mimikatz | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
729s
max time network
749s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
17-03-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

mimikatz wannacry bootkit persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\E442.tmp	mimikatz

Downloads MZ/PE file

Drops startup file 2 IoCs

Processes:

WannaCry.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD5E07.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD5E1D.tmp	WannaCry.exe

Executes dropped EXE 16 IoCs

Processes:

NotPetya.exeE442.tmpNotPetya.exeNotPetya.exeWannaCry.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeLoveYou.exeNotPetya.exeNotPetya.exeNotPetya.exeNotPetya.exehydrogen.exehydrogen.exe

pid	process
2888	NotPetya.exe
432	E442.tmp
3248	NotPetya.exe
3868	NotPetya.exe
4764	WannaCry.exe
1488	!WannaDecryptor!.exe
692	!WannaDecryptor!.exe
3228	!WannaDecryptor!.exe
3596	!WannaDecryptor!.exe
3276	LoveYou.exe
2580	NotPetya.exe
3016	NotPetya.exe
3960	NotPetya.exe
4284	NotPetya.exe
2840	hydrogen.exe
1480	hydrogen.exe

Loads dropped DLL 7 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

4136 rundll32.exe
3580 rundll32.exe
2944 rundll32.exe
2628 rundll32.exe
3476 rundll32.exe
548 rundll32.exe
1240 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4136	rundll32.exe
3580	rundll32.exe
2944	rundll32.exe
2628	rundll32.exe
3476	rundll32.exe
548	rundll32.exe
1240	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WannaCry.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

62 raw.githubusercontent.com
68 raw.githubusercontent.com
69 raw.githubusercontent.com

flow	ioc
62	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

rundll32.exehydrogen.exehydrogen.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	hydrogen.exe
File opened for modification	\??\PhysicalDrive0	hydrogen.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

!WannaDecryptor!.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 54 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\javafx-src.zip	rundll32.exe
File opened for modification	C:\Program Files\StartTrace.rar	rundll32.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.cfg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf	rundll32.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	rundll32.exe
File opened for modification	C:\Program Files\SetStart.7z	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip	rundll32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h	rundll32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	rundll32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	rundll32.exe

Drops file in Windows directory 16 IoCs

Processes:

rundll32.exerundll32.exeNotPetya.exeNotPetya.exeNotPetya.exeNotPetya.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeNotPetya.exeNotPetya.exeNotPetya.exe

description	ioc	process
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File created	C:\Windows\perfc	rundll32.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File created	C:\Windows\dllhost.dat	rundll32.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File opened for modification	C:\Windows\perfc.dat	rundll32.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File created	C:\Windows\perfc.dat	NotPetya.exe
File created	C:\Windows\perfc.dat	NotPetya.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4680 schtasks.exe

pid	process
4680	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

1980 taskkill.exe
3216 taskkill.exe
2624 taskkill.exe
2844 taskkill.exe

pid	process
1980	taskkill.exe
3216	taskkill.exe
2624	taskkill.exe
2844	taskkill.exe

Modifies registry class 2 IoCs

Processes:

MiniSearchHost.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3594324687-1993884830-4019639329-1000\{2DBB1B96-7688-4586-BA8E-F927BE356D71}	msedge.exe

NTFS ADS 9 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 479277.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\hydrogen.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 974085.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 443237.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 156663.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\NotPetya.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 253889.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exerundll32.exeE442.tmprundll32.exetaskmgr.exerundll32.exemsedge.exemsedge.exemsedge.exerundll32.exerundll32.exerundll32.exerundll32.exemsedge.exemsedge.exe

pid	process
4104	msedge.exe
4104	msedge.exe
4720	msedge.exe
4720	msedge.exe
2700	msedge.exe
2700	msedge.exe
3800	identity_helper.exe
3800	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
692	msedge.exe
692	msedge.exe
4136	rundll32.exe
4136	rundll32.exe
432	E442.tmp
432	E442.tmp
432	E442.tmp
432	E442.tmp
432	E442.tmp
432	E442.tmp
3580	rundll32.exe
3580	rundll32.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
2944	rundll32.exe
2944	rundll32.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
1556	msedge.exe
1556	msedge.exe
3432	msedge.exe
3432	msedge.exe
4172	msedge.exe
4172	msedge.exe
2628	rundll32.exe
2628	rundll32.exe
3476	rundll32.exe
3476	rundll32.exe
548	rundll32.exe
548	rundll32.exe
1240	rundll32.exe
1240	rundll32.exe
1656	msedge.exe
1656	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

Processes:

