glupteba | 142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d

Resubmissions

26/04/2024, 23:55

240426-3yr48aff3z 10

26/04/2024, 23:41

240426-3pvhzsfd5w 10

Analysis

max time kernel
209s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 23:55

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Size

4.2MB
MD5

d64e66f33ab2867cb03fafd0fd9f199f
SHA1

b49802537fa13de4501101403959b1b87900c172
SHA256

142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d
SHA512

a1acfdb815617dd98101d29e0ff529297484cac1ac5ea177afd9d27a9d1b468bf2bec0cf88cf77e53917fb72527eab1fc14ca8eff601ef42b03590fbbec71fc4
SSDEEP

98304:AkAjdDPAeC2B02wyEqB4QU18FBwX92iJvUa6o386BoSeiwZU4mjQxQ3:ruPAV2B0NRqB88FqJvA6j4GQq

Score

10^/10

glupteba wannacry discovery dropper evasion loader persistence ransomware rootkit upx worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 10 IoCs

resource	yara_rule
behavioral1/memory/2004-2-0x00000000064A0000-0x0000000006D8B000-memory.dmp	family_glupteba
behavioral1/memory/2004-3-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/2004-130-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/980-170-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/2004-229-0x00000000064A0000-0x0000000006D8B000-memory.dmp	family_glupteba
behavioral1/memory/1620-355-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/1620-681-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/1620-707-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/1620-742-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba
behavioral1/memory/1620-773-0x0000000000400000-0x000000000441C000-memory.dmp	family_glupteba

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5072	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD353B.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3542.tmp	[email protected]

Executes dropped EXE 8 IoCs

pid	Process
1620	csrss.exe
5184	injector.exe
2724	windefender.exe
5972	windefender.exe
5760	taskdl.exe
3616	@[email protected]
1692	@[email protected]
1260	taskhsvc.exe

Loads dropped DLL 8 IoCs

pid	Process
1260	taskhsvc.exe
1260	taskhsvc.exe
1260	taskhsvc.exe
1260	taskhsvc.exe
1260	taskhsvc.exe
1260	taskhsvc.exe
1260	taskhsvc.exe
1260	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6048	icacls.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000023448-673.dat	upx
behavioral1/memory/2724-674-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/5972-677-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2724-679-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/5972-690-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/5972-774-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
341	camo.githubusercontent.com
363	raw.githubusercontent.com
364	raw.githubusercontent.com

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\rss	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
File created	C:\Windows\rss\csrss.exe	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5888	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1968	schtasks.exe
1688	schtasks.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1162180587-977231257-2194346871-1000\{8CFDCD20-7892-40B0-886A-CB5F849EB870}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	chrome.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4428	regedit.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
2232	WINWORD.EXE
2232	WINWORD.EXE
6028	vlc.exe
5308	WINWORD.EXE
5308	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3148	powershell.exe
3148	powershell.exe
2432	mspaint.exe
2432	mspaint.exe
2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
2568	powershell.exe
2568	powershell.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
2064	powershell.exe
2064	powershell.exe
2800	powershell.exe
2800	powershell.exe
1764	powershell.exe
1764	powershell.exe
1764	powershell.exe
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe
3220	chrome.exe
3220	chrome.exe
3984	powershell.exe
3984	powershell.exe
3984	powershell.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
1620	csrss.exe
1620	csrss.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
1620	csrss.exe
1620	csrss.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
1620	csrss.exe
1620	csrss.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe
5184	injector.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6028	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeDebugPrivilege	2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Token: SeImpersonatePrivilege	2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeSystemEnvironmentPrivilege	1620	csrss.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeSecurityPrivilege	5888	sc.exe
Token: SeSecurityPrivilege	5888	sc.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe
Token: SeShutdownPrivilege	5132	chrome.exe
Token: SeCreatePagefilePrivilege	5132	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
6028	vlc.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe
5132	chrome.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
2432	mspaint.exe
2432	mspaint.exe
2432	mspaint.exe
2432	mspaint.exe
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
2232	WINWORD.EXE
6028	vlc.exe
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
5308	WINWORD.EXE
3616	@[email protected]
1692	@[email protected]
3616	@[email protected]
1692	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3148	2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	84
PID 2004 wrote to memory of 3148	2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	84
PID 2004 wrote to memory of 3148	2004	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	84
PID 980 wrote to memory of 2568	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	93
PID 980 wrote to memory of 2568	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	93
PID 980 wrote to memory of 2568	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	93
PID 980 wrote to memory of 3480	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	95
PID 980 wrote to memory of 3480	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	95
PID 3480 wrote to memory of 5072	3480	cmd.exe	97
PID 3480 wrote to memory of 5072	3480	cmd.exe	97
PID 980 wrote to memory of 2064	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	98
PID 980 wrote to memory of 2064	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	98
PID 980 wrote to memory of 2064	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	98
PID 980 wrote to memory of 2800	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	104
PID 980 wrote to memory of 2800	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	104
PID 980 wrote to memory of 2800	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	104
PID 980 wrote to memory of 1620	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	106
PID 980 wrote to memory of 1620	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	106
PID 980 wrote to memory of 1620	980	142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe	106
PID 1620 wrote to memory of 1764	1620	csrss.exe	107
PID 1620 wrote to memory of 1764	1620	csrss.exe	107
PID 1620 wrote to memory of 1764	1620	csrss.exe	107
PID 3220 wrote to memory of 2720	3220	chrome.exe	110
PID 3220 wrote to memory of 2720	3220	chrome.exe	110
PID 1620 wrote to memory of 4336	1620	csrss.exe	115
PID 1620 wrote to memory of 4336	1620	csrss.exe	115
PID 1620 wrote to memory of 4336	1620	csrss.exe	115
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1384	3220	chrome.exe	117
PID 3220 wrote to memory of 1012	3220	chrome.exe	118
PID 3220 wrote to memory of 1012	3220	chrome.exe	118
PID 3220 wrote to memory of 1636	3220	chrome.exe	119
PID 3220 wrote to memory of 1636	3220	chrome.exe	119
PID 3220 wrote to memory of 1636	3220	chrome.exe	119
PID 3220 wrote to memory of 1636	3220	chrome.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
432	attrib.exe
6040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
"C:\Users\Admin\AppData\Local\Temp\142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe
  "C:\Users\Admin\AppData\Local\Temp\142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:5072
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1764
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1968
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4336
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5184
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1688
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      PID:2724
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:5872
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RestoreBlock.wmf"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1520

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ConnectJoin.odt"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc30b1ab58,0x7ffc30b1ab68,0x7ffc30b1ab78
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4508 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1816,i,2235508343008947854,14321619586808433722,131072 /prefetch:8
  2⤵
  PID:3144

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3472

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\DismountRepair.reg"
1⤵
- Runs .reg file with regedit
PID:4428

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5972

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UseRead.m4a"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6028

