Malware Analysis Report

2024-08-06 15:50

Sample ID 240514-tdxpjade2y
Target http://github.com
Tags
discovery evasion exploit persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file http://github.com was found to be: Known bad.

Malicious Activity Summary

discovery evasion exploit persistence ransomware

Modifies WinLogon for persistence

Disables RegEdit via registry modification

Possible privilege escalation attempt

Disables Task Manager via registry modification

Executes dropped EXE

Drops startup file

Checks computer location settings

Modifies file permissions

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Enumerates physical storage devices

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Modify Registry
T1112
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-14 15:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 15:57

Reported

2024-05-14 16:04

Platform

win10v2004-20240508-en

Max time kernel

420s

Max time network

418s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.com

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" C:\Windows\System32\TankRansom2.0.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Windows\System32\TankRansom2.0.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TankRansom.exe C:\Windows\System32\TankRansom2.0.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TankRansom.exe C:\Windows\System32\TankRansom2.0.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\System32\TankRansom2.0.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\LogonUIfake.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A
File opened for modification C:\Windows\System32\voice.vbs C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A
File opened for modification C:\Windows\System32\TankRansom2.0.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A
File created C:\Windows\System32\LogonUIreal.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A
File opened for modification C:\Windows\System32\LogonUIreal.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A
File created C:\Windows\System32\LogonUI.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601758443788154" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Windows\System32\TankRansom2.0.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\TankRansom2.0.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4560 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 4536 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 3900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 3900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2692 wrote to memory of 2116 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.com

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc15bbab58,0x7ffc15bbab68,0x7ffc15bbab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3316 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4696 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:2

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Temp1_12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.zip\Volumes\T7Shield1T\230724-samples-108\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1820,i,14799853599652601823,2459389064283506781,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_Tank-Ransom2.0.zip\Movavi Video Suite.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\System32\TankRansom2.0.exe

"C:\Windows\System32\TankRansom2.0.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\System32\voice.vbs"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x394 0x340

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:80 github.com tcp
GB 20.26.156.215:80 github.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 170.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.112.22:443 collector.github.com tcp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
BE 88.221.83.179:443 www.bing.com tcp
US 8.8.8.8:53 179.83.221.88.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
FR 142.250.179.74:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 74.179.250.142.in-addr.arpa udp

Files

\??\pipe\crashpad_2692_BALPFMBYNPZIMFEN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 c819dcdecb57ccd6230bd9036c6a591d
SHA1 1e232377b7f2fa8c4e483ff9d0202ccd87babefa
SHA256 6905d1355010a340b7b30c95c89b1e8b5ab2996c9354d60fc388ecba3e49105b
SHA512 1c6eb3b2ca0828e1ebeea80b9ac0cb18ffe1d0d1944187ee784fd1d53e8d2b4255bddf0e8eebc7d087a78ad100b9d1db924c5f396e86fde976984aa4cdc5f1c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b91c8a924553450c267fa4483bfd46e3
SHA1 e381b714baf6c8e39acec5d20a932586ae7f6f4b
SHA256 99114f838d63691cdb3a880c0b2958e71c6b0342f6599dd543bdbad26d96dbde
SHA512 0f268f1d7438409531e06e91884461c9f26c33178c412b584d4c424831e1ec3a079cbbbf8825648e0922049a4c0d78681a49c8df647726713b97b688663e6b78

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ca6f31ca2898feb48db233d7f893b299
SHA1 3e1aceece3ef18186c822aec753289ca554ac5d2
SHA256 b5e4c89b1802c9b0df1ff9af03826b2c31ed4c13dfa3be38ef06e0f9a25a789a
SHA512 01d337833e8fc26ff50d744f1920a828244007039c4387015108bdd4bc073d82df2a3bc9ccded09d9881c307c094f21176ae5b83f32da96079b600312f1afa3a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dc01abc3a36fc18019ac8c7083461fee
SHA1 3797f9a4a96248834c5d02626d77cbd325aaf803
SHA256 e0204a6b15031f84b8daec39a12297020997dcd4120ccf73991888440d2c6587
SHA512 bd400d6feacd92be20ab52e506fa0a7e9ce0609c71d861b554545be24c586e9415d580987ee646e88ba1ddb54417e62113c9968cc52b077377057bac333a0b08

