e478d01cd4995d6
SHA2560ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e
SHA512b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFilesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFilesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeFilesize
3.4MB
MD584c82835a5d21bbcf75a61706d8ab549
SHA15ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
SHA51290723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
C:\Users\Admin\AppData\Local\Temp\is-R7KRF.tmp\processhacker-2.39-setup.tmpFilesize
785KB
MD51c96ed29e0136825e06f037bf10b2419
SHA1b74a55279474253639bebf9c92f10f947145ff30
SHA256b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021
SHA5120e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177
-
C:\Users\Admin\AppData\Local\Temp\is-R7KRF.tmp\processhacker-2.39-setup.tmpFilesize
785KB
MD51c96ed29e0136825e06f037bf10b2419
SHA1b74a55279474253639bebf9c92f10f947145ff30
SHA256b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021
SHA5120e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177
-
C:\Users\Admin\AppData\Local\Temp\lol.pngFilesize
11KB
MD53f3a8282cbdaa163c8db1e5e41793ea1
SHA1220ba2e1ae8540e89d3a468ca4e4926851960696
SHA256c358f6ddb8161c3b4bbe677b23185b3d2666a7eb5f74564a217bc5ddc971b7d6
SHA51269630f19d36bf8bcf85549a667e4c0d7b4cddd44d1c907ef7e57c99a94328cf3ff6f303a9341d41d27c0f90d9e1f2dc0c169e0bbd0265e84df8025414a7f3807
-
C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnryFilesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnryFilesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnryFilesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnryFilesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnryFilesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnryFilesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnryFilesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnryFilesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnryFilesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnryFilesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnryFilesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnryFilesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnryFilesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnryFilesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnryFilesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnryFilesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnryFilesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnryFilesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnryFilesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnryFilesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnryFilesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnryFilesize
50KB
MD5313e0ececd24f4fa1504118a11bc7986
SHA1e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA25670c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
-
C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnryFilesize
46KB
MD5452615db2336d60af7e2057481e4cab5
SHA1442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA25602932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA5127613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
-
C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnryFilesize
40KB
MD5c911aba4ab1da6c28cf86338ab2ab6cc
SHA1fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA5123491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
-
C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnryFilesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnryFilesize
37KB
MD5c7a19984eb9f37198652eaf2fd1ee25c
SHA106eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA51243dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.jsFilesize
6KB
MD5d14da26ba8a924422f1cdf38bc90d916
SHA131ba5187f171d966630ec8afce8d608db45c7081
SHA2568fcca65687fcef59b21849d09b97f2005eacb8f68b235ce09d899d79e99072fd
SHA5128501b22f0d7be6db5b8d9a2f1bd3c81ad2258ead08adc9c192dbb6a679d5c46977ff46111436268c89836519ea7d2eea29ae51ff565e4e07390b9656ab8014a9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.jsFilesize
6KB
MD54499ac60253413bbfec2845874986541
SHA162e930247a03986de3a3d50e4e16375784990967
SHA256db356d6223d460102c218536988f2fa4e79da47c873dc5727a89fa5894a173b5
SHA512dc7fee34e23e1920ff308ccbf5a6a9e04fade15eca779db7a4a206ba128b87e99afc37461d5f3109f698d5244bfb4610bbe29b8e84284348841a63e9d13318d4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.jsFilesize
7KB
MD531f32409d4622749f9519f5c85b0f658
SHA19b549fd99a18bacfcfb7829feb5857bc516226a9
SHA256b38e5e075be30f94bdaf045e47c290cc73f6ae49aa33dd2b0ddf68406ca0bd3f
SHA51208acfd5577c8db0b1239691afc01a60df8f8a5d9bcc230ac3bf11cb95836f32b7bd6985ae5f30ff57ebec5c187628b9da77ac276fe47c9af675e5b8144037137
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.jsFilesize
6KB
MD54af73da8d1577df13253277209b3569e
SHA1077c5217655e523458cdc77fe84566e8d888437c
SHA2560522d11cf2a022a53b4969712fbeb8487b335c1b3605b3495ceb4329bd088b61
SHA512a83a458975fe3f89a753014438183cc78b08d3079969151f953b80c92fdd364548a2aa5be7e785938fade571074ce4d4e63bce5fda7e63259597a59d269c7fc6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.jsFilesize
6KB
MD51984b45f201f1fd79d2154406648433b
SHA142f082dc6d4d43333688690bf4dfa7c7f8b618ab
SHA256000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9
SHA512e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionCheckpoints.json.tmpFilesize
259B
MD5e6c20f53d6714067f2b49d0e9ba8030e