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\hell.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc30b1ab58,0x7ffc30b1ab68,0x7ffc30b1ab78
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4112 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4504 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4604 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5052 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3448 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3392 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4796 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4304 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4880 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3416 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5160 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5588 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5432 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5372 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 --field-trial-handle=1916,i,3051987178839941989,11534368902200718412,131072 /prefetch:2
  2⤵
  PID:3396

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5108

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:4764
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:432
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:6048
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 149211714175961.bat
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:5164
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:6040
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      PID:5244
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        
        PID:812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
1KB

MD5
f52d8b62d7158daf6e5c36a6eec1c216

SHA1
6864cc522eba9498d601540e588a1af94bc07c8f

SHA256
7ce4be06fbb1ddfd9fb33abf7b789a3a545a83223e7effd58bac569973408f26

SHA512
25d42b11afe50158b7fa5435a84ca87e3116d0ad6993abf885bee87c4ed2e2d048c94e89c80b9eeef67453b58761f54596e320a2c7e16fb5d6a167c303d225ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\97dca186-39c6-494b-82b9-c7da703ee11a.tmp

Filesize
96KB

MD5
bed272dd58e9ffc9e23b3675fc49f7ff

SHA1
d1037a32c4b13fde20f7dbdfb6eed852536c465b

SHA256
9e6c144dbd895b5dfed2c13d75e01ed2d905a1f5229ba2a5630a8c5e68c35737

SHA512
b3cd84debad4cc158963797b0fe28e8d951ff22709ee5ae59f870e6df06591ccc89003cb2dd379bde4279a541715e0d8ef948894c12b958f4b2fa29b19150050

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
6123155f7b8a202460ac1407e231fbf4

SHA1
13121f6000a380f6621bcb8dc7c83f9cd10ab626

SHA256
dc3766fd1d9f14e305d5483a9e886548c3ff3ad2d8497e26a04c6d8c31e7be6c

SHA512
ef2e48a3517f58cf068d2ed9e202ba4d2a54afdccd4937c74b5c84d5c4fd47d9b92ddcf3b842a102b426dccae53ab3bc9e571a5cf27cb315be4dc58bdaad34cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
8144155add13290b3f45318e00d75c4e

SHA1
35f5b04f06982309cdb7b98183c8639d09ad05b6

SHA256
d473fd350a670034532775f827362ef56ef6f8869cc58560c0928f78cb637024

SHA512
e1e531a2a1861c23a45674cd8c4e885a0b0f5116431b816683c500644107cfe26259b4a404a7e0760c923c2f58b249a5886f1fdae474ffc482bd6b9925f209f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
f4a695a7ff3b4d05bb5e43210c7e6d05

SHA1
ca134979d0c8f4128fb2460d87d30408c684d559

SHA256
f2599583ac64dbdeeec558a71efaa7dd7dee23e7ae6e4e18a0196d33169fd14d

SHA512
bbf139e96200420e4946193d227ad48d40127b815092abadb5c6d754a7df8fec817ab9e0ceee1d892fe788a1b41fcf205b7dda95b89df47b4f6bfc6f722df75f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
3755d2ac21bf150506de389362c107af

SHA1
909b3d87b5d33d770fad6a42ac8d2f0f3a352e8a

SHA256
d79348e4555c0b15a74ac255e9a03c81aa836e45809325b775b9ef35bba30039

SHA512
dd155796d3997ee355164009cb1cb334510e78812f629428fca29a8c3419a2d5208ade1a85955035f7a6e5a73c831444ffcd3e1512e09cb4d49d9ab4500d82bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
34KB

MD5
ddffe7711a573eaf4fe195409e09baf3

SHA1
46f6c83db2e1ca1f0200c35bbaad2ec46bd4dfa7

SHA256
605e2dad630d8f6c963b65b6375210a921f909857fdc54aa27b83e6431d4d855

SHA512
98c4dea6c66f5596dcbee1d402b552e1b23317bf892b8ea94c81e0afb828377e323e6e16ce26dfb1c945fb1792e6175568ff9605a8e5b13b4340088c8b01621d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044

Filesize
23KB

MD5
25378c883e050d6b28439fdb922384fe

SHA1
5e2bc1133184ccbaca4bd7b1cb3377f1685c828a

SHA256
ad8fc5b41461cc7fe296f1d423ad1469c6200f97334478db0e62b20cacd55f3c

SHA512
b739372961bf923d81f03a8892378de5acd7d10616a32c55501fd037cc1c7980eee542265b02fa92ec4ead43ca653d6c026b15c57c4ea342fe96adbf361e8133

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
77be7858f36f2517a7dd5bf0e856fcbd

SHA1
f35611e37d834411e82de3fc26b032f3d5d1314d

SHA256
c904be92e3fb05f01402666f118733f9983cda3ce2a4b28d2ce44b5ea557293c

SHA512
867fe6c8befafe3ec32d9923ae1c484f85a7169f618960234c5447a264711cca1a72560603f8df38be31e2a1dee0448243847a4ef55cf9ac0a4d424550d39056

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f6334cf51e1d5c955c7682525df30bf5

SHA1
6430034c2d1002b19e93a1d2c1745d663eeee01e

SHA256
f6bed99f751434c3277908ee7181b8ea021ffd72f7a35642bf4150a82f6fad18

SHA512
cfecb4b33d242f9a9e698641b2be037e1add0e64c095f05b3d493a78bf935b8f4a8bad3a2c6eb042b644ff547caa04a4c4ffb4090d62ca0bea0a7feb940c2e91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
332B

MD5
d4cf5549682ac1ea090fc7bb0571b4a9

SHA1
05c32610d77ee983b4a0785fb8bc2ca4bf51bb48

SHA256
7beeef3ac9db4ba63287e6f011144e583add109cd552b6905955d42595bf7e91

SHA512
7f200970250f7d4aba7c367b5b5a5dc0dbad29596662e574f6f7360c0d66a2f378849464ae7ccaa5bd0d80f2668c9fb749ee316a4a0233dae316e0c456c67b85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
70559933bc3566fccc65cd04f085d734

SHA1
8b230bad43a073c80bf1d44de89a0daaa4e8e241

SHA256
b7d6c1934437701c759f5b1961737a5a98705de7032cb81c4761730931e88e5c

SHA512
42832106c00e0c5f913018119cdf891fe85f86445d2b73788d9c928a5622504d3a03d342547c44411fbf48d68d803ed83fe1d51ec6797ab54ae76847b4fb18ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
1941989f441cc3c6bf5f142a11f771b0

SHA1
c1a15667626485ea8e04139f69a80862ad6481ef

SHA256
1768848cb9eb5958fbab58cec10a333f68b09109e11d74baf40c52510674e30b

SHA512
9a724ee9a7e1ae5012b6b27432185e9aa329048bc1e84d5bd6660f63da5491586a4c2b1d2f0ded477960a6cb7fd8ab6fe825bd36552c51473cc05d78794d283a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4816812abe3e5aca3daa789476602e06