msedge.exe

pid	process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32.exeE442.tmprundll32.exetaskmgr.exerundll32.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	4136	rundll32.exe
Token: SeDebugPrivilege	4136	rundll32.exe
Token: SeTcbPrivilege	4136	rundll32.exe
Token: SeDebugPrivilege	432	E442.tmp
Token: SeShutdownPrivilege	3580	rundll32.exe
Token: SeDebugPrivilege	3580	rundll32.exe
Token: SeTcbPrivilege	3580	rundll32.exe
Token: SeDebugPrivilege	5072	taskmgr.exe
Token: SeSystemProfilePrivilege	5072	taskmgr.exe
Token: SeCreateGlobalPrivilege	5072	taskmgr.exe
Token: SeShutdownPrivilege	2944	rundll32.exe
Token: SeDebugPrivilege	2944	rundll32.exe
Token: SeTcbPrivilege	2944	rundll32.exe
Token: 33	5072	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5072	taskmgr.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	3216	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeIncreaseQuotaPrivilege	392	WMIC.exe
Token: SeSecurityPrivilege	392	WMIC.exe
Token: SeTakeOwnershipPrivilege	392	WMIC.exe
Token: SeLoadDriverPrivilege	392	WMIC.exe
Token: SeSystemProfilePrivilege	392	WMIC.exe
Token: SeSystemtimePrivilege	392	WMIC.exe
Token: SeProfSingleProcessPrivilege	392	WMIC.exe
Token: SeIncBasePriorityPrivilege	392	WMIC.exe
Token: SeCreatePagefilePrivilege	392	WMIC.exe
Token: SeBackupPrivilege	392	WMIC.exe
Token: SeRestorePrivilege	392	WMIC.exe
Token: SeShutdownPrivilege	392	WMIC.exe
Token: SeDebugPrivilege	392	WMIC.exe
Token: SeSystemEnvironmentPrivilege	392	WMIC.exe
Token: SeRemoteShutdownPrivilege	392	WMIC.exe
Token: SeUndockPrivilege	392	WMIC.exe
Token: SeManageVolumePrivilege	392	WMIC.exe
Token: 33	392	WMIC.exe
Token: 34	392	WMIC.exe
Token: 35	392	WMIC.exe
Token: 36	392	WMIC.exe
Token: SeIncreaseQuotaPrivilege	392	WMIC.exe
Token: SeSecurityPrivilege	392	WMIC.exe
Token: SeTakeOwnershipPrivilege	392	WMIC.exe
Token: SeLoadDriverPrivilege	392	WMIC.exe
Token: SeSystemProfilePrivilege	392	WMIC.exe
Token: SeSystemtimePrivilege	392	WMIC.exe
Token: SeProfSingleProcessPrivilege	392	WMIC.exe
Token: SeIncBasePriorityPrivilege	392	WMIC.exe
Token: SeCreatePagefilePrivilege	392	WMIC.exe
Token: SeBackupPrivilege	392	WMIC.exe
Token: SeRestorePrivilege	392	WMIC.exe
Token: SeShutdownPrivilege	392	WMIC.exe
Token: SeDebugPrivilege	392	WMIC.exe
Token: SeSystemEnvironmentPrivilege	392	WMIC.exe
Token: SeRemoteShutdownPrivilege	392	WMIC.exe
Token: SeUndockPrivilege	392	WMIC.exe
Token: SeManageVolumePrivilege	392	WMIC.exe
Token: 33	392	WMIC.exe
Token: 34	392	WMIC.exe
Token: 35	392	WMIC.exe
Token: 36	392	WMIC.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
5072	taskmgr.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

MiniSearchHost.exeNotPetya.exeNotPetya.exeNotPetya.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeNotPetya.exeNotPetya.exeNotPetya.exeNotPetya.exehydrogen.exehydrogen.exe

pid	process
1908	MiniSearchHost.exe
2888	NotPetya.exe
3248	NotPetya.exe
3868	NotPetya.exe
1488	!WannaDecryptor!.exe
1488	!WannaDecryptor!.exe
692	!WannaDecryptor!.exe
692	!WannaDecryptor!.exe
3228	!WannaDecryptor!.exe
3228	!WannaDecryptor!.exe
3596	!WannaDecryptor!.exe
3596	!WannaDecryptor!.exe
2580	NotPetya.exe
3016	NotPetya.exe
3960	NotPetya.exe
4284	NotPetya.exe
2840	hydrogen.exe
1480	hydrogen.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4720 wrote to memory of 3992	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 3992	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 840	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 4104	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 4104	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe
PID 4720 wrote to memory of 2488	4720	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd71663cb8,0x7ffd71663cc8,0x7ffd71663cd8
2⤵
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
2⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7160 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:1
2⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
2⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2264 /prefetch:8
2⤵
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:692

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
3⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\SysWOW64\cmd.exe
/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 21:13
4⤵
PID:3256

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 21:13
5⤵
- Creates scheduled task(s)
PID:4680

C:\Users\Admin\AppData\Local\Temp\E442.tmp
"C:\Users\Admin\AppData\Local\Temp\E442.tmp" \\.\pipe\{83F61478-1BFF-446C-A14C-69811ABE0E72}
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1248 /prefetch:1
2⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6844 /prefetch:8
2⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6828 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1556

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:4764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 313491710706304.bat
3⤵
PID:240

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
4⤵
PID:4884

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:692

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
3⤵
PID:4324

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
5⤵
PID:3252

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe
3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7100 /prefetch:8
2⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
2⤵
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
2⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3432

C:\Users\Admin\Downloads\LoveYou.exe
"C:\Users\Admin\Downloads\LoveYou.exe"
2⤵
- Executes dropped EXE
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4172

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2628

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3960

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:548

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4284

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
2⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
2⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
2⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4036 /prefetch:8
2⤵
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6956 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
2⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
2⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
2⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
2⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6580 /prefetch:8
2⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14534637472706644848,14624813239941283527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7132 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2644

C:\Users\Admin\Downloads\hydrogen.exe
"C:\Users\Admin\Downloads\hydrogen.exe"
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5008

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3248

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2888

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5072

C:\Users\Admin\Downloads\NotPetya.exe
"C:\Users\Admin\Downloads\NotPetya.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3868

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Users\Admin\Downloads\hydrogen.exe
"C:\Users\Admin\Downloads\hydrogen.exe"
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c65e704fc47bc3d9d2c45a244bb74d76