SHA1f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA25650a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
SHA512462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4Filesize
3KB
MD57f5245e9fd4eee8f4b850c929ab0826c
SHA1b2576547c21f905ec1e591b095d66c1e47e311a1
SHA256d8444837b00e2b079dc4aa02660130d3ba980fa87c150836af4d122eeb5563a6
SHA512e94b51da64a0392594498cfa779b43ce89553b8535a2aa2d229c6137c9369851f3831da0969343700291e6559a459a33aa3b4740840b2205b6c22be41fbb957b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4Filesize
4KB
MD566c8235c114292f18be973e7c9e87f91
SHA1d6d35a844b6b7e61a72684687f9218f50e67fc3e
SHA256f721c4312e1d23d48bdcc9b106560e55b7fed7811755307afe0b082ddda00a16
SHA512c8220b18fe4d06742ad6d919251b775689ebe9e8e5d5bb19ed3399e586e180de82c2016224bba3b64c663af833b45ca9611ca21f038412eec34c55af190bbe09
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore.jsonlz4Filesize
7KB
MD504d1bb7bfe2a24d446510bed4cbcf815
SHA1e339bb44e7923c7a84d22d55bd25d209b0322849
SHA256c202804712cfc771c09df82cd81eaadd31f51069cfe6fa30722c01e308e569b7
SHA51236d7b3e8a2b9a459013cbb14017942dbd1d3f8379ec78165f42e8326be5a40fc3938adc1546f215e4f47b19a4ee6d0392f70821787f7be83149a767a1843cdc2
-
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.newFilesize
6.7MB
MD51f7c4ca6ffd2fc5f3829d0d54877d119
SHA167610dbae925b29427c2f018d6e01526ac823d57
SHA2565ba89c983c59fa693cbb0989d86b2b94a84257437dfb413a3def23c5dfb0982d
SHA5121820312b1495556d6c44ac46c90c5dd10d691d866ecd3eb278eb25a8e3bb145acea2758bed578ed2735069ed367dff68d14b9a460a1a3668def0995171209750
-
C:\Users\Admin\Downloads\processhacker-2.39-setup.exeFilesize
2.2MB
MD554daad58cce5003bee58b28a4f465f49
SHA1162b08b0b11827cc024e6b2eed5887ec86339baa
SHA25628042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
SHA5128330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
-
C:\Users\Admin\Downloads\processhacker-2.39-setup.exeFilesize
2.2MB
MD554daad58cce5003bee58b28a4f465f49
SHA1162b08b0b11827cc024e6b2eed5887ec86339baa
SHA25628042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
SHA5128330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
-
C:\Users\Admin\Downloads\processhacker-2.n-waCWNx.39-setup.exe.partFilesize
31KB
MD5d60976f5e596c737a3e30d375a353310
SHA10b42538f16bf9e009274201929290a9fdbe8c380
SHA25676873ffccb71ac8dbb7bf5b5e2e0da3ffa176838abde57a5881c0d6f64ad9cc4
SHA5122980f3de48c027c0ea19e75dd2e6752fe9a6a5db7e12513d3348d8330bb2c96b5e1efbcaccd999861ce53dd8db9353887c3c26b16819dabc7a995e7d0ab2b236
-
C:\Users\Default\Desktop\@WanaDecryptor@.bmpFilesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
memory/944-1046-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/944-849-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/3336-2827-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/3336-2839-0x0000000073570000-0x00000000735E7000-memory.dmpFilesize
476KB
-
memory/3336-2824-0x0000000073350000-0x000000007356C000-memory.dmpFilesize
2.1MB
-
memory/3336-2843-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/3336-2842-0x0000000073290000-0x00000000732B2000-memory.dmpFilesize
136KB
-
memory/3336-2841-0x00000000732C0000-0x0000000073342000-memory.dmpFilesize
520KB
-
memory/3336-2840-0x0000000073350000-0x000000007356C000-memory.dmpFilesize
2.1MB
-
memory/3336-2823-0x0000000073610000-0x0000000073692000-memory.dmpFilesize
520KB
-
memory/3336-2838-0x00000000735F0000-0x000000007360C000-memory.dmpFilesize
112KB
-
memory/3336-2837-0x0000000073610000-0x0000000073692000-memory.dmpFilesize
520KB
-
memory/3336-2836-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/3336-2826-0x0000000073290000-0x00000000732B2000-memory.dmpFilesize
136KB
-
memory/3336-2825-0x00000000732C0000-0x0000000073342000-memory.dmpFilesize
520KB
-
memory/4804-2850-0x000001BDF5E40000-0x000001BDF5E50000-memory.dmpFilesize
64KB
-
memory/5092-2676-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/5092-2662-0x0000000073E90000-0x00000000740AC000-memory.dmpFilesize
2.1MB
-
memory/5092-2657-0x0000000074F80000-0x0000000074F9C000-memory.dmpFilesize
112KB
-
memory/5092-2658-0x00000000741C0000-0x0000000074242000-memory.dmpFilesize
520KB
-
memory/5092-2655-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/5092-2639-0x0000000073E90000-0x00000000740AC000-memory.dmpFilesize
2.1MB
-
memory/5092-2641-0x00000000744E0000-0x0000000074502000-memory.dmpFilesize
136KB
-
memory/5092-2640-0x0000000074130000-0x00000000741B2000-memory.dmpFilesize
520KB
-
memory/5092-2706-0x0000000073E90000-0x00000000740AC000-memory.dmpFilesize
2.1MB
-
memory/5092-2700-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/5092-2690-0x0000000073E90000-0x00000000740AC000-memory.dmpFilesize
2.1MB
-
memory/5092-2684-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/5092-2638-0x00000000741C0000-0x0000000074242000-memory.dmpFilesize
520KB
-
memory/5092-2682-0x0000000073E90000-0x00000000740AC000-memory.dmpFilesize
2.1MB
-
memory/5092-2659-0x0000000074130000-0x00000000741B2000-memory.dmpFilesize
520KB
-
memory/5092-2661-0x00000000744E0000-0x0000000074502000-memory.dmpFilesize
136KB
-
memory/5092-2642-0x0000000000470000-0x000000000076E000-memory.dmpFilesize
3.0MB
-
memory/5092-2660-0x00000000740B0000-0x0000000074127000-memory.dmpFilesize
476KB
-
memory/5104-1232-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB
-
memory/5304-834-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5304-1050-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5304-1074-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