SHA1
e18a5b6e0d103da699f3d414c626025157b03d25

SHA256
8d9ed7e42cdc2918fc8f7dab53ae7b8858455834d9b4b30f59a96852b8526e57

SHA512
d0b77ffa004d278ed12b88b4d68dd8ed9500946906f520aae85861b9ca40b95158a5191b29100b5cb4ab064fc521e35d93b0e10c43fa757846b9e9f228d6a08f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
aa949f09084d43db3057b815281d0bf1

SHA1
3bc842e1bcc4c4c1e244a74187c6e22b31c19bdf

SHA256
45fbe8714245c14e8ecdc10ac252ac2bf2f5a4406ceb8c0016099581a9ff722a

SHA512
4a5bc8a02fd6acda9643817c23e5a80040cb837443d912181da0adc1f275f33ba42bbe278283b7cfbad82cff6a64008972a9343efe34422474e1fd38bb50cbcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
c5cd6675404db39232c7dfa60ab6f136

SHA1
96639667601d878d9734e8f94e067c85a4e7f741

SHA256
ec7eab0142c71f0006c36e68ae213706024dd305ff54e53c9ed5b46baa108d4e

SHA512
6f3648df344403a3d6b6b69f93743381936b75b4948d5b649b6c77e84b1e8f772b44b221504f220fa330cda643a44fcdfce402f6d66809601cb109350e3d40f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4dee2fb21a9e16ac4863bdebd046443a

SHA1
e358e6de00bfc9d3498acdfe1053225925ea2df8

SHA256
f7c72d2d725c83cf307d8ffda83dcf8ec922426894be46cf3c83e1bd5a77b09a

SHA512
f0d81b25d73c9242361e0fe5d159efd1f3d38e06c4d17ad590093677e37e9b294266176188e322ecbc54fd68f8956bc8f75240bfd15cc1b0ee4ea82a2f4cf605

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
9aee79affcf68e47d1fc2768fedec891

SHA1
9ff4c7a6e8ca7d154bafe2a056e6ef72bdafc662

SHA256
e1f17f152864e4213277b64b772908ad713d58dfc8d67a28dfa048ae8414f35f

SHA512
924fdfd7d0bca82d282edab064498ef3a1b7a30fedbe391abc8b9eca1400e6a43cccda3c54034ea918406640237ce1b0b7d1fc547c673dc1ea6844a747a74375

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
14434913e89d9efa0777da0722dd7eef

SHA1
3677a4652bba7dd08a6562c0e30c246436cc203b

SHA256
1dcf5bb969ccca1e09e703cf15f9c0f0f1fe3d2e603f993069272feaa5899aa9

SHA512
8fc1e4432dd88fe5ffa5eab6faf9ceff22b72a5340975cb6309fd3cce6c86042acaf44f36873d0d37cf2c8c1c1b859d055e41278a7ddc7b5985830ea4e2642b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
4e822646b17ab2820441decc914f7461

SHA1
03190fe3b4149ba1e0ba2fa5176158d3583a72d2

SHA256
ae9decdde35b41b45ecd474962d10ecd16c3ea148114c2329b9b948c56e75526

SHA512
7d1c62f368e1d74909c8f4f041063db82d3ec72cc8f783332c43f785e0dbd0a9bce8d8e1a000903faf5b3762c868f3c72b56f53ccfb52c0aa0dc2dba20d44102

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
185379126d1ce2e1d89b0cf456cf2a6f

SHA1
d0f2ffb6e171b8b61662c6e51905a364d1188f15

SHA256
e5d719582bda2159c9a453f1cac9fa7e2382516cc72dc7e3337bcfe08a921030

SHA512
26192e6a6323bf60e616a910e210e0054c887ab96448a6563d212d1bb5fe8bdd7236fb8ac328aa93a74e2c2836d19449c68281c5f168660a4f84b26d052fa8b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
b8b868482ad21ea0cce9e355ef67d9ed

SHA1
7f1db84aed8ba8586ecdad3805a0cd573b69fff4

SHA256
f85ee38a72481b813dd8f00a2a278b92441f2dc6bd283fe429f34bdde1679dbc

SHA512
29c11df0609dd1802ffa4d6d5232e3199cd31bc80854e63f3d9b51b25d5e1aa69add0ae4d08f0b514b96e09cb0e6c18302109ec1a9d02208a9db585c21d2029a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
f1f9c7415fa778b1b8b6c14a275f4b10

SHA1
b4c771c00a9426205af6832a3276e7f4c5c2b741

SHA256
5033b6b2f2070dd955d79e76e325427d13b09ebc2102bd560a9893f911cc12d0

SHA512
c8d26c72711fa3a174b23e5ce83fa3d986badafec7b480c800fe9443b97b1728d1abfedc3b9a2bebd998c4236a66a91fade98a2ae66d2a5c58b042fd43610fd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
709e024fa8e5843077873fb3ca4f8596

SHA1
823da5ba9192742cd400fb05a7ac4413a28d3e5f

SHA256
3241b4f81c1c2ee84244a1cf778b729ad8cf4de8711cc3210b142ed334f97af8

SHA512
8b3fd7e84a9efb3805c010c4ee2a68fbfd6d5a53db0f0c77953c29ae23abb6126670ec80db2131150e081e7131b213430348312d950624bbd665feab5577306c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b02d051e58d61875ffe16d811df6777a

SHA1
8f8a74a78e16403fa308482e2040f2795e9afced

SHA256
87db7980785a4294319b14084a3c8e4fa207c4f41cc9dc9eb3efe34453390ea8

SHA512
8341b820c0cec284b0bbc0e40626e2c8d10000cb4697c991333e4346c46d568e934c2156fe928baf63121ab53b36c1cfadd3fa056167f399e55cc24782788b35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b8f29fc2181c601842896234fb42df16

SHA1
9b1d51f0135e20aa6983fc3dca3874c2d6534340

SHA256
28adff10bc879cec4c548abec2d207730c7a49ca252d7c0da0b7f755f4e444b4

SHA512
073af679350ad236b4332a5c1169729b2853f4cbbb6c0df8c50083542b2fea901397a548e3d68ecb22a9f9a9f9690cb477dc254d925aa583915346e7886870b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b3cd314be0261f209e69ad3cc15c28ad

SHA1
fc7aee9a85a3819023a7873d3dda4f3439095976

SHA256
8c601cb737698512c92b612c95fbf23a56818e24bf61f14d341b7ceb13b4c331

SHA512
f1ed094f5d759b090109c64f5dc558b1cac6fc30e24a5e2949c4fa6589d965cdeae52122e80fd17dab94729b6c1fb732f49e18bec15df2ebbda8adfd56efdbad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eda80a4cb439917169aaab59081a9ebe