SHA1
3e7917feebea866e0909e089e0b976b4a0947a6e

SHA256
2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110

SHA512
36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c3ea95e17becd26086dd59ba83b8e84

SHA1
7943b2a84dcf26240afc77459ffaaf269bfef29f

SHA256
a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc

SHA512
64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
119d88acf951838b79599e4bd878e118

SHA1
ad22405801e36bf802aba6497742f382eb580f77

SHA256
0707180c9e1003c3dcb539af5c9d452c6213d0a7f3f949d550bc6f2befe24945

SHA512
6ccb18065ff3369a300e706ef51daac41004e2be0d7f4b0a8b2940489374a7774d4e96e5d36e6e116252b5757fb405efd81915121f8fa05cd4de0d92806a268b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fb7f14c619b43b2705b6851050aa0b0e

SHA1
1bd93704bd839f81f55e42bc4ba1768a710cfc71

SHA256
3abeb00dda73e45cbf831077beca8273f05a4845b716c9f1135991b29746ca96

SHA512
c7d6204163cdf9aae4be87125e05b92edb99b12c53a952f55766131782f768adb3d35a74c566f336f3929acdf076f7dad6252c61cefe63d136023a806394297b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b18d86d4f0678fde3476bd7bab5debd6

SHA1
b5f9d4eb67d446043ab56a9f2694cd6301f8093e

SHA256
9933a9377fb48a339c46faeae003c201438b6c0ef239593f548754b59d5d6f02

SHA512
05dc1963ad279e66833df1b972b9a148a85dfe2e5321cd2a9d1fa756c46c0673e12d756a24ad07a526d2936a774c9cded0daaacb268c933ed138d4c01928f62d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
0028a1a5c441a3cd5a60c34da771564f

SHA1
e15d27a8322b435564ebcd36467b997d0fa8ef32

SHA256
8dc36283781a25af9e2ae76d255ae311b2715396f710ff0e9850b0e64525759d

SHA512
e26efd2be3114e733acdc00fb54150790872b10c88a7c4d3a19a16383bf58897ad89f14b3255a984f836666b98bafc099d8988532d03acda0dee7a7a7da3f40e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
656B

MD5
c2e4e56375ec44faca5313bcbd295f53

SHA1
bf9bdaa3b31fdd28047e42a8f943f4ede9d098c5

SHA256
84c912b4facbfce7a81670c40691fb39d2fecf23d4443725f9e368c3c8e3a902

SHA512
1d85e1973dedbbe81f72409db0a7450f381c14c610a24ec0082baa095c6e084b4ae5502c452296ab435feea1e52df8fc98f1c0698c4a53e9562d0f8a970cf76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
773fb4b4aee1fc711996decf4d943b6d

SHA1
5a0ff39895150d79afc75d6bb870eaf2a7411555

SHA256
bf2541e5f818c85e94f249780776e0d5b6a4aafffc8ce5e97dc82070bebe30b9

SHA512
7c55dc4ab11ace2db228705f5f4115ec5d3f42c80cbc9e31049bdbf657eb4e966335ef8899534bf449bf62aaf1a4bac9f52e92264323f0fbaab4de82c88aeee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1013B

MD5
5326b1c6bec4cf52648e2dd563b383b4

SHA1
80c595cbcdf4b003bb42bf86ff56f5d864b700b0

SHA256
66889c467b71f74d71aa2824987a9d78eef57ca200aeff36b61095aeeba37aa4

SHA512
ddee1d360d90f68bdf39a45d5533bf0af66d27293308682eae01e61c2a824dbfaf57edc6725094ed42f28411814d3bd51ef9a13b75f78d6e8f06deb49cafe3dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
656B

MD5
3e9ad1c93e540b883d29a2863ee19a3c

SHA1
44e8873a303d9a5bcf9d163b70c732e7a6a4efd4

SHA256
7408a3f4b7a3b1973e3b3acb7c29169ff4df7b851b3e095bc1db2406f379cec1

SHA512
001c7507702a62eed067e89b9299a3d3b90b8a66c1a0f974f6509bbe4ab2867234f6baa72c9381ea2fb2d675edbfae22c01ea0740aafb5ece631d4f50ba25319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bccb3f144cfdaff8f43f5e8ac0720d35

SHA1
ede0ec1221acd154454a13e1d6b4721c2f6c4088

SHA256
11d0bc9c21f578559263a6eb2212b924e11bd87801cd598e036df07e439a0004

SHA512
3b4675d2987341265a49b03d366551756eb36002290427649cd21118cf57f636888ee8542f4cc330d7ae3768911af188c430707e8e9bcfc514543634627512f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4be0e6093c5552bc16c63ed2a5ac7837

SHA1
322221ce0123b6c04b98bc293dc9b33973378114

SHA256
2a24ab0aeee1577060926eba901173f15509472ae2be024e1e0accba6220ace4

SHA512
69e3e38dd2d7db4d59a3b25cd686f350c32f5d98ce401761338c9832d24fea58b40fc64550f8fcbe100337c86599657e6017ff985a10418d52e581df7683c874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a2fc022dd90940c8baba405f8801c17

SHA1
f4c4155d29c775d792532e696fd5d0573329b3b6

SHA256
628a3b0a4f10cf131a4f72e6c72218718ccf598607af0a4cb8b8c4f4d4b03887

SHA512
eb2325271d9097a997a2457d3c237928a3decee7a43dff599d068a99afba59444d85967cae0069dd8f12c2d6911424d652f8a9a48e35cf27fe450e4132c5ad14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31e937952a8b2ee279cb901a696b7370