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 7c9b7184eb2671d09a0aa141a716f685
SHA1 a85d1d6a5b871892245cec72e7d5ac099a86613c
SHA256 8327d5c7304397cf1eeb0fe318892434cd4aff7b2fb96c8f4b24f521d4950524
SHA512 36a669ce3b3b1655b3a44f97a082f27d626d37d1d9980fba81eb819ae9f41d69356e816db73d150d8e2b1c54f8a764ab23e3616991ee1afb5ab0b63278d95574

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e2e3e69869722c60cca6bb496852f37a
SHA1 570ba7f55dd11e6f158a20bedd3eead2027bc5f1
SHA256 40a506bd4a5b4905362aa9ec6c4693e4ed51e67762a3baead6458b8f9515b569
SHA512 e88fe754ec8d74f889be9a61fb2c6ef8c66eaa6b2e4bdf885b644afc92ed1eab31cc89b3688f9ebc85785f2fe022f603ad4dad3f577f3753c89d5fa4c070c4b1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 58e232e46c1a1ce562188ddd3849bee7
SHA1 37fdd8bb40a4f30f1b6766347bf0dd575be279c2
SHA256 554bed3e04f62b2b52a191857964ca490a90916119cd8f17efba98688141bce4
SHA512 9e42ea9ca44a4353c7a1f68d4982a4f7f456f01cfdf631c6e95eb7e38cd9c9a5122e176f91c3e7d21c2c534c8ef9584505dd183b88d2c5220ae825c840db41ab

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7a994615405e66f7582be1c514a5dce7
SHA1 f08dc7e858f2fe340514fdf7928b1e8678a8ac10
SHA256 615030f9f34d8f9a798c4e647e1b25db84b04a0b2858323f195d19e8b34ea1e0
SHA512 0f409e532f8ba79cc7c3cb4296dc6002df2c368669386be8f3c28f0cb4f525622a3f7fb4dc92392a55a7fd42c5bd158b19b0f564e84c8a96d547600160fbf833

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c5487c8c2ac1ad58dc8c8ff5b56ba13f
SHA1 4674aedae75c55516879d0c0df93542249f98f87
SHA256 3c0e4d7b239e65fd6a6e622da8e8a3f89f17de2007a6eacfcd5da4e258e8b2c6
SHA512 ad8f61a28c72743f859e2243e4e82783941676f18c7c9d9addc9f1b974c655663550b4074b1fb8e578d2c80f064bd41db93a51392cbb9e5343aba900b07dc196

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f628f2d68ec1d9b3b5fe88767fbd4a5a
SHA1 ed78fa99add79215d9c462e4f101c39874f87534
SHA256 1c79aed964230b71e260e650452b700ad3216911b26cd6f9d8bf0085a87a5ed5
SHA512 6c9cf889cc3a321b10465c04be3c9b8b02068fb08e34735a9badb51e42988ebe76ce50db33103d8f9f51af137f78ff6da30fa4ed461cd901c59af572308951c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 89cd3b690ac49e88b87c3110f20d956d
SHA1 2cab10fc990333761ca1e00107de4e8fb8331220
SHA256 929f6abb8b247699cf1c47e61059884eb69166cb4334b3f11ee056a0c3b055ac
SHA512 4671e6c0d9f9ecc336aa985b17f018b3dded0e21c7503198f3acaca6a065d26d366a9ed640b724f18f65e2fc27264a4a23f0909fd63f6fccf3abd429c044fc87