SHA1
1460ee44260e8535816c8067f7381eac9292f5c3

SHA256
061b5d7ceb21a0e060bd9819ec12b0fd6767e7cb0c16c714aacb4d4319191b4d

SHA512
0c81d943c46f93ca4fe9628227db6dd50ef3aad9d5be09e1195d5af73746a5246c00bcc6b59e8e1d5d154a36de48777e8f0a02b7fe68d2350e524633fcce1660

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1ae1f0be473dc9c544c118526edaa131

SHA1
dd53da0c610535117cd1b4649a5bef4bde261320

SHA256
38303b4776eca32892d2e44a33566f1550bb499abd30e67728ccaf1e585b693d

SHA512
6b792bf1358d7ba0dce91641ea278491714546f7aa73f36518de8195773fc372eaa9647e130e0819534706f32a54600c28a92b9fac72dfc30b1d91311f9e20aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
153ade14e1b127401e0d587651e38a61

SHA1
0aa69dfaa9d116b1a0ca1291580625ee54b53f8b

SHA256
2741eac070e91a1b9cc93b952f0f05b11b7562ee6b986033b1c97e3f4ff32e85

SHA512
fc93e871d9b42a3da559ec8878c35d451e76206ceb15f5ebde1fb0d0b65a89ce639ddfc6932292522381efc37005d928a26c4422368487d3372c6a1ad8c179b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58f0b4.TMP

Filesize
120B

MD5
db6ac168f4b5e7c886ff3a164b4285dd

SHA1
433621570ed6335afa18bd37ca156cf71401356f

SHA256
dcd746a5d80eafcddd31d3ae08db696265f2f2ad92a255dbe60584af3e3d5f96

SHA512
b537beec67ec23532ea2ec6ef6cbbd129217e99eda28dc7df9356a25909b173a5642824e584d845f5d69602d4a45e428b4e34567da52428982b0d1bd140817bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

Filesize
2KB

MD5
806f9ab5ec6d8dab82da885282243b1d

SHA1
9c5c29adbd189c1dd460eb550fa81a0ab0452276

SHA256
db2fa323da62357c85588dcfedf4e8424d3a3e80a56e5d5fa9010efa7b8cd733

SHA512
da1262c220af91eb6abce65c7eab7af35a93e01f7254ccc70f7dc0d2492c1fbbe8b3ca681b1f15fdd2ae85a5328d230ea3ae3c374c3785a0c924bbdda2bb2694

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
a13f5d3e669cdd7e213fcdd24cd027d7

SHA1
e77a6765e6c6462a0a773f62b822bd5613f093e4

SHA256
f794ee6092f80daf1111bc97e1b8029d068220494f8992796bcdc7b9d3a3d355

SHA512
dd3b4b0e5387c758257d351ac9434826a8358dbb13aaf22b5409c61bb21f288f1f91649cbe680c753292391a210c2e989cc4242bd354501167cf40a8cabaeebe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Filesize
213B

MD5
046cc08d163fc4578cd1b77a5d0965ac

SHA1
92f503e605c30974baf385f1619f1269b81dec57

SHA256
693a60684aa9ff4f01cb6027e9c938f4701c0c898afc224a0776cb1e18e87166

SHA512
e8b1df36a237bcbbad897146ca247edf75466b2a4030fec620c46932b5c31137f2931cd2758534e4308aed3fb9cc40edf2d7646a38530bcc5e6d7069c19a3b1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
320B

MD5
78ebb9a46ea56c2299f15d1c6d76b586

SHA1
d495f163462aa58b11e7830cdc0d3dca1cca69bd

SHA256
84e58e1d1bcb94e425cade192e63c3f64689e2cb4c0a4a814c4c0306467283d9

SHA512
ca997492450ece94969dfc4175d0a273b8851faffeae5c7e77f680f6b857a890883f776a2fb1e6b2ee40964b949d05124a48eca42b4da3dd92ed6902cb6e546e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
d0d42e39d8f082d431afa30a6dd33d03

SHA1
08750ff97e5703694f34f08976f3c27c2e0d37f8

SHA256
66aa93c47c3d1f5e9cf6acd187f1e396ccb0fb69aef9399ed519323db7867a24

SHA512
d40ed52fe6978c6183713ca3707c06455f738e082ce04a9a6212d622c994771f487d4f4f8e52ef8885dd56af26f06c281d0609ae5867f6c390967e6f9ce52bf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
15KB

MD5
7d01825fe357938aa656f209487ffdc9

SHA1
152a486424a43f3fd01c35418fcd797a51352a5b

SHA256
cd57df898dd978a1d813d8691e6ac60e04ef02bbad849046f5356f36646fb40e

SHA512
2a68cdbc0527e347a57dc80e079424968b743136db68da5dca05086d3b0eb52a31b0fd04bfd46d166817f403046e055c56c87816ba71e0fc7cf9212fb3621fcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
826270930ce7a5662ae6447d2f5f9eb9

SHA1
5e9b8a070f6559688a991583a05806f41d7e6615

SHA256
620741aa79b1fab27049c60f3e709ac53e9a83d0c6c52be1faff21301f20176e

SHA512
0ae0be0af541b971dc92844139472c20a8c0a37c7f5bff0ece79024027f89b814e90120d78a8b975f7801673565d0367983754cb7ce206ce3f911d93893fed81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
1KB

MD5
b35363ec78082abfcc569c545fba0a11

SHA1
fc237586bed8f0549e419b086cbea7b6303eb44b

SHA256
7e2d5fa85d53545e9db7f1f58991b571b5023c3a95b35fef34b8d00471619471

SHA512
0ca13e5404eec3811d69b85cb91ca393689d6358b8e65eae889b7b64f9cb1c1f51402341c4be8271531392ffd00bfd9e4147dc7c19e8442126e2c2418243e4f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
61b2adaff573df7b10c6272a80d24f1d

SHA1
5e84788ae7c98e05de6e736b42b4474a2753389d

SHA256
91cedaac22dd99747d7ff2b2fcd22ed59749876a9a5c352ec028a4d32a5e4bf1

SHA512
dd0788ddbebc5d1b6bb9a8ae394651dd8ec7ed303196fb7963788f64fbe444823de44d99c382531a8c101f7cad1138c98cbf36d103c125b0d6a9bc80f57a9652

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
889B

MD5
9683e32cd56f18314da513af633d530a

SHA1
98b7c375cf187cf81d9ec1b35b14a69ea40f86bd

SHA256
6043f81cdd4662b9ddde9248d01846edf025ab529024d61eb83b07627066a3b7

SHA512
8d4f4e50aee15becb2c8f665be9bccfbb7ff69cdd898eb0e830f4db18ccd2f7c8dcc419be6e5533fe9c3c6fe973784cb39df76bedf986b7d6574c3a985838106

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
b7fc60c1827ec3e17b2c1c643756f9c4