SHA1
f1ef909584a1b6c4cf8b6bb53040e7f522c4c99b

SHA256
72705d18c775fb644223e58b14d1578e33bd8f72a592c7edebd237e9f29f9bf2

SHA512
851faedeef04cb320af34eb6e4e8a2fc087851ca5b0f054125ee2e8098551c98c9abe2a1311ac82d692b4ee1d4f9818e8272d880f9da833844c04f637165f17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
414d4f24a251a92b509aed0fd593ab6c

SHA1
285b6998533bd573e0c87458efc18f420a10adee

SHA256
e378cb7227585a38eeb9cdfb9dd4973368b382faa1f5c6017d60b71003f2fc0c

SHA512
18402023abe77220c6e7a3311747d4edf50e237a61632d69f4137369056679e0a3d258f4bff661feabb5231e674ce2547d62e80d163077679c53851473f47046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f618061b8ff246f466ffbc725db1e539

SHA1
60647c1f7adddb352071fb831d206f19707627b5

SHA256
c39f0edc27d15c74cfef89bc0ad9531630765f524a53d97101657e01f389a7a9

SHA512
cb0a44fadc5abd466d433e73d69438fd9c77b47727452540969a0ed0dc3953e2e67790c0ba97bec0479ff3e64704206374f6e084a80f542bfdfb791825050339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ecb7ca3c51116f0abb4d372ad93856d

SHA1
8862d93dbe90dd0cf4fea7c658feb86a72cc9317

SHA256
af0768823d541d28142edde0d612d23c2e28b98138c9ef339c015fb7c5b878c1

SHA512
7417d8ee58fa49d32076661407189596ad0651ec18420c5918461ba54aef7e67591a95720e1faeef20466b2a0f89191bead91e264f4f39b1110849ef25196262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
868097f87cdde257dec42039a823333c

SHA1
6bf09395aeee90bf6ae97789f66320564bef6229

SHA256
84e3bde56eb2f872e16f2dbdc0016b8e75bd6a38aa6bd018e55cfa97b9cf3984

SHA512
b8978ff8f14ef43a359440c9521623c79558ddde8ad22d4f0cfb9e5d38227da5f0787cb5a895f2e2ffbaba20e30880e1e1f53754114d1200784fbac0304af323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
153a6a310ddb2f396f85c9c7ec464dc7

SHA1
696b7fb11a3c5b0ae837c238cc17161e58064fa9

SHA256
f886700a702585b03e3f00cc4e724ec9702e4885a63c7c82f57088934eb1aed7

SHA512
acf68e35188eca89ebd679b08e56b84f3ec8334c9155bdc0e448aae9f6bb6665a8c3d9e680d934ae92a0b05722969fea423383a5abf6505e2a5050d58a060f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
bcd940e47ffa7a1c40978905ea8d0f96

SHA1
2b0c3d471fe0b2bf08cc4d8aaf98fea47780bb16

SHA256
fdfa9b986de041d4cdfda7b6aade3e649e3c2c37a1d8a5152b37d17c497224f1

SHA512
efb80779d9667e3c561626b1c57925cb89b3c82f55bcc33d579fda2d897322c60104446ec0c41a8e9bbf2329564b3015bb6d87cb3ddfcba6fb7712ce39cee89b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2fa84c101c915170d8ee97ae4301dade

SHA1
4b4036e848606e4fb107fa1d0aa24cae193de992

SHA256
240046d779a2cd683f30ee548e26fa7345945d716c2e768c47e31d1e275c2fe3

SHA512
4ad8d0d6575ad3c715acfed17bb17e905dfce85cfe61126ceca50f5bc086a2a43ff181bba58bafa5d51e8ff698dd72e723beaaf40ea2b4e8d2bb7ab5844629b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4585c2e078f2960a49324f7cc4b548b0

SHA1
e93b9f174a8386d69ce71cf4b1c49af69d10b93f

SHA256
54024f5205c5082511bf809b937a99379a20cb06494edf4674587dd95972c67c

SHA512
51667efefc0a90de92390620b914173687ef67ed46afc81566823b02a2b1b375e509c08fb56faaf3b31dc2d3565b23c6bf3815d5d5b5dd5d7b826964b38e4184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8dde62f7efc2a86420b7aed14d4f8fe5

SHA1
ce5cdcd3b5f977dd9944236fb6afce9e69cbe1b9

SHA256
8aa51ead9adbca53b4f56d1f73de0645420356ce7a21a6cc68d9141db14f40f1

SHA512
980a297b82dd036f123302945dfb15914e27644c3324d2ff54960e42992e4fd1bfb140616080962b60e4b99a776b3ae13896f88bbfdf1cf52db53a3a959238c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4fa6eae24067b9d33282806c149ced3c

SHA1
06ffdf130520d2455372203bff9c8db5cd48a50a

SHA256
5c92e0f48a878595f9883f87548e67ad1662959cc4ae90614203aeb98d61a707

SHA512
3b404757122669ee4d2a73b0613023f505da0488c67c781a314b6cbec4bd0babaa9ff0d3d6627669b80f24fdd493a9f3b5e60aab6067587f316b90db2533895e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2848225d88c12a5d944950183b505948