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 77ebcbd69c7b93dd1e71fcc3ac3f5c84
SHA1 96c10b63b9e8ca1fad33b7b9d88da5bdf83bf556
SHA256 56e586dca299b9ae7087c7514429309db100c9f879ed00b6d7148c962b536053
SHA512 13f479c4d5f24edc73cba953317e9181d2d7b4e37c4d9e4275499b13cd7e1c43685f61dc62ad75c315ea8988fbfe79716c2a2aedf87ebdbf0e2b1314a3ce11ba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 265fe732c5b670e19ce75352fccc8afd
SHA1 f31f9e3202573ad3398653fd58e3c3dabb540b10
SHA256 9a0004d5e0786e2d66a57b96ec284dfb6bfd33f9acdb20cc0b6818265485235e
SHA512 2a07ba6eed6f3e601e74fab13a72ef4ca6fcf7def12322add7e95043fcdd928578cee4da7c918bfd1a77fdfd832ca0c89b05023f0df9cada8963fc46bcc7974f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ed9d58dbcb975e80b6e1fbe7fc82520b
SHA1 ee423bd84ac22ae13208bf0df4e011d730153628
SHA256 39ffbe0bc9753ec9d81b4d7b701679237933d10fd10e1dccdac705bc400ed807
SHA512 32d5d8e9c4eb184583279eadfb729a7e4824241357b04392227dfb441bae4c08778a813d8e44f7d15a0f908ef51ceb974545e582b00c12c6dff85f26846a7bd9

C:\Users\Admin\Downloads\2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21.zip

MD5 0b7eff1e81c21dc1b1ab562e941c22cc
SHA1 c9928379a599cf75095cf0243ad5119deecd6f17
SHA256 2d3160e8a0f52001f895c03fc6ac384b6c7396f16c95a4094ef1079dc7a54fa6
SHA512 2388703f22b55f5d6f5ab025739c323b106287f0397521bc64094508f3b5ce1448b9b20404af5f1aa3700ca82efeb78663ef6955b9ce880aa1a498a998a15fc7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 466f259201b4224dabf31d1392877edc
SHA1 e0e467b9e52507c54b2a27de6afa244419d386da
SHA256 377248d7d3421ae00f86730d329c18995bcddc70aa0dfddf491d0ed84a91c780
SHA512 88686bb80e08591d1af7e56c7ee30897393d4d2de64e0e9f0c7583be4fea50faca932488957b587ed7a3d0746aea9bec887411401c1a44522e4f8e8f548a4a75

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cd8184aa7950ca4fd1cf4c237c22da26
SHA1 aba6b20e2f82ea8e7b8cf2248ca3508aa894d9b3
SHA256 fc63836c8f68c041536de89943b0190cd5a302fee8badc14fd856e7dd1df557d
SHA512 b2178dcad5bf00e7ddd4809d9a63dfab1435e404043bca155c38c69ffc65e62b21422e1b014af708b9bd75597e28c63bc1cec39cb61b2a362e260b4483080592

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 a114b4a5f3902f2057abbdf13108a8a6
SHA1 f26b5c9059a55f93d9299d372bcd1bb446f8f11e
SHA256 767eab049c3645255712ff4d2195d40a271689bce8be3c82e005e059cf90f1e6
SHA512 8e1594e3328d852e1e886a0a992fcab89fe1e72ee00016b7dbf570d5a64703b9e4749da80bceb9ce1b1bb68e2775dace4005d5254c374896ee496c9b95192136

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59c809.TMP

MD5 909c295160e775e327bfe1420ce46227
SHA1 47eb93e41ad72b6bc11eaab4c0e7536f048beb40
SHA256 9ea99d5672a1f0dd0f8bacb30480fb44cd4de7dabcc6c831ef492eec4bca0619
SHA512 ed1db5566ee7412ade54cafe8f21c37292b5f6bf2a69cea71c515cd0ea063cd2bf7309af878989e043074f8b2da919818f276514b326c6d72a1a2d14f6474aaf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1407203065a24f7196ee4c7a99650ea5
SHA1 70ee2bcf96eee1b7fe5236618719429fe1da971f
SHA256 4239aba39c315ffa862a2a9ca5996cb9d6c563e4526a63d976988676c6104d8b
SHA512 c80299d6408866e90f8b8d2fb04a9862e2de11df8d405313ca2cd496dc8c35f860ad87eb9cfeeca6ca3fc8dfaa14814e9ecd575be981501f21b6bb26f7d6d18c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 33e10886b3b06ea23b2075b3471bdf9a
SHA1 1841cb0d57deb1f50baeea54fc51666683c30ab8
SHA256 92845d9114c90e998406fa7e720cbd2339a70b779768843ca016a9825747b3fc
SHA512 02e9ea7b4aebda2c451706c3cadda56d71311247e11bf9d4c33d94fdd9115e828b5b1de7d9d93f7e1ce5425d8f3aa93ae3c53ce1eb40d3c53dfcb4211f51514a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