SHA1
59fae7b951171da75ced4f8fa2279e78e88fe42b

SHA256
be30e8adc6ded365eef54d91fc188454bb1eb2a5506ba077df1c664164da7c27

SHA512
522223205f3172aa5533afb4f41f728ab99fc7fb2707225ede186f1850193f559caba93b38e4089c1237acf9ccd9b0bd69eb5d86da3df73f7a965d5466566235

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
009b9a2ee7afbf6dd0b9617fc8f8ecba

SHA1
c97ed0652e731fc412e3b7bdfca2994b7cc206a7

SHA256
de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915

SHA512
6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
f681324eaec1508cac0f793c29266873

SHA1
9c8a7a441b0483969429678af0613caa11cc6b85

SHA256
b4a63508513273535074940498839585b8e9710dd81faeeb2924413a53824969

SHA512
370e980c86ea9fdd60191af15971518fc23649228bc5f611a9195d1d3dfa68d4064ebf71634465aad46580ff5bad116b24e156f48a0ef567a52a3ac891e7b4f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
a0018c0c71503a63452a149bcbbbdf71

SHA1
34c60d63d9e11057baf40b2dcacf8e90a4eea8fa

SHA256
d441dc551678dece758cffaf5af0574dcd89f0f3137c5efe37aa8645927196f6

SHA512
7abaf9b2f6a3e0d71b7fe494842eef0d98507e94509988f6c389154aeeec38a6acb69d01a67a730f5ea219c0424796901387113dfa9c346b75f5b265eb8c9be4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
256KB

MD5
035d71c4d314fd2ad4170ef4148a1008

SHA1
f9a6a4d459ab5e93f88ad64306a003213140dcab

SHA256
9393634fc07c1b1fae51b7ac72bc23699109b12d08431fd60dda970fce8dba9d

SHA512
57472a8ce4e223b4c6dbb4dd6b19ba7bddc10f3ab7aaa2959ea505c51000049e03ccafcb4635e60f79480d3a240dee0d9763726629c5bb146a879508e2d38831

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
131KB

MD5
642ce543d401b60171967a4175c5ae6e

SHA1
03972aa25ec21bd86bacce4e39a23b9cde01a7fd

SHA256
0e2601f9cb4075c81c9d273bf342a1432a54e2404c1fcc6f3faf14067b741fe3

SHA512
cbe3033147182158996f4e0b36a4d84500e0aed2d1857a10fa26c953e7ae2b86872945e03d057039fdc94bbfcb68f5a24e68d785bebf500e2721f3b040e7c19e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
94KB

MD5
29e6fb70f8a8d2ce7242e2cd3cd83954

SHA1
56ac9d2aea1f611881b6359dc0829b41a6f08070

SHA256
d0f343109793a0db89cc21d377442f3022ab036f998955a3453a2d491509dd78

SHA512
1b03351ffcea3f1d24c0e05c788d409f476fc8f22e9b22624b1ae540f548a02615a06b65122809196764d07c8c1900dbff0644cb7e38764e28795da6c330e6fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
7c82135081e28dcb01aea72ab6ee642d

SHA1
f2943eae886d293444fb3fbbfe95a8a7e8793eab

SHA256
fb7302fc82c82ef5c75f104e55a1fa50f2fdd07258e71eed2f94fd414a934e97

SHA512
191da0cd4c064b66d76f2d5d8889809a97e12c70a17845a011032e60af60f27fe47550c269bc159d09b05ffa614ba2706323e3b5fefa04561db8d110ca2a444d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
49b65ca9f5a8d7f38ad9d6bdf4ae7e02

SHA1
c39403c7cf4a92301f4a5f24ff06fc3539bbb281

SHA256
0f5210c33b70f003a689c54362eab509f5ff188df2dfc83a50ee0d810e6ca1c6

SHA512
99aac95022d9b98369a142ea12de083d3d13b58fa8b982f60b97e562143c8db694b6c8f21a6325b785690a42739f1cfc78c82de96e8bb4c5499e2261a9ca03d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58f344.TMP

Filesize
87KB

MD5
00125873333a53c7b52a7e598d6bef97

SHA1
6b5d93cd73140fa57ce701692d1fc19c6e278eb9

SHA256
d6b81342b69e6ad25fc1d0d1018f118d05204af33556324d737c97562e7d80b5

SHA512
a335008165af4a70ca325a75597bf0162b97d0277f777458c584c4b591316ce17e47a058ff62d2afb71be3f52030b6e8d3c03a7422a0e7d30936e5d2562fa100

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
b00f3f56c104c94e03cd2ad8452c14e7

SHA1
51b78e45015e0d9d62fbdf31b75a22535a107204

SHA256
ba2b669020334ff01a85bfc900ea4371ea557bd315f154875d9bdfdc16ae8b50

SHA512
93e1609be5bbb414c285f37432ce93294c3d1583ef46c7c6c570c122f0b166c34b0ad87de708005c8af97dee27923ba53395a34c2563cdadf3c0a708848b3525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
b786e1823126511af724f5253d9281a5

SHA1
3c07d44876abc4241bda51fc114bb23a6bdea2b9

SHA256
6fca76a2a24ea404c7fe1df0e2f6c7f9285f2bdc5b99451000535ad23fd760ef

SHA512
cd52f5c194e50cf31eaa48b3a341dbf4487d0d147e9dce3b1807381bbba92e4be903e0a9749471be224dce33c6a2f621e9d8fa7162bce1892d26fdb6162201ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
8313e59436211bc6d0e088f0284da887

SHA1
573366b2d2de73c3c381dca1c859c2f04a7cf99d

SHA256
b4e87b35c46b2f0a7e722d364ec71b7ff8234017afac3baa3af4202f0356a54b

SHA512
bd191bd9ee606832dab44498cc995cd20317493789e7218382fc532475ce62e38c0d09f27e8f6bb22d1ab6ae06366356329e0226766d8bf4ffbc9dc2fb0c2f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDADB4.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ppzxsck.i5g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7886.tmp

Filesize
30KB

MD5
f10df902980f1d5beea96b2c668408a7

SHA1
92d341581b9e24284b7c29e5623f8028dbbaafe9

SHA256
e0100320a4f63e07c77138a89ea24a1cbd69784a89fe3bf83e35576114b4ce02

SHA512
00a8fbcd17d791289ac8f12dc3c404b0afd240278492df74d2c5f37609b11d91a26d737be95d3fe01cdbc25eedc6da0c2d63a2ccc4ab208d6e054014083365fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7887.tmp

Filesize
32KB

MD5
51804e255c573176039f4d5b55c12ab2

SHA1
a4822e5072b858a7cca7de948caa7d2268f1bb4b

SHA256
3c6f66790c543d4e9d8e0e6f476b1acadf0a5fcdd561b8484d8dddadfdf8134b

SHA512
2ac8b1e433c9283377b725a03ae72374663fec81abba4c049b80409819bb9613e135fcd640ed433701795bdf4d5822461d76a06859c4084e7bae216d771bb091