SHA1
0980d7209abae103ce0afdc06d1e6d97a545f286

SHA256
e9f4b2ce1bf8fc723ba04640965e94f69d2272b8553029a5b512c1e5e7b5a1b6

SHA512
4e2e4ac02bf48c765755f78fd8adbee94d75c0eeae28286e18cdb5b2cce174974463c560ab7111f6a9da3bb5ea62cba8b1610fb765c0f5af62fe9941849240e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebc89e03f3aa80ac216744140621b8d8

SHA1
700e8dde4de5fb140adb6b40c713265ee197ac26

SHA256
3ff1fa69734c0d282c84bda4718723d779ed0e51174a94389b601e25ff4f042b

SHA512
b2542d3101f4ccbfba8c01e1cc609170163e30fbc65061510557a0d8ade850e37e77d704a836b006686b7d238221773925581a9b3cc6ea60f57159fc37208460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
864B

MD5
fd83a6f95d0b09dcc45239b319535438

SHA1
12ca68fdaafb246a65650a8599054a41571d5a50

SHA256
7692ffa717c5bd787525a940262a2b2e779d69c93491b1963ae9551abf6a2727

SHA512
2a86049dbdb5e0a225dbb4184334b30574726eca271254b0c93d640a1c322f19c1b8079f08aec1b68d819e5b6bd3287cf16591e9031b96ea1461132ce1abdb5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e87d7e84517a6c1bccfa6fadcfd11fc8

SHA1
a5e29716bdc48e0d762cd018e6b424d10133176d

SHA256
e8647383790baa5a12d2861a39c610db71abe1f454ff61d7421c69951128220b

SHA512
3db24e32035fb42dd90320b7ff356b342d616c4b42022871b2d6dd9a48e8f7c9e8dfea5f922fee23963cc80e21ab03f62d439bd7c21c6d98f802edecf7da820f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b9b230463f72bfadcfee735cda5dac2

SHA1
7d877a06459e10f286b04435951542c19164be80

SHA256
cc72296e01f0b01f6f6dedcc57c6f640d97cc6592fcfe8fe3ccb1a32800cc403

SHA512
0c97035c3df40d527a708991d39bedc969d6b799c190623cc92f24f556093d681273b20ce6718feb2a445187c3baa53df43717a8fe150f9981320f0daec16789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9b6f661fc406e7253d4cd830cf4f7487

SHA1
a366f3c863f12b351a2f6bf9e7b94b8a6fe14fd8

SHA256
2e7afbdcd0cf999ac2d9e40d7e7f1aac7756acbe5a2446af20c0d8e76d656e42

SHA512
5f095ff95a30d29ca42c400381d78cbbe95a450e8af8e46958a4aae214c43e11c22d9946e0a1e11a040f80b1cdf42ef5c587184a459890f293189d52511a73b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ee44733ad63be52cf9723c6829b0dbf

SHA1
9037aa99cc00a021f4443d8781286140516ee903

SHA256
13057f8275c2c5a09139454ece9a098fe62492704ae5cf2cf91f017704dc0a18

SHA512
ddaade36e637d326e0977cd58bf9a5b7b35a7cc6433b9651026297d5e5c6e0fc25bad1013f2998e980ad8699eb287d680ff0002cdc6e7533512f459559b9554c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa2e6baeefc26b93b2ea1340956bada8

SHA1
616050567560632f3ede63c0100b62f463837e16

SHA256
10c4aa666afbc1299874d822a2e60b7b3650365c840a308e8db6643577555ba8

SHA512
7046a2fc7fdba1ea295ba732debf7a3db4f86a41cd8cf8a31bde65c4b284e6904de1639a44a5ebf5f23ef8ddb0167b132b7e6af5d7526a4eda2a27d9aec6e4c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4b562bde7b107ccdb33ff21d8f12328

SHA1
d19731ea71cfd28daeb79a42cccdad6b2ca1ad65

SHA256
2772c8ec053e3d258ec75a45ee540d14b0165bfc5f68b09c98fbce87d10ad4b6

SHA512
6e429f5c3275715ae9fa2594a8f4defe2eee45a6fde86879d38026cf0c4f8bb8de1b9fdc084105e9b5de47b95d03eabdbd6e2ec0dddef4f52ad5d754fd6ccc97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c19104673c31ea9f0dcbef8d4edd4b1c

SHA1
04b72fda308863f5bdf8d855dae601d5047371cf

SHA256
f1428f94ad23aced97cf5e08668df231e15da1f088faf30550ac766c7488b5d4

SHA512
b5a6c33d6730b60c372aab7738dc512dc403fc778c33142aa5ecc49ed3e1dfc3a54fee5288b6f0969f653434f53a3b6b3d3ac4bbbdeca876a3e95e3a0b923f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f9bd18684ed070cb5076cd767f2758f

SHA1
714789304992c590d1990c354c2ecc9d18b9e5ba

SHA256
968f1349d0387a2468f075fece13632c546df080c36f8a29afd4f22b90cdb8a1

SHA512
6187889b8c183b56e8d3fd04184febddb23dfcefe6ab4f444912e0b76280682f8d9a1822924da9ce6aae803af806bc430f5b18a3215db464fcd50371403f50ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d6fadbfe875f0f65800671486da191c7

SHA1
6846c24177fb56bfc5cfd547bd425b1845a23d07

SHA256
bd84fe9a3a6e39eae04e05b8a980fd143155f16374cf0cb686599219ac8b7861

SHA512
90f777fce3f607ac55c592fc81387cea64c15bee1c2b04aab2fd1930776d2d1b02ff8f35678d83b87882849a75d4a20bad7ff5d8c185c7f0b70e4cd4b46a8799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
67d0bb1ff44248e5e154e4fe7ab8fd27

SHA1
c6b33a09285db37ad716445d9dc17993236291ca

SHA256
ecba1b07151502f202ea52a79443e31e746b6c1263cfaa75bfba7c9ce6bc6643

SHA512
efdec0c6441d3f6476eb7e014ff0d8beefa0f8493900cadfb29f46ec066ec617c842af908848976dcde50638878bbb3755327257630962d3e563663e2425d04b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e97f9f3da1f7aa540f92932bc9090df9

SHA1
a9501554a8976453061a4447f5782f381ce656fa

SHA256
6d4a19d367c8dc153a28e12d63853e3bd9601b003645786641b33b30c5dc067f

SHA512
a2da661eafbde9a379d5ea00ce05623d3d282636f30e4e71a7529ac2c17214a1624f441cd3d235f7d7a5d399dc24a8b994234e529857bf8b3a463192b8c0bf5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b565.TMP

Filesize
533B

MD5
c54191ee2dd9bac9e20cb5c4a5666f23

SHA1
d58db688a74e18929cb104f917433fb49b836792

SHA256
ea286cfc2d4c8b4b0a140d0135552e0dcc9e21473e1540b15df7e5729ef05d9f

SHA512
8f1a18aac5c520c2076129517193a9a405a258d6cc6d17e0ce1749c683e1769ea1f8df4accdabe7b3576cd0afcefdbce79bac510c7b244b1132c45c2c35542c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Filesize
16KB

MD5
9a8e0fb6cf4941534771c38bb54a76be

SHA1
92d45ac2cc921f6733e68b454dc171426ec43c1c

SHA256
9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be

SHA512
12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db

Filesize
16KB

MD5
d926f072b41774f50da6b28384e0fed1

SHA1
237dfa5fa72af61f8c38a1e46618a4de59bd6f10

SHA256
4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249

SHA512
a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9214e6cdcf80a33ea3538622fddc7b4

SHA1
afcac9adedc5ef82a5ff66f72d09fc23ab2c124b

SHA256
7fc81f58d395dcf53f729f9ed48566c339b56ef529b9f4dae80c4df86cfff4a3

SHA512
275fa81ed3357b3af2f972a618453845be299906045df06a81de481c3db5c9e64c64f2b68234b486f1d83ed009e3b0a1696f7e7ca3ed4676661df5f60a9710dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
920e4c9015085975e6e5498e769e992a

SHA1
8764a6319759968817bff99c7af5aa976e9cf1be

SHA256
2427594b16f3b332daa161d851e456ac18e9d30876f55454fbf829d6273c6158

SHA512
61fd79cdcd1a0d2ba23ffe0bb9a26e424258141d1304277abf8d16966bdd1e65c31eab44c5406e4ad57c4682c6a70bf3c6dd5098d90a2df73b3703abcf696a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c4a414d8562b7d847bcb8b5fa08ccb61

SHA1
be118f4d9303ebc5a08191cca8016ed1fdfceff4

SHA256
73af39a996701ab27fb75a12ac451630e2bd646a013aa4e78600c01e2de66e82

SHA512
da50c84387d8d926b36227763fa1cf9f61ced0dd2cc1f20cd57c26d90586d10c3e4f2b9e96d0e3a7f59a52b1d0117497f7ecc5e4c6c336d56d2f7dc96f531380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
15a2e7ced56c1e8d870e34bb9f135b65

SHA1
2b42261d6e8855f5717802de31c3d174d55b662a

SHA256
e45ce66da9326d8a0b8b3fffb4583f79d9298e0ff1495fbc96449343f64aea9f

SHA512
ff62bd8642bad1a1ff7442db99383f4fd1254b254023ffd016e3a58acf171ec8bac4d85ee960971940546909f4fe7b3712842aa90939b5ce1c6e9e184b132aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dc53bc9d907514fbf49a5d9eeebee8a8

SHA1
0cc7af245dd30fa49893404339839a8b3384f104

SHA256
9289d4efc90d11e925a567991a0dbd93eee13233e4fa4aaa6238c31b5a523742

SHA512
37dc8d40dee35ae1cde603796291eb345a1536a61f7994b518e9557d09e0d9d811779a8795b6a7aa6c32370fba79186259fa89ea3f1635d41c621dcb462c298c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0c07c10c5269af0a5ca40ed94c43cddb

SHA1
5fb0828119fda7e5c0cec2f944f9aaae818fa9f4

SHA256
afd90b986bef976f8e71d2fac92260dba3d71c9ade0e8f0fe49eb39aae702f58

SHA512
3512df50b80eae7137314b106da32ae22dbaa6ecca25809d2a4b66d6a3cd5fabe3305f98fba311576d10b986d566e09e8a66ed33680163547b08a7b8d018a115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9549dd203a38792824d762ce633f5d47

SHA1
215fa65325a00e36c822370b29efea02b358356f

SHA256
88dc3be635514896b9b44e07bb5db73ec9d9cc7cc533e25bd90575d1dfb9a032

SHA512
2cb4014a567838fb4625c032b770d2ccd5d9ce3076db79c6b47beedd7b66faef9e63fd79db52c0faaa458e52d8dc68bf9a1474e531f60837031dc6a28852e4f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
641fa9d13d0ff7b985fc8c879a710c75

SHA1
4cfb892b1e655f0fc6ca9f7bf43b821c15b414c1

SHA256
3b073a331e224351f47b94d81cd76683a71424c00e316924c695fa041bb76f21

SHA512
6d3b1c96fe941bed2848dc4a9d2f3772b2fcdcc13c747d2d7865d4a38523292be108da67e9f1ad80abf6f83195220860c443def12ce33a6d3276efe7a020528f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fab2ff36b84ad5b2db62ca75d7818c64

SHA1
7d8fd03677dae8783a86788ea2babd35b9296911

SHA256
9b9999d505eed8ce862a86f4cb52498d31c4aa1c9d1a06181c17f5b855b300ba

SHA512
db5db82fd24682be1f2a25652cb349303b15304de83f647232e721419812c0fa1e24791426b36a8fa0b75fc610c0f44a1d63729b717ab76493945c0be7a131fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4c03b9468a94a7328e06a06940fb4267

SHA1
8bc9dddc4d9b78f034a5ab79fb248ee72cca72da

SHA256
06bcf07f1d63aeddf22982fe0cd9df7f902f12f77d15b055d998bad552dd09dd

SHA512
783fe45a0da44fdb2d122eeae33ad49ceb7a030901bd152a85caeef445c4c0407f675120d3b2e7b6d9dfeebd8008276c14e731bfc2589ec813d77089f9528215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.WCRY

Filesize
1KB

MD5
ab5dd9a5644752a38d33673807523928

SHA1
63b5112a60796676d94bf9065eb3a328c1528018

SHA256
5ada4b9eceb2db0fd3cd24526a8b0ef7e87f759cb79c116ff97d363e7211e1bd

SHA512
6b4016e91a16d0ca8d9885f4b77c1d87921f03fd145feb3e5c1fc560df6a8e456d5add34c0fb0fa0c3c67e2a7f4e1d899939956e2edc45a766c827f059f4b7f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WCRY

Filesize
312B

MD5
f155436cfd8c1d580fe3b8337196d174

SHA1
53740953a18a9fe4a007fc090f179a4f163d0380

SHA256
70ad16f70f71da2dcc09121cc3905f91ab6e064b49a66a9d41f00cb2b7a62fe1

SHA512
9cffe700687ec4d008333b606a359ecbb1c257655a4359f2f987e4645ad71ff3ae2a243d0f2d39c86c817d051ba8659d989eab3072b90f081a639f6e3578d24e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E442.tmp

Filesize
55KB

MD5
7e37ab34ecdcc3e77e24522ddfd4852d

SHA1
38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf

SHA256
02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f

SHA512
1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
d7adfe71c4f59f2206b44384196c641a

SHA1
50c3d33132ca373c3052fea52920ee9d0f6d899b

SHA256
7595e558552fb300cb9b743bbe07cafbce09b30532edcc7db3cb1262756c7099

SHA512
894d77ab1a1df671478bb800f481aa99666a2ce9df3b93ab81b2614cc088a88311100653a2fba09f9e244b6832851b5b1ba094083f4dd910e653122e1cb73694

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
4de7492771eedd2fd42e54d1d11038f6

SHA1
e3bda81eb84b0d5d19cc98e1ec2ff40b8507fc96

SHA256
2599614fefca75de4e4448037a020750a76d9fba631383989cbcd670167b4f86

SHA512
7357c5f5e4227c8c1a6d519d972f288a9559503c27380d9e7b2d8b9b4c6cf59da2736fb9b44bd36d477f6c941817cc14b4cc45e6a87dc53c373cd038fb3a8493

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
df3d1f9fb235441c4f5a4cf37078195b

SHA1
389c27bfb57639eacf3eb1d00ced3f5fa239dd77

SHA256
8fca9ca1819355441ee77d69d4f3b636916bc08b0ea6a5c8d16a84e4fb835a13

SHA512
781b3ce23d53e584776766bf948f7ed8c40575c0b459e4a9c842c853cb17fbce74f0448e1c0743f31aa7300bc5bd8ea61456efda445caa80253d2951f0c40822

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
1d7646861ea2d8fb2b49222eb2f08ec1

SHA1
9652017190034fcf21562ef697fd2b99f3fa7d7f

SHA256
cfa33cb29dddb70cb17ff8bceadb8a0327142e60cab2ab3bd3080311e3fe58d2

SHA512
422bf81bc4cc99cd647bf916b1717e17b93468a61aca46db1135686aae189c9fa098a1b3e15cd2f44a4346cfb10820ca601a0686dc313630acc349ba8a540727

Download Submit
C:\Users\Admin\Downloads\313491710706304.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier

Filesize
210B

MD5
b367602bc4f30989d806cf06c3c39699

SHA1
88c31db0e4b60b6f1b193151755a5ff5a84be80d

SHA256
3d4f6af32083d27d5f764de13ab325146f9d9f9515e9de52ab868e62f3c69cc8

SHA512
dcb2082addf1e6330e481a37c9336949af7686982159f1374d2c5aa83755b9a565b1a72d99088c48ce586326a9ae2b8681092c8048356b37acc0ca0bf544db3f

Download Submit
C:\Users\Admin\Downloads\NotPetya.exe:Zone.Identifier

Filesize
120B

MD5
c4d0c25459b3eb075d94d0f085b587a1

SHA1
21289e178cfb7bf93fd4f9a20a7e42e465657e30

SHA256
3555161a234660c71b4e7b8a8380456d718472f828ac4dba4d3854fe8c2fd402

SHA512
f49fbc8d4a1b02c1f10bae7fd0956ca9745bf63a3a7290079d5d4f9fd0efaddd384712e4a02831b7191e4afdc77e5eb98846b56f0e275111ba34c8bc525da193

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 156663.crdownload

Filesize
390KB

MD5
5b7e6e352bacc93f7b80bc968b6ea493

SHA1
e686139d5ed8528117ba6ca68fe415e4fb02f2be

SHA256
63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

SHA512
9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 253889.crdownload

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 443237.crdownload

Filesize
128KB

MD5
efdd98ae7ba8aa1a457d6938d554e5bb

SHA1
5adc3d12792396b569bf024676636262bcd9c7ff

SHA256
283f195bad35cac6e9452c2791eaeb90d9cd6d506aa16c6505247e5be74aabf0

SHA512
6c1e6adfcf7416c153b8f57149d232bd3caecda0806369cb00131e0877559953041017a641f910e7360ddeb059e568c4c4bbbbed28ed902f80221a68f1bafae9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 443237.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 974085.crdownload

Filesize
22KB

MD5
31420227141ade98a5a5228bf8e6a97d

SHA1
19329845635ebbc5c4026e111650d3ef42ab05ac

SHA256
1edc8771e2a1a70023fc9ddeb5a6bc950380224b75e8306eb70da8eb80cb5b71

SHA512
cbb18a6667b377eb68395cfd8df52b7d93c4554c3b5ab32c70e73b86e3dedb7949122fe8eea9530cd53944b45a1b699380bf1e9e5254af04d8409c594a52c0e7

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
0cd31b10399d8dea111950401340a48f

SHA1
9f8b9327f7c10bc81348cffc0d29e574d6cd99bc

SHA256
9261d62f96693ee13040e061269fab40c39b061a63fa841e50da2f1efde89ace

SHA512
4f1dee783fc7e153da434d926808d17a109b0907b682753d07681178d614b64c55a03323e1fa59d4f84b409d6d12743b9b686604ca7f988a4aaa43aaf00853f4

Download Submit
C:\Users\Admin\Downloads\f.wry

Filesize
246B

MD5
6ac435419b4037539b1c42c23f6c3c76

SHA1
b5bd65d06f14c8a33c7f4645477f64a8db7b1fb2

SHA256
977b3877b5fad4bbbe31aec5201eea907670ec9f1ce2c9da9a6b749074c558f8

SHA512
b531e852d69356fc4421eab09b7c7cf7e0e38d5725855d987c41517268983750f69fb681fec653964cabe0394350e354d468f28d148d2e0ab4952b14c040bed0

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\All Users\Microsoft\Diagnosis\osver.txt.WCRY

Filesize
296B

MD5
1c1db0963909a4e97100a5e67afe685c

SHA1
2f4afee4a0052a0e893cad5459a28105a894cecd

SHA256
c3ca00fff53c1ad4712c6923661053598463bc84775ba8a6ee37371735b41af5

SHA512
22f6bd98f6d4e2b6125239906d657f12ecba52398766d634cd43e5d8f114f53735a1d746bebdd13a5be0e273e58c97d9431e7d7111404470c935b6adc06b760e

Download Submit
C:\Windows\perfc.dat

Filesize
353KB

MD5
71b6a493388e7d0b40c83ce903bc6b04

SHA1
34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d

SHA256
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745

SHA512
072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f

Download Submit
C:\Windows\perfc.dat

Filesize
353KB

MD5
9a7ffe65e0912f9379ba6e8e0b079fde

SHA1
532bea84179e2336caed26e31805ceaa7eec53dd

SHA256
4b336c3cc9b6c691fe581077e3dd9ea7df3bf48f79e35b05cf87e079ec8e0651

SHA512
e8ebf30488b9475529d3345a00c002fe44336718af8bc99879018982bbc1172fc77f9fee12c541bab9665690092709ef5f847b40201782732c717c331bb77c31

Download Submit
\??\pipe\LOCAL\crashpad_4720_OANIWLLNEXVPZPME

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2944-634-0x0000000002540000-0x000000000259E000-memory.dmp

Filesize
376KB

Download
memory/2944-642-0x0000000002540000-0x000000000259E000-memory.dmp

Filesize
376KB

Download
memory/3580-600-0x00000000010E0000-0x000000000113E000-memory.dmp

Filesize
376KB

Download
memory/3580-592-0x00000000010E0000-0x000000000113E000-memory.dmp

Filesize
376KB

Download
memory/4136-536-0x0000000002F00000-0x0000000002F5E000-memory.dmp

Filesize
376KB

Download
memory/4136-546-0x0000000002F00000-0x0000000002F5E000-memory.dmp

Filesize
376KB

Download
memory/4136-539-0x0000000002F00000-0x0000000002F5E000-memory.dmp

Filesize
376KB

Download
memory/4136-537-0x0000000002F00000-0x0000000002F5E000-memory.dmp

Filesize
376KB

Download
memory/4136-528-0x0000000002F00000-0x0000000002F5E000-memory.dmp

Filesize
376KB

Download
memory/5072-610-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-617-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-616-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-615-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-621-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-620-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-619-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-618-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-609-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download
memory/5072-611-0x0000025C91070000-0x0000025C91071000-memory.dmp

Filesize
4KB

Download