MD5 95de4388ce919e280deab81630f80dac
SHA1 97dceaf7c84e5313ff898af7620552f3a812bacf
SHA256 4e161daeaa2d8efbe9040307c5b8cc85bdfa15bbb376b7b5774375410732040f
SHA512 5cef016330a6c3f28a778736b32d568a5ee3a81790ce638fa21b298fbfac95ea40c5cfdaaf2138fdc9aafefab01e5ba6a6d5d9638f08f1f430899d601043d38b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f1739a61583de9ad93383bcedbe08b86
SHA1 66ea9097072c6989717a76f33bb808ee928f6460
SHA256 146925457cf43115b40377a892d5ed577c2fdd267e90f9fbc51446f5ec1db11e
SHA512 891a2f0d4f65c51f918277e16ed1d0cdca1a086a4e0de8803d4a9b8047426e8e5fabb1910b3dd8a1d212b33685f793973c0dc6fff56ecda3883d6d563ad47f05

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 8656819decc068d82a261881d7df82d5
SHA1 c2eaf97d1cf32c1ed2d81aae1276a61ddb58f7cf
SHA256 4c11a6ec33f2e81a6e5e0314dc3a876e41c38126729701fb0d1dd67d7e3f90ea
SHA512 ea639a67485b541befeee720c7695392b51673c083f547392a6eb2ee2dc80f82c57b275569565f4305a7410f713eb2bb968c86835ad4553cdce3691f72b3e1d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f8413d32d7c45ec3407dac12299a4ec5
SHA1 e7c8c0451b3d1252c3e776856a28c00327554e47
SHA256 8c9d8ddb95cc01cfb3e732ff005484147eb95281cf9a281ccad561a33352fb9a
SHA512 60cdd3a365f616de9390007616332bc2a3516caf166dafbbba96f6cacf446533d83ea44487e27577bd1f0a87e5b16cf19b6a79a3bdb223f143937f68fedfb210

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7b98965ce18c4fa9bbf6933996b01524
SHA1 30953983cdb85fc5d09fe2832387626e44ca7d48
SHA256 f2552379d17de52f3cacd0c9c5fae25e50a0f3eb5ab8cc2f2592b3f7d6023417
SHA512 1a04166df4d6b80a1ab7178674beaa8a4c2c2ab18646c339d3c84dd1e908d56de1304d38dea229905ee47c1df9b138cb9f19a0418e20721e02371eb5a207a1e5

C:\Users\Admin\Downloads\12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.zip

MD5 8eaea8e00d34e99869f5e8dcf1037df8
SHA1 4b61e43d24398af299e6f150ea5098f2cc47b21b
SHA256 d8c5e219c9d2c82349dc69a2ff9d2146644de56bb61a1f32a35d2c6fdb725107
SHA512 8b1a6ab79b960ccff3ba76233eec43c3f4d17aa4bb8a270e2bf0690304df1a86610a91f1fe4885ddec2c4a0ab645d80eba4ff87b8a604dfd78cfe7a3c7621834

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 dea0163de080d4fc980ca929bce8b032
SHA1 159719d388f4e6c28ca4b515bc78e67395f8166e
SHA256 d7d6dd53e15b0d664c9dbe3b82b26062721e16a09b6b861b45146625035bf2c9
SHA512 9ca96adb999cfab970297bcdf099e4b1907770dc64196e6a3cb30a52e021043430757441d714bc334e925c0d34a43b68aba4ddde94475d23a897887712826669

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8f394a481968a5f2c8c36dedc07a1a85
SHA1 eb33b6f9ce38c05d48a8f296d4347ec069e6b85b
SHA256 dede606e3c6784eb91113e9f96b09274f594f894589726cd5dca154164d024c9
SHA512 dce8916da7820205a6fb0e380a4ccdabafbdd5c56b252d92b7cfafe21bbcb5f709fccb1733e01ee4c37cdb10d695d3400d510a164d2194d410d8ea47d2d9a479