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7929.tmp

Filesize
30KB

MD5
1d6f8e73a0662a48d332090a4c8c898f

SHA1
cf9ad4f157772f5edc0fddeefd9b05958b67549c

SHA256
8077c92c66d15d7e03fbff3a48bd9576b80f698a36a44316eaba81ee8043b673

SHA512
5c03a99ecd747fbc7a15f082df08c0d26383db781e1f70771d4970e354a962294ce11be53becaad6746ab127c5b194a93b7e1b139c12e6e45423b3a509d771fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7969.tmp

Filesize
45KB

MD5
c455c4bc4bec9e0da67c4d1e53e46d5a

SHA1
7674600c387114b0f98ec925be74e811fb25c325

SHA256
40e9af9284ff07fdb75c33a11a794f5333712baa4a6cf82fa529fbaf5ad0fed0

SHA512
08166f6cb3f140e4820f86918f59295cad8b4a17240c206dcba8b46088110bdf4e4adbab9f6380315ad4590ca7c8ecdc9afac6bd1935b17afb411f325fe81720

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab796D.tmp

Filesize
30KB

MD5
91aadbec4171cfa8292b618492f5ef34

SHA1
a47deb62a21056376dd8f862e1300f1e7dc69d1d

SHA256
7e1a90cdb2ba7f03abcb4687f0931858bf57e13552e0e4e54ec69a27325011ea

SHA512
1978280c699f7f739cd9f6a81f2b665643bd0be42ce815d22528f0d57c5a646fc30aae517d4a0a374efb8bd3c53eb9b3d129660503a82ba065679bbbb39bd8d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab797F.tmp

Filesize
30KB

MD5
e033ccbc7ba787a2f824ce0952e57d44

SHA1
eeea573bea217878cd9e47d7ea94e56bdaffe22a

SHA256
d250eb1f93b43efb7654b831b4183c9caec2d12d4efee8607fee70b9fab20730

SHA512
b807b024b32e7f975aed408b77563a6b47865eece32e8ba993502d9874b56580ecc9d9a3fefa057fdd36fb8d519b6e184db0593a65cc0acf5e4accbede0f9417

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7981.tmp

Filesize
30KB

MD5
d3c9036e4e1159e832b1b4d2e9d42bf0

SHA1
966e04b7a8016d7fdafe2c611957f6e946fab1b9

SHA256
434576eb1a16c2d14d666a33edde76717c896d79f45df56742afd90acb9f21ce

SHA512
d28d7f467f072985bcfcc6449ad16d528d531eb81912d4c3d956cf8936f96d474b18e7992b16d6834e9d2782470d193a17598cab55a7f9eb0824bc3f069216b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7983.tmp

Filesize
28KB

MD5
6d787b1e223db6b91b69238062cca872

SHA1
a02f3d847d1f8973e854b89d4558413ea2e349f7

SHA256
da2f261c3c82e229a097a9302c8580f014bb6442825db47c008da097cfce0ee4

SHA512
9856d88d5c63cd6ebcf26e5d7521f194fa6b6e7bf55dd2e0238457a1b760eb8fb0d573a6e85e819bf8e5be596537e99bc8c2dce7ec6e2809a43490caccd44169

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7993.tmp

Filesize
34KB

MD5
53ee9da49d0b84357038ecf376838d2e

SHA1
ab03f46783b2227f312187dd84dc0c517510de20

SHA256
9e46b8ba0bad6e534af33015c86396c33c5088d3ae5389217a5e90ba68252374

SHA512
751300c76ece4901801b1f9f51eaca7a758d5d4e6507e227558aaaaf8e547c3d59fa56153fea96b6b2d7eb08c7af2e4d5568ace7e798d1a86cede363efbecf7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab79E5.tmp

Filesize
32KB

MD5
205af51604ef96ef1e8e60212541f742

SHA1
d436fe689f8ef51fba898454cf509ddb049c1545

SHA256
df3fff163924d08517b41455f2d06788ba4e49c68337d15ecf329be48cf7da2d

SHA512
bcba80ed0e36f7abc1aef19e6ff6eb654b9e91268e79ca8f421cb8add6c2b0268ad6c45e6cc06652f59235084ecda3ba2851a38e6bcd1a0387eb3420c6ec94ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab79F6.tmp

Filesize
34KB

MD5
62863124cdcda135ecc0e722782cb888

SHA1
2543b8a9d3b2304bb73d2adbec60db040b732055

SHA256
23ccfb7206a8f77a13080998ec6ef95b59b3c3e12b72b2d2ad4e53b0b26bb8c3

SHA512
2734d1119dc14b7dfb417f217867ef8ce8e73d69c332587278c0896b91247a40c289426a1a53f1796ccb42190001273d35525fcea8ba2932a69a581972a1ef00

Download Submit
C:\Users\Admin\AppData\Local\Temp\cab7B96.tmp

Filesize
31KB

MD5
92a819d434a8aaea2c65f0cc2f33bb3a

SHA1
85c3f1801effea1ea10a8429b0875fc30893f2c8

SHA256
5d13f9907ac381d19f0a7552fd6d9fc07c9bd42c0f9ce017fff75587e1890375

SHA512
01339e04130e08573df7dbdfe25d82ed1d248b8d127bb90d536ecf4a26f5554e793e51e1a1800f61790738cc386121e443e942544246c60e47e25756f0c810a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
02dfdee5d74b3d13b21aabc63dba885f

SHA1
087559c0c214d7dfdc380cb79a40bf5800ef9dc6

SHA256
93f6f222e2097d58414f415a2a25f18e45da65dc7a1c0d93b8234e0547372754

SHA512
86f495d64afb06eeea8c51bf3224145c464a692bd60b97ad118dd04f3f0bba6e3ccd84a23aa7bf4682901ded6f0a733aa7728132636dd8ad57b8c73cc28ca683

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
61c099bec8db7734e887d9c0d3008027

SHA1
44214eb815151e5c693c627bf526af0904405dbb

SHA256
7a78921a35e0a90d307026eaf584dc62516205660932b4a2e6043e6985afbd91

SHA512
7febfed7b403a4c45152bebda6ca46478933bba88829fe3d86ad6e85f1879e874deea66611fa0367e0c33e4dc298fecb48e30427b39c1703255ec73a0ad9f6cd

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
72B

MD5
550f02a8db0cf2679c2f015cac3f7ebd

SHA1
989c012446f9cc69f283aa490f565738be5cc68c

SHA256
d98526a743edda2e3470ad25fa5d4bc7277fa996cce095ed99affbd7d64e7bec

SHA512
cfffbb68b0227ec47043f290324e1b06863bb2cfbc561e743c44255417e4a216380ae2f4cd62de684f0ac36e38d26c973b7fb89bb4063503f421099cbf1ba70e

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
b1b18c77d398475fd4117729f2b27c37