memory/4524-637-0x00007FF7768A0000-0x00007FF776998000-memory.dmp

memory/4524-639-0x00007FFC06D00000-0x00007FFC06FB6000-memory.dmp

memory/4524-638-0x00007FFC1AF60000-0x00007FFC1AF94000-memory.dmp

memory/4524-640-0x00007FFC02FF0000-0x00007FFC040A0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 dddc9005d45ad8ec2ecc09a573aae784
SHA1 ce08fc44d052e0a63c2db6a4c9340d0896b91c92
SHA256 6d872eef7e94c0a46adbd9c42211ba6d0ce9a1540721ef0a92e771c64aed4c4f
SHA512 ca47273bb44f811ac3c64e2c7d7ea9b206a532d33413eb07b24da9e1b8edeca6fa8ed1ac87f25085c82167621bf2fd9b895e0b674ed89735fe20cd77a93731e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f5ccb442c8b8f9e9_0

MD5 e50b7f0f99ad84538409a773e1de9a24
SHA1 a1f2054b5bbfe2e61e480dce0d3eb8c73825aa76
SHA256 c281659abb63c72ff00a9701c8b5b498a8dd83697d0711ddef612f6a52b7482c
SHA512 90cdd890fd6672908a6c1b86d1b4a6f4e9800d831446b9b80aa49a85ae81dd90a0ad6d824a3981f61c18e046862f514fd180d6420be2d3f184599f5a672ada1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

MD5 20eb2919c6cff126cc0c70e0b3668753
SHA1 099abc5d9b36163fb553d4623388b82b916d9596
SHA256 255a5705756bccb6beeccf8a3021bb12628bcec129bada057a39e70a45c66d64
SHA512 1aefdca99e2268f62cd42acfd301a5ece3d2d947c5d2b3f4d64c0ac39b69cf8dbb1a00937492b325f686d6525ae9634f197fec5ea57fcd3e46b0d93371570e10

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2774a911e8b4e3a38b3c71c56818f489
SHA1 41a28819d5a4017a4271d27726cf57d32f8af2f8
SHA256 dea39f7844e7286590f773076f26fe1685a9182c1d1c7c5e21a8334c9e692e6f
SHA512 0a76f794dec9e9826909c99810d300c1d77820df457cc67b8c494458311055d779e765503c59ae69b4ae2a7b3647eed74bca79aaf620ae0180fefade4da803bb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3718463ed7f0e840c19c40751782554d
SHA1 3dfd04e9c24c5c78bf9eb402334b9558e27e4d02
SHA256 4648e30be1e09b2323a90c9c9269e5e4515351ee6c0e9cbb769be4399a094142
SHA512 fbc3bd5c80dfe4141affa6b0f5aa8c0de19718f8545758877e51ab0001ab74d4c0da4aa46ea97aeef5e5605009f308a3b3584abf2a519b018ae92aecbf58c0d8

C:\Users\Admin\Downloads\Tank-Ransom2.0.zip.crdownload

MD5 b6e2c99195ac4ad593316f7424602c41
SHA1 97bfbb2a5c14135b0a10763b7d871a46721d2ea1
SHA256 c84af6786b6170cfb81ba1faed06af6425fbad8ce97e7fac1b3bf46d209dac1f
SHA512 c44f5722baa60c1a270b22695bb6e8899731bcf351d4f51c42efe85e9e70133399d9ff99026f96d30653f66fbc85ea62fcb37d8c30540f6c15e2dbf20c76669f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0c7d8692a76f4f6586fbfea5668f5d99
SHA1 395782d49af7bc3bc1065f0196ab91bf324b6060
SHA256 2408c003c1e5d2037fd229afd98a8ed65bf1dd3c00503b3a06bf31a820190642
SHA512 61e0b633147c830c35320abb0eb337f2dcb2fc200ec94d1a648dc38c9c9d452b51e88caebd7012e65a3b0f88843b63413a59f1a47ad1ab3af9a42d92a0fe132c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 24496dd6a79d802ec986b559c483a5d6
SHA1 0e9b9033f5e8ae68cc83b0e55639c7abc7e75108
SHA256 282ba3178afddc6c59164b7e6cdf9f6caab71de2e40efa0cac6193aaf7a34c04
SHA512 e087c093e4cc696b27cd66d2d8b04f750f4f79e49dac579ddf22762e4a20f072f07b94397e39580babcd8d57fb0b6f510dae494f6a2991a1e6adb420b3530654

memory/3020-730-0x0000000000BF0000-0x0000000000C3A000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 518508807a1cfd441f6d3939023d5959
SHA1 eb5d62202c8537bb74c3a3054de509f541fe0d31
SHA256 62cbd4c49920b06929cae3fc01f22a69e0c48cf9eedceda9d85e0cefe34d88f4
SHA512 b01f73e7d7133bddfd312af5adbc7da04c35f534e1286f4880809885764ad5eb2101d80a33214f27988c0b22bfc1cca6a75a1af81cf3b96cdcec08eb307690dc

C:\Windows\System32\TankRansom2.0.exe

MD5 855f0f74bbd2d54d1d638be889578aed
SHA1 fae4ae22aa2ff05e1462730dc5f723cb84173262
SHA256 9f236c3e2f78823d44e0d5fb3f62d8333084f95d6bb927ea7f7717d0a0f138b3
SHA512 8a9d485022348ad6029a292960b2072bea7913709a97fd9304933051c10cce8e423e22043f80336ad434aaf5cfeda48105940b410ea157cc311001f796fd2ffa

memory/1996-758-0x0000000000630000-0x000000000065A000-memory.dmp

C:\Users\Admin\Downloads\Tank-Ransom2.0.zip

MD5 7eb27f780762de1f04a53027f6796657
SHA1 9db6e08af30825b479040dbfbbb0373c0b683585
SHA256 4364db13ba145265367afc354eec1368e73d9fa384c09cb738b93a15fd5519cd
SHA512 c1229dcb496ea7a6f55c5df64c839eea05d49e8cbdd62e04dab9f92b18f3281eb71853c892fef2ea1455bde4ad00675578670d6e94a80f1de49bc8613b528775

C:\Windows\System32\voice.vbs

MD5 f3356dbb18fb01413eb46d5672b0b3d9
SHA1 1b14464cfe89ee88cb4b9501919420eb73d9294b
SHA256 21982b5e271f90f9a3462d265eb0a213cd3315df841fded629fedea62b4cf31c
SHA512 1a766a765a28a3fa3d5b9590a6b2c3706d2d8638ac37bf367f66668170561b31be6adc0414942f88546a9430d911320c3aa46132fbed83bd152b35b96218b2ce

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_27D083846948401ABC859A4355AD6E68.dat

MD5 64b54cb9d5c72cfb24a2c96513510a0b
SHA1 bf013c9f47cab00ea4fb896cb970d02a76b61a1c
SHA256 848eb942ca4b8a065d8947d570a58a8f104ef9d1e633dffdf79c94e7f04c0515
SHA512 2eb48bc10dfc436962c32d50f38405c2aca2889a7ae64dd5bbd7faafc1540ab0872319b02c5e7e45256f72b943b2e46d559c27936d29f69817ea4001a0c31fc0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8a908ef3d97add3a_0

MD5 8649e5b81a037e849ba042abbeb28657
SHA1 6a5e087886ef7e126d3fb550c777e8e8bfe68295
SHA256 bb8530e512d9f6a2532a0f609a4ce3a6605c36a6601127496be3de1346041c4f
SHA512 8d26479c3bd58065cfa01c467a39cbaef72b4b8d31fca2b223409de5367444e9bfe6dc85e755f7cb045f1af99daeafb4a13dc26b7a303ce5fcd3650a5d830b26

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ab9b4968d1d15f0b_0

MD5 bddc70b6a90e7a631e6a6fe60c7b2d51
SHA1 d881b7678d7611742e47d4adaf9b39720ae12767
SHA256 361d0962c0da08b2b6a71d7f4dba3810bac6a6882689c73bd8a873589252bae2
SHA512 f7ebd6987ccfa307d95a830ade46868a75508f458ea891e8ca8b821941252c8d905e8eeed1a911b5a0dbb761843cde57f6ddc5df0038390821d423d0cced20d7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a80ca07e38a4bd5a_0

MD5 cad9dd5173f761562b41d6de32b6ce06
SHA1 8aff7dbfa6ca02ce0f9567e0c6e889dafbe0d6f9
SHA256 36aec190b1e0da22348cd7822ec13ff460a3ece180aa0726d8998f6bc11595f5
SHA512 febe535c1ad486868f815829298e14949086ca14a2e3e28828e3a9d28963c09dbd0ef23d8bbbe6988338cfcd51f98e09bad674fb0bd7c42224fa20d5902fd20e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\338cee54502046a8_0