SHA1
e7418667a2703e32abd4d41f930988fbda0f82c2

SHA256
006fc34f9ba769e369c452afe2ebb451f11f5a73d70c38ad0f6b6e1067936fab

SHA512
556b0bccd3243e0c5fc6103755bc6e2c5f885f7a46cecc9142828a292a0d043340a15bf5e228e4f0353a6a61105f796bd0cc7dd7cb437ab805f50d8ec14dd2c7

Download Submit
C:\Users\Admin\Downloads\WannaCrypt0r.zip

Filesize
3.3MB

MD5
e58fdd8b0ce47bcb8ffd89f4499d186d

SHA1
b7e2334ac6e1ad75e3744661bb590a2d1da98b03

SHA256
283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

SHA512
95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

Download Submit
C:\Users\Public\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
683461b1c662a1ba1fa2e18f7cc8859a

SHA1
6e602df84530773d130e968eeb38558467908746

SHA256
369dcdefca9d823ea23244137fcd7e283f124bc868a1b665b9fb59edb21dcab6

SHA512
13e0a8d83b07262131f59d4f218b1f972fd1e98039c2f6598c5e9b40e2badd631251c5bb3234c8d49c6a4722e594babd780d33008085cba7b93c1537021217ae

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
0c74a83b64f419486e084185d6996108

SHA1
875ac4c310983772db8ee74e7ac45e8123eac3f1

SHA256
97830e7d4f8fe2cd963c8cd1b5a5b5809b94f70524088782ad4f0174f2ff696b

SHA512
f8e181812049c32ee502e7d1689700359f5a9d7ae5e1c116bc365ec26f3d88dfa9da8c80f0aaeb49062ee9a93eb31cffeb43a78bc6d67ef7b89ca5a9a20ec63e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
32f39e02c692214df9dd8143d57ffaff

SHA1
1b31eba0a0ce39b70ac80e7b14b5f923c32bab03

SHA256
30bed2a5dbdc04bdbcd2056b68ca54f5e38e247a65fb8331eb3b62bc452e5eb6

SHA512
ea2ed75255093f449844ba02f353f779e50002bb9ccc8366b550a89a86a135b783c64108b6cdf4790701d3158c164031a67718576448f4af316d1855e9ed0eb2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
897f773b7e0a006734736f938a84342f

SHA1
8853cdc8baf04c988128e95d848e1dcc2ab65ce1

SHA256
37609cd49e9f342b23a3fda030fb06450d29e6de9f56bccf0ad78ba1ceaf5bf5

SHA512
da8aba3e9da4de94f2f5c566183497ccfec13815d4ac6bdb379863ef502ff6987372f1b11981657668595f1d60074d01a0368769dcd406357898a9d9e77f2b4c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
9f7692e61afd37d647db85237415ab51

SHA1
66e6a5561e2badd95d075d48187a02f073c1f6d0

SHA256
41cea56f51deb24ec8408af65fc097e79c4bd21e89e1c78177310450d01b8111

SHA512
709a179057e511441147eb9d1898a76d81e3edc2e5ec29f91daee44e6d7a0009c0cd62536f1e668d83ab3e2f0ebee67cf7bc19820ee487a9bb4cb9f27c4758d5

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
d64e66f33ab2867cb03fafd0fd9f199f

SHA1
b49802537fa13de4501101403959b1b87900c172

SHA256
142a4cc96d518e6005b3e3f14c9435ac9e908d4700672f9d8cd12e333830340d

SHA512
a1acfdb815617dd98101d29e0ff529297484cac1ac5ea177afd9d27a9d1b468bf2bec0cf88cf77e53917fb72527eab1fc14ca8eff601ef42b03590fbbec71fc4

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/980-170-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/1620-707-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/1620-773-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/1620-681-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/1620-355-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/1620-742-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/1764-157-0x00000000055E0000-0x0000000005934000-memory.dmp

Filesize
3.3MB

Download
memory/1764-159-0x0000000070850000-0x000000007089C000-memory.dmp

Filesize
304KB

Download
memory/1764-160-0x0000000071000000-0x0000000071354000-memory.dmp

Filesize
3.3MB

Download
memory/2004-130-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/2004-1-0x00000000046F0000-0x0000000004AF6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-2-0x00000000064A0000-0x0000000006D8B000-memory.dmp

Filesize
8.9MB

Download
memory/2004-3-0x0000000000400000-0x000000000441C000-memory.dmp

Filesize
64.1MB

Download
memory/2004-229-0x00000000064A0000-0x0000000006D8B000-memory.dmp

Filesize
8.9MB

Download
memory/2004-228-0x00000000046F0000-0x0000000004AF6000-memory.dmp

Filesize
4.0MB

Download
memory/2064-80-0x00000000058F0000-0x0000000005C44000-memory.dmp

Filesize
3.3MB

Download
memory/2064-101-0x0000000070FD0000-0x0000000071324000-memory.dmp

Filesize
3.3MB

Download
memory/2064-100-0x0000000070850000-0x000000007089C000-memory.dmp

Filesize
304KB

Download
memory/2232-93-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-96-0x00007FFC12560000-0x00007FFC12570000-memory.dmp

Filesize
64KB

Download
memory/2232-666-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-667-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-87-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-94-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-668-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-91-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-669-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2232-97-0x00007FFC12560000-0x00007FFC12570000-memory.dmp

Filesize
64KB

Download
memory/2232-90-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/2568-64-0x00000000709D0000-0x0000000070D24000-memory.dmp

Filesize
3.3MB

Download
memory/2568-63-0x0000000070850000-0x000000007089C000-memory.dmp

Filesize
304KB

Download
memory/2568-75-0x00000000070B0000-0x00000000070C1000-memory.dmp

Filesize
68KB

Download
memory/2568-76-0x0000000007100000-0x0000000007114000-memory.dmp

Filesize
80KB

Download
memory/2568-61-0x00000000056C0000-0x0000000005A14000-memory.dmp

Filesize
3.3MB

Download
memory/2568-74-0x0000000006DA0000-0x0000000006E43000-memory.dmp

Filesize
652KB

Download
memory/2724-674-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2724-679-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2800-132-0x0000000070FD0000-0x0000000071324000-memory.dmp

Filesize
3.3MB

Download
memory/2800-131-0x0000000070850000-0x000000007089C000-memory.dmp

Filesize
304KB

Download
memory/3148-25-0x0000000007860000-0x00000000078D6000-memory.dmp

Filesize
472KB

Download
memory/3148-29-0x0000000070850000-0x000000007089C000-memory.dmp

Filesize
304KB

Download
memory/3148-48-0x0000000007EB0000-0x0000000007EB8000-memory.dmp

Filesize
32KB

Download
memory/3148-47-0x0000000007EC0000-0x0000000007EDA000-memory.dmp

Filesize
104KB

Download
memory/3148-46-0x0000000007E80000-0x0000000007E94000-memory.dmp

Filesize
80KB

Download
memory/3148-45-0x0000000007E60000-0x0000000007E6E000-memory.dmp

Filesize
56KB

Download
memory/3148-44-0x0000000007E20000-0x0000000007E31000-memory.dmp

Filesize
68KB

Download
memory/3148-43-0x0000000007F20000-0x0000000007FB6000-memory.dmp

Filesize
600KB

Download
memory/3148-42-0x0000000007E00000-0x0000000007E0A000-memory.dmp

Filesize
40KB

Download
memory/3148-41-0x0000000007D10000-0x0000000007DB3000-memory.dmp

Filesize
652KB

Download
memory/3148-4-0x0000000003150000-0x0000000003186000-memory.dmp

Filesize
216KB

Download
memory/3148-5-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/3148-7-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3148-40-0x0000000007CF0000-0x0000000007D0E000-memory.dmp