MD5 2c5931d82d49ba2c40f2f494254af4b6
SHA1 903bb26fba39186446a7deaaf09397e1fdd35cea
SHA256 76c92133050dfb9e1df0990eb9e70ecf4f5e1760714b6f9ad602bfe9a9297273
SHA512 70aaae6538b8ae24bf8e5678a9fef5635c50312f83504d5f84b18b49978b1b24999d1fc9595cf1be80016469a249126406723983ccff7b58aa56d62d90e5d190

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bcfcf7af75ee7158_0

MD5 4011165f0997afef8d0d1f14dc023662
SHA1 76a7da5442fc09b3145869da6603f450aac86674
SHA256 32800bf5a7b830248a85ffe61547c05080a7e57b775102c89434d3a3089e08eb
SHA512 29d9575bf83aa9f67625c5ea92908b224d89c2fc5324cadd8e388dce13f97bd0b5ed0ad9e9897d3d3473018da7da353c08e94e66493b1dc37a576a0d4d71f186

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 87e75411c48d551e08c72b7eb30d072f
SHA1 ad7a0291f08ea67d30ef7e1652dc6d2555fc6f96
SHA256 9e9b32ce6296da501aa0cb030a989efea604ebe8aa261e2a7ab4dc0872047c92
SHA512 321c6c26458b4b6a189484165e8109f428605bfb129a4c8026dc162961fd00094918c0c9a4ef2eadf58acbe164e08a7c01ce26b6e030781984a23244ff4c866d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\be2f8f8f24ee2948_0

MD5 56c440d8b4485fbd1dd2be830240f7db
SHA1 8cf8f8c5f90e74c22c76c614701aec1e7ee15b0f
SHA256 47311e523d8ceb82535aa1ab42fa77bfd1754b7928bdb2ad4b406305d32d9b22
SHA512 dba2cda6620e58921326359e9c44e0b3aa0e756ccf28f24062111fadb30882c0add0fedaa843aa667fd163f4de455438653a995004a0c12443581832b0556bc4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ac9cc4312da18d64_0

MD5 be74747958e06f6f9d7fdce20bf09836
SHA1 b113f6d1055e9d46ccbde4f0017f2e7f233553e7
SHA256 7641f5fd495c164609a2139f9f62abe9a86035bc4632679a132ee06b555aa2fb
SHA512 007e76f77d8221ac524658900f009482b7e89582e767e5f393b79b8ba09aecd3cce14c3d22711e2857c83832db3b67b61cf11f6e8383635ceb70d10ceabfc648

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5d0915f091119a47_0

MD5 1c28206903113234b3eb795fb4cc1c93
SHA1 dfbab95c9623190e4daabfd0952809e145ffa099
SHA256 cd444e9be02dfbb5f23be590701ba3e9dcd17af4b2e8fa9cad7ee2ba0a605582
SHA512 65458346e88f4b00e89a62d182a52f0aead84d3681804686f6107c3eb56b3c2f4b3f43ce5216417b873a953948b367389c14db3c0665189b3b86d2e3a4e39dd2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d647e9a6a3d48f22_0

MD5 d05cdf3746daa6f3e2172f0062db9683
SHA1 a7e6634d1bb5bc25d285397fb60b87efa0f0c650
SHA256 6c808a513f0076c52fee1cf6c2a57170cccadefcc7054cfd9fe219cc9effb5ea
SHA512 b987fc1c2e4ba37c3c3d7f19c208f9c59887c6ad73048b93f19856e2a83d1346b27423433133d0e6a2ac73fe27af6bdec7ce70b85f0f728dcd7ed2baf89a7790

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ee3134534b5646f124045bc98fde1392
SHA1 d32f4e08c0ef58346a0e9a5336c1dd0d878980f9
SHA256 4178ba042ce1bae93ab032c81da4a5d8789e31a153b62c4f089124fd6bc7ef28
SHA512 a3a1a2cc43ea1c365245812f92d4a98ef85d3126818f08a90b4c4fdbaac2339c352b9d8e238e378a337259ba118073252f91d998dcab813623f27c2665b88902