Filesize
120KB

Download
memory/3148-30-0x0000000070F50000-0x00000000712A4000-memory.dmp

Filesize
3.3MB

Download
memory/3148-50-0x00000000749B0000-0x0000000075160000-memory.dmp

Filesize
7.7MB

Download
memory/3148-28-0x0000000007CB0000-0x0000000007CE2000-memory.dmp

Filesize
200KB

Download
memory/3148-27-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Filesize
104KB

Download
memory/3148-26-0x0000000008160000-0x00000000087DA000-memory.dmp

Filesize
6.5MB

Download
memory/3148-24-0x0000000006CC0000-0x0000000006D04000-memory.dmp

Filesize
272KB

Download
memory/3148-23-0x00000000067E0000-0x000000000682C000-memory.dmp

Filesize
304KB

Download
memory/3148-22-0x0000000006750000-0x000000000676E000-memory.dmp

Filesize
120KB

Download
memory/3148-21-0x0000000006180000-0x00000000064D4000-memory.dmp

Filesize
3.3MB

Download
memory/3148-11-0x0000000006110000-0x0000000006176000-memory.dmp

Filesize
408KB

Download
memory/3148-10-0x0000000006030000-0x0000000006096000-memory.dmp

Filesize
408KB

Download
memory/3148-9-0x0000000005790000-0x00000000057B2000-memory.dmp

Filesize
136KB

Download
memory/3148-8-0x0000000005940000-0x0000000005F68000-memory.dmp

Filesize
6.2MB

Download
memory/3148-6-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/3984-241-0x0000000006460000-0x00000000067B4000-memory.dmp

Filesize
3.3MB

Download
memory/3984-243-0x0000000070770000-0x00000000707BC000-memory.dmp

Filesize
304KB

Download
memory/3984-245-0x00000000708F0000-0x0000000070C44000-memory.dmp

Filesize
3.3MB

Download
memory/4336-192-0x00000000067E0000-0x000000000682C000-memory.dmp

Filesize
304KB

Download
memory/4336-230-0x0000000006030000-0x0000000006044000-memory.dmp

Filesize
80KB

Download
memory/4336-179-0x0000000005AB0000-0x0000000005E04000-memory.dmp

Filesize
3.3MB

Download
memory/4336-215-0x0000000007470000-0x0000000007513000-memory.dmp

Filesize
652KB

Download
memory/4336-203-0x00000000714B0000-0x0000000071804000-memory.dmp

Filesize
3.3MB

Download
memory/4336-202-0x0000000070770000-0x00000000707BC000-memory.dmp

Filesize
304KB

Download
memory/4336-226-0x0000000007810000-0x0000000007821000-memory.dmp

Filesize
68KB

Download
memory/5308-747-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/5308-746-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/5308-748-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/5308-752-0x00007FFC12560000-0x00007FFC12570000-memory.dmp

Filesize
64KB

Download
memory/5308-749-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/5308-750-0x00007FFC14E90000-0x00007FFC14EA0000-memory.dmp

Filesize
64KB

Download
memory/5308-751-0x00007FFC12560000-0x00007FFC12570000-memory.dmp

Filesize
64KB

Download
memory/5972-677-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5972-690-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/5972-774-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/6028-708-0x00007FF77B500000-0x00007FF77B5F8000-memory.dmp

Filesize
992KB

Download
memory/6028-741-0x00007FFC34AC0000-0x00007FFC35B70000-memory.dmp

Filesize
16.7MB

Download
memory/6028-710-0x00007FFC35D80000-0x00007FFC36036000-memory.dmp

Filesize
2.7MB

Download
memory/6028-714-0x00007FFC46150000-0x00007FFC46167000-memory.dmp

Filesize
92KB

Download
memory/6028-715-0x00007FFC45CF0000-0x00007FFC45D01000-memory.dmp

Filesize
68KB

Download
memory/6028-716-0x00007FFC45CD0000-0x00007FFC45CED000-memory.dmp

Filesize
116KB

Download
memory/6028-717-0x00007FFC45CB0000-0x00007FFC45CC1000-memory.dmp

Filesize
68KB

Download
memory/6028-712-0x00007FFC465F0000-0x00007FFC46607000-memory.dmp

Filesize
92KB

Download
memory/6028-709-0x00007FFC45D10000-0x00007FFC45D44000-memory.dmp

Filesize
208KB

Download
memory/6028-719-0x00007FFC45C60000-0x00007FFC45CA1000-memory.dmp

Filesize
260KB

Download
memory/6028-713-0x00007FFC462F0000-0x00007FFC46301000-memory.dmp

Filesize
68KB

Download
memory/6028-711-0x00007FFC46750000-0x00007FFC46768000-memory.dmp

Filesize
96KB

Download
memory/6028-738-0x00007FF77B500000-0x00007FF77B5F8000-memory.dmp

Filesize
992KB

Download
memory/6028-740-0x00007FFC35D80000-0x00007FFC36036000-memory.dmp

Filesize
2.7MB

Download
memory/6028-739-0x00007FFC45D10000-0x00007FFC45D44000-memory.dmp

Filesize
208KB

Download
memory/6028-718-0x00007FFC35B70000-0x00007FFC35D7B000-memory.dmp

Filesize
2.0MB

Download
memory/6028-723-0x00007FFC45BF0000-0x00007FFC45C01000-memory.dmp

Filesize
68KB

Download
memory/6028-724-0x00007FFC45BD0000-0x00007FFC45BE1000-memory.dmp

Filesize
68KB

Download
memory/6028-721-0x00007FFC45C30000-0x00007FFC45C51000-memory.dmp

Filesize
132KB

Download
memory/6028-726-0x00007FFC34230000-0x00007FFC34483000-memory.dmp

Filesize
2.3MB

Download
memory/6028-720-0x00007FFC34AC0000-0x00007FFC35B70000-memory.dmp

Filesize
16.7MB

Download
memory/6028-722-0x00007FFC45C10000-0x00007FFC45C28000-memory.dmp

Filesize
96KB

Download
memory/6028-725-0x00007FFC45BB0000-0x00007FFC45BC1000-memory.dmp

Filesize
68KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads