cerber | 8e0253a08faf294eb4752c77cdb107f886be1d3374ccff6236f8924e56508a5c

Resubmissions

24-06-2024 15:05

240624-sgfpra1hnk 10

24-06-2024 15:04

240624-sf1crsybmb 1

Analysis

max time kernel
758s
max time network
725s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
24-06-2024 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

files/dom-0.html
Size

74B
MD5

47567aa590acfb67ef92453934d200dd
SHA1

23b2cd0138112f12d9d248ba69447e625ea3ca77
SHA256

8e0253a08faf294eb4752c77cdb107f886be1d3374ccff6236f8924e56508a5c
SHA512

68b3f2dc7ba905e20c34e42b95a72fc8850d7655c339808a40f8b378ed338b0f0293c2b39460d8b3d41eb169f7d192ec93a880a7137617bc1b37c635bc98b149

Score

10^/10

cerber wannacry defense_evasion discovery evasion persistence privilege_escalation ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___97XI3M_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/BDD6-5781-4B4C-0446-9F4B Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/BDD6-5781-4B4C-0446-9F4B 2. http://p27dokhpz2n7nvgr.14ewqv.top/BDD6-5781-4B4C-0446-9F4B 3. http://p27dokhpz2n7nvgr.14vvrc.top/BDD6-5781-4B4C-0446-9F4B 4. http://p27dokhpz2n7nvgr.129p1t.top/BDD6-5781-4B4C-0446-9F4B 5. http://p27dokhpz2n7nvgr.1apgrn.top/BDD6-5781-4B4C-0446-9F4B ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/BDD6-5781-4B4C-0446-9F4B

http://p27dokhpz2n7nvgr.12hygy.top/BDD6-5781-4B4C-0446-9F4B

http://p27dokhpz2n7nvgr.14ewqv.top/BDD6-5781-4B4C-0446-9F4B

http://p27dokhpz2n7nvgr.14vvrc.top/BDD6-5781-4B4C-0446-9F4B

http://p27dokhpz2n7nvgr.129p1t.top/BDD6-5781-4B4C-0446-9F4B

http://p27dokhpz2n7nvgr.1apgrn.top/BDD6-5781-4B4C-0446-9F4B

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___2HSZG2_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="YrNAcEJX4" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yoADoy6nNSSSu find the necessary files? Is the cbwlc5Bontent of your files not readable? It is normal beaK3xDVgcause the files' names and the data in your files have been encryphcaD7kted by "CeAV2rber Ransomware". It mem2uWans your files are NOT damageDacHKvYgd! Your files are modified only. This modification is reversible. FSmpArom now it is not possZXtPJnRdzible to use your files until they will be decrypted. The only way to decF7T3qssW4rypt your files safely is to buy the special decryption software "CZ1yvyusserber Decryptor". Any attempts to rest78ore your files with the thirwJacZd-party software will be fatal for your files! <hr> You can procj6vWhlUeed with purchasing of the decryption softwlQNare at your personal page: PleVIV9ase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/BDD6-5781-4B4C-0446-9F4B</a> If tJKLjKQyohis page cannot be opened  cliabNHsRck here  to get a new addrCIess of your personal page. If the addreIpss of your personal page is the same as befogYAre after you tried to get a new one, you cXHX8P4Gan try to get a new address in one hour. At thwSis page you will receive the complete instr2JkHuctions how to buy the decryptiHoOon software for restoring all your files. Also at this page you will be able to res1uK4cAxtore any one file for free to be sure "CerbeUr Decryptor" will help you. <hr> If your per9lFM6Ngsonal page is not availallHCHiFble for a long period there is another way to open your personal page - insta130iEgkllation and use of Tor Browser: <ol> <li>run your IntelNscihLrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entoWCgIer or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadnuhuRmPHieing;</li> <li>on the site you will be offered to dojNURO6Iiwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>rufvC9QQZ7Fyn Tor Browser;</li> <li>connect with the buttHTYJ5vKhon "Connect" (if you use the English version);</li> <li>a normal Internet broaeS9Miwser window will be opened after the initialization;</li> <li>type or copy the add0BHVMPyress http://p27dokhpz2n7nvgr.onion/BDD6-5781-4B4C-0446-9F4B in this browser address bar;</li> <li>pre87h3kGfBss ENTER;</li> <li>the site shoqKDEyuld be loaded; if for some reason the site is not loTp2gc6tqading wait for a moment and try again.</li> </ol> If you have any prKHH5qnaBLoblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searc7uYadAqh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> AdditXHional information: You will ficnd the instrujRWctions ("*_READ_THIS_FILE_*.hta") for rer0bz9wMstoring your files in any fOHByolder with your encjV9YzD7oxDrypted files. The instrKafLKuctions "*_READ_THIS_FILE_*.hta" in the fzJWuKDrgHQolderPrJqcs with your encry9DSwjSndhpted files are not vir1uses! The instrucQPLhKT3Gtions "*_READ_THIS_FILE_*.hta" will heywElp you to deco5s0NzqKHrypt your files. RemembeWa8eEnmr! The worst siotuation already happnCened and now the future of your files depDq9zL0pends on your determvcQrwTSination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/BDD6-5781-4B4C-0446-9F4B</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/BDD6-5781-4B4C-0446-9F4B" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/BDD6-5781-4B4C-0446-9F4B</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/BDD6-5781-4B4C-0446-9F4B في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضkO46F9Bافية: سwxsV5وف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرشADtMMz5174ادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موdX21mciNYقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！��

Extracted

Path

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (1116) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2220	netsh.exe
2012	netsh.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\	cerber.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDF2B2.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDF2B9.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 29 IoCs

pid	Process
536	taskdl.exe
4072	@[email protected]
2164	@[email protected]
2860	@[email protected]
4268	taskdl.exe
3708	taskse.exe
1152	@[email protected]
2112	taskdl.exe
3744	taskse.exe
4516	@[email protected]
4900	taskse.exe
336	@[email protected]
3696	taskdl.exe
4404	@[email protected]
2444	@[email protected]
1516	@[email protected]
3668	@[email protected]
1828	@[email protected]
5260	@[email protected]
5684	@[email protected]
4436	@[email protected]
5420	@[email protected]
3328	@[email protected]
1016	@[email protected]
1512	@[email protected]
3888	@[email protected]
5200	@[email protected]
4216	@[email protected]
1664	@[email protected]

Loads dropped DLL 9 IoCs

pid	Process
2976	windowsdesktop-runtime-8.0.2-win-x64.exe
5868	MsiExec.exe
5868	MsiExec.exe
1960	MsiExec.exe
1960	MsiExec.exe
2076	MsiExec.exe
2076	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5036	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vzjdxkijlvlgfga147 = "\"C:\\Users\\Admin\\Downloads\\Ransomware-Samples-main\\Ransomware-Samples-main\\WannaCry\\Ransomware.WannaCry\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{63880b41-04fc-4f9b-92c4-4455c255eb8c} = "\"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\windowsdesktop-runtime-8.0.2-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.2-win-x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\documents	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat!	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\desktop	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird	cerber.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpEA66.bmp"	cerber.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll	msiexec.exe
File opened for modification	\??\c:\program files (x86)\bitcoin	cerber.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll	msiexec.exe
File opened for modification	\??\c:\program files (x86)\	cerber.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird	cerber.exe
File opened for modification	C:\Windows\Installer\MSI65D2.tmp	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\office	cerber.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook	cerber.exe
File created	C:\Windows\SystemTemp\~DFBB286E69A11792D6.TMP	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\onenote	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat!	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\the bat!	cerber.exe
File opened for modification	C:\Windows\Installer\MSI536A.tmp	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook	cerber.exe
File created	C:\Windows\SystemTemp\~DF65FB9EA2881720F4.TMP	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote	cerber.exe
File opened for modification	C:\Windows\Installer\MSI6CE8.tmp	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint	cerber.exe
File created	C:\Windows\SystemTemp\~DF23545CF291A60558.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF135461F47E2F80A1.TMP	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server	cerber.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC2C520C5E7AE1392.TMP	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote	cerber.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD482F4F9339D3933.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI557E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F14.tmp	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word	cerber.exe
File created	C:\Windows\SystemTemp\~DF67BF357668FF6FD6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI600F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI638E.tmp	msiexec.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\office	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird	cerber.exe
File opened for modification	\??\c:\windows\serviceprofiles\localservice\appdata\local\word	cerber.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4048	taskkill.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637151809941736"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63337BB296F4141479799EDBF63E89A0\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63337BB296F4141479799EDBF63E89A0\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.8.8795_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings	cerber.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DF1F64D8EF250D42BCA10C1326BB942	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_SHAREDHOST_8.0_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D881F2EC0135A4B72CA89D27FD72F577	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9DD61CBBEAD5AD449609DDF0061A46BC	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DF1F64D8EF250D42BCA10C1326BB942\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63337BB296F4141479799EDBF63E89A0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.8.8795_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{63880B41-04FC-4F9B-92C4-4455C255EB8C}\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DF1F64D8EF250D42BCA10C1326BB942\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.8.8795_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\WINDOWSDESKTOP_RUNTIME_64.8.8806_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9DF1F64D8EF250D42BCA10C1326BB942	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EC4D2DC6E5F594446E1328CE265CCE74	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_HOSTFXR_64.8.8795_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{63880b41-04fc-4f9b-92c4-4455c255eb8c}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63337BB296F4141479799EDBF63E89A0\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63337BB296F4141479799EDBF63E89A0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\70BF2CCB0FC824541BC016CBFE40FA2F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_RUNTIME_64.8.8795_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000_Classes\Local Settings	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DF1F64D8EF250D42BCA10C1326BB942\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.8.8795_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\18237B7CA0BADAD40AF9C5034D6097CA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F5968DD9DAA5B3567CFF6E791844C78F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1788	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ransomware-Samples-main.zip:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2952	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4944	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3852	chrome.exe
3852	chrome.exe
3484	chrome.exe
3484	chrome.exe
5816	msiexec.exe
5816	msiexec.exe
5816	msiexec.exe
5816	msiexec.exe
5816	msiexec.exe
5816	msiexec.exe
5816	msiexec.exe
5816	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5592	OpenWith.exe
5748	osk.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe
Token: SeShutdownPrivilege	3852	chrome.exe
Token: SeCreatePagefilePrivilege	3852	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
2976	windowsdesktop-runtime-8.0.2-win-x64.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe
3852	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2660	131.exe
3764	131.exe
4340	131.exe
404	131.exe
4072	@[email protected]
4072	@[email protected]
2164	@[email protected]
2860	@[email protected]
1152	@[email protected]
4516	@[email protected]
336	@[email protected]
4404	@[email protected]
2444	@[email protected]
1516	@[email protected]
3668	@[email protected]
1828	@[email protected]
5260	@[email protected]
5684	@[email protected]
5748	osk.exe
5748	osk.exe
5748	osk.exe
5748	osk.exe
5748	osk.exe
4436	@[email protected]
5748	osk.exe
5748	osk.exe
5420	@[email protected]
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5748	osk.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
4624	OpenWith.exe
5748	osk.exe
3328	@[email protected]
5748	osk.exe
1016	@[email protected]
5748	osk.exe
3708	DllHost.exe
4072	@[email protected]
4072	@[email protected]
4072	@[email protected]
4072	@[email protected]
4072	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 236	3852	chrome.exe	80
PID 3852 wrote to memory of 236	3852	chrome.exe	80
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 1232	3852	chrome.exe	82
PID 3852 wrote to memory of 3780	3852	chrome.exe	83
PID 3852 wrote to memory of 3780	3852	chrome.exe	83
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84
PID 3852 wrote to memory of 4172	3852	chrome.exe	84

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
940	attrib.exe
4124	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\files\dom-0.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb3677ab58,0x7ffb3677ab68,0x7ffb3677ab78
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2144 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4540 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1784 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:8
  2⤵
  PID:104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 --field-trial-handle=1800,i,17852656529092429418,7675578253035656922,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:716

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Mamba\Ransomware.Mamba\131.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:404

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Cerber\Ransomware.Cerber\cerber.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\Cerber\Ransomware.Cerber\cerber.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1084
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2220
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2012
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___8R4QIO_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:2988
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___ATOMBWN_.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "cerber.exe"
    3⤵
    - Kills process with taskkill
    PID:4048
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4944

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:3572
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:940
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5036
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 120121719241807.bat
  2⤵
  PID:1432
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:768
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:4124
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  PID:4448
- - C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2860
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vzjdxkijlvlgfga147" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\tasksche.exe\"" /f
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vzjdxkijlvlgfga147" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1788
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4516
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:336
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1516
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3668
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1828
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5260
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5684
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4436
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5420
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3328
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1016
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  PID:1664

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:4072

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4404

C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
"C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]
1⤵
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4472

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
PID:5712
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004E8
1⤵
PID:5940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetCamSystemGlobal userNotificationListener 0
1⤵
PID:1760

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetCamSystemGlobal broadFileSystemAccess 0
1⤵
PID:6132

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
- Suspicious use of SetWindowsHookEx
PID:3708

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetCamSystemGlobal downloadsFolder 0
1⤵
PID:4300

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:5556

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetCamSystemGlobal documentsLibrary 0
1⤵
PID:1904

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\f92c0754344840618996c75aab2257a1 /t 2172 /p 2988
1⤵
PID:5420

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:5412

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:1788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5552

C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" /uninstall
1⤵
PID:5984
- C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
  "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=592 /uninstall
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2976
- - C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
    "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -q -burn.elevated BurnPipe.{1843560C-DEA5-427B-B789-DC66DD91932D} {99156D74-AA88-4BDE-AA5F-A6EB0EC9638B} 2976
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    PID:1108

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}
1⤵
PID:4720

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8BC7D2357B6F4510FC16D7C65B19C0B7
  2⤵
  - Loads dropped DLL
  PID:5868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 197E607F581B813834A925F41F925511
  2⤵
  - Loads dropped DLL
  PID:1960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 61313677F5A5DC5116BE3CF70A951BDF
  2⤵
  - Loads dropped DLL
  PID:2076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AAB305C70FF215708B49592E43E1E32D
  2⤵
  - Loads dropped DLL
  PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e6253aa.rbs

Filesize
131KB

MD5
df0dc3c6c13dd35b930df313c72e7a58

SHA1
4ea61074cca09c72092951eab5a20b0771ae83fe

SHA256
64b565bb194d180bc43c7fc1d1cc425022a514c8489f781cf1b08d82f7a4309f

SHA512
ec519857f66a4e70b1b64fe345a9cf562869ac436e80877a6e89c203abaff8e641e4650c6eccfaf1359fd4074ec79423983774572506add1eb894a574d37607a

Download Submit
C:\Config.Msi\e6254c7.rbs

Filesize
9KB

MD5
1927881359ede36560f8b40f23007685

SHA1
c386095589c11f6499218763440fe3522a38bfb2

SHA256
ca4d1e20675f6496edf8825a02511b57f358ef7b72e8712f2bf38bb2cc6e451d

SHA512
92402332559ac964181393e9ddb05bbefe145940dbf948f93343ddb2bc518c392af6fe22907cc1e66ffc1987c21e9372caac715c8e1f5a10e9d6f407ae517990

Download Submit
C:\Config.Msi\e6254ca.rbs

Filesize
8KB

MD5
21c5b80d98f90e7aba300ffc04254410

SHA1
8142f5294d8a7c0f20ab84a598daab292335542b

SHA256
dd6de7c1ed09f406127a2fc2dc01a9ca57d83d685e2f7de29ab0fb3fe0a2a55d

SHA512
eb151b42a2afd5a6f2bca306b36bce3f34e63875d71179932d9a02ced5b713b76ac843b7a3279142ccaae3d9f9d28207ca24944b04859331a1acad8a0948abdb

Download Submit
C:\Config.Msi\e6254ce.rbs

Filesize
85KB

MD5
da516d72984367e6afc3a65fe284a2ad

SHA1
17fdfbf22cd86a5df819540d39e2d4bb0d63a4b4

SHA256
2d7826daf1228bf75bb698dd35f343854832d07ffa7d6a1cb944070c6afa0bd3

SHA512
4e44efacbfda5c7599fad577f95e44ea6763a230cce1d036e5941dad720c59fa88fcfdefe5d70c7160bd438caa01c42402b1e60c5c694980d6382eb23ceeb31b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4a2e9d13bca9fb3b157692bf7a70ca6e

SHA1
a05ab54819f94bcef573843555f0a0f4b67ca02c

SHA256
aba8d0a709b722d1c609a0129c6b87c75e1dd2531a9c92d3afcd5623dce6d4e3

SHA512
f0cbb470597202ce6a7cb30e29c19071d16d6b1a2172f786022200477ba66e12a3135b62fac98809c73a449ab5b9d2ef60803bde23e47c6de4e18cbf1f37009a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
dbc3ce4d91a52e345892a97dd224c458

SHA1
78fa7a2db9e73604de89cca3adf309f865d1ff5d

SHA256
f5462afb2ebc99bca6d1bdbc9d2b74e76a2987b506ac7857dbbefa995fd005dc

SHA512
c985f23c0f3ccfb8983d19f682beea7a656d6a57dbb0f5a18b7e6290b68bf7c82f82684d6da80f79d4e4f740a56291b6917de2e0d5d305d3cb1b11cf70a3df74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
cc0d843fd694b70bf485815233c2364e

SHA1
cf695711a243800a31a181373e2a1aee7649c654

SHA256
f24dbe4b6cb3d735fb38662b7714c3ad8f95b59d8d34b492fc10729966db93a6

SHA512
93f36f86159cd382892f3b966734cfe3eb132c0a2f8040bf2d446b1905025cec68caa52040df953deb4941c9d67af453a2e78a0ea9e2c795acd6facc1d67cf03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
45b76b35a759dc9e2e67da333d640140

SHA1
14aa7f09b83c394262f0a86b27256c64dedd1f5b

SHA256
74e88d8b61cc517837f8e171b0c33943d555ecbc3c0c3b0bb9a72a3aec19411d

SHA512
aaf62e56c3a0e7524202de8d4087dfad5a413cabffe372ac0fc09c35d323e8f63b0c63c85eb1a4e53db9c3feedbc233903c1ae17baee9d00925ee31700cf93c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
539017225257210bd6bf91ef3d258429

SHA1
71a5bcc128e3a355f899dff1f85c47c56da3d91a

SHA256
612e1c92fe419194d5ffeda438d1fc9aa6e42f9c5edf6ae207c7e6fb5b8da3fc

SHA512
05f8e476c3311f1efe74a1a96ae6714f0dfa8ba497e46d9d161d907a2d6587f2ba0566c71e93c48218bf696e9887b0495c2ff34095db684c3794936f1e86870e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f93037536dc5e6d8b7790ca89e04cef5

SHA1
9ffab9249aa607c15fe22a518c8986715d2dbdaf

SHA256
b3eec4a93428754ccf2d731f106d39364a23d73008708c71894880507e57573b

SHA512
14dd0b5c93a7e50e4fc70f6597ce026fc1982d3acacb15802201f610f8590c1ebf3f897af7e53f28ee5e821be4fd296ab7075d4a88d876ce7800cc322514bd8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
23b068d242f1c08af6fb80c2593f127f

SHA1
e309cc33402ea8d5d582157d333f14d82e6fa871

SHA256
8b765bf21d1a74cb68af3245f02785a67572ae2f0fd5c8b606843f04c0de2b1e

SHA512
37542adf1a2d6e7f407ad58327f332ac677f96b4fbb8fc3f27c34414fd83e70e073b6317ca323b202fee35e1f8836cf4a8390fff1e929e35b42082d56e0a3273

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
45f38de08cb30ccf551d4540b20e1d12

SHA1
b75f83ad0fe5b4fb6f5ad25d39e07ce16d5c7593

SHA256
3b6fd7490da54c310d9b2982c4b1c44ae3941eaf023ec9317fdf568c6d65d7f7

SHA512
bdba776824ce8588b25ecc894a686ac5d4c5a91ade46e1224c7bb2da00d68e806bc64e5ee213fd6d018270c88c4222ec68b3a6877725f9a5f33e666305f6f1f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b84efcf4c4be35e60772c0a815a654d8

SHA1
ffcc356c1bc6b84315ab55d1c82c147f509155f7

SHA256
c1dcf389ea2374ca092c7e0ad4dd5ac12de14c6f6da491a84d656a37567cbcac

SHA512
d947efba5128383e14fd07a4be393806b54d266bcaa0be7e69b55b9a1a01673bef510fc17a2e53daa31d0c5cb976d3c510afa92e20d7b0124c0826ceb21291b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
563c20e24cf4e00880dc99eef6cfdd1f

SHA1
178b0b2fb205b74bd277369acc5df2ac6a897983

SHA256
d6f8845b50a371daa25b56ff38f74175961647be13a5a723c1d0d965ba980e71

SHA512
33c5739cea24e4b4d5370fb1f89b1d625deafbc30892a08a9cf617cba53b708888195514e6284cfa32d1436c1349161933d6f852f2c5969614dc57f8ccbba847

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
079c90b6e21fbd9cf794a4db1870261c

SHA1
8a157da9396e76ccffc3cd54dd156587af4b8be1

SHA256
7a40ffd5ba0c5bba48e2c7bec5a321c3bc120b3be88e00819dc8707e115f7ffa

SHA512
d29444afad162b5ed026cc1dc5e36bb2794ff830393738d252384b31f102ca977637649563779532c893c7641b03431bb608b8a45e108a7965cbf791de75f245

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
2762a2ed0165525a5a5a70400737ce84

SHA1
a2dc998869b10944b9a2100bd563e8a8b96b1818

SHA256
47424e4a2c239995ba41991c8fc8500abff900f5566737d2a837a63cd9ae18d2

SHA512
41c4aacdb6c5aea962529995199be59ead545a8b92945d9e1d080b97c2bcf3925c47a44fe6c9d35043831b05e6f7d97e5bab8aa51274cd640840a1eb96aa1dd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
94KB

MD5
101976cbd29a0d810827b618c40d04e1

SHA1
249432b266d434c1cca5a0287cb54fe131edcf8c

SHA256
25668a83972114b1ee9aac1c1146e39871736be9114696b6550c8057c5dc48d4

SHA512
aced595841006e4a79ee333b2ae42df337e19d0006e123fdca10272822fa488002901462480f5f0512f43ad61317cea6080a644ff4426e74575d2d24d384bca8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe584aef.TMP

Filesize
83KB

MD5
104bfac2dc6074e9319e346cb5b7d7e1

SHA1
7bb85d585295afa40922ad8e5e19b3620abee3f8

SHA256
be8661ec31f93f6584e7dbd3276ebeb8ea919e24bd0cdb6295a4e8a5fdfb75f8

SHA512
111f83168b6bdbc2e51c25ba9f8385728cb04a60a49627edd24e7ce3a7f2b74427de2d75ee95445dcc295e0e4a4a9818c5b8b046db94a0984143d31b31f7ac5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___2HSZG2_.hta

Filesize
75KB

MD5
29f2fb63160277de1f11cfd4f408fb60

SHA1
e477f336fa04c22a231bf35f6a20e556aabaf553

SHA256
3eadf8dc047d98056dda2c5d9de28d449835d252cf2eea1a92482c679b85a405

SHA512
758c651f7e670d47d23c9e562424db5898c5d10040ffa909f022d7092b8c37cd3443dc01c4d57d62cba1a5b465bd66e3611346d650e5d96bd0c294058343f827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___97XI3M_.txt

Filesize
1KB

MD5
941bc474d068cd2898097bc2d526ab17

SHA1
f02266ca696e4c55f316b6e531d450d743279c44

SHA256
c685e05dd0ac91601ff29b0ad4fec9b2287a2037d9209bceba7ef5001567fad3

SHA512
aa5b6f85e5c1833f353c222ab2beee7f4c0cea628db8a45023ed9f88bd6e431c32aaf2892a9db2d4550a24f59a0b1c6e7f5560044bd64a9293ceb713768cc30a

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\_R_E_A_D___T_H_I_S___IFWF8VLZ_.txt

Filesize
1KB

MD5
aa3f15c244ba32e35b7b606c525c603a

SHA1
dc8c47298c6ab13ad89a08db6a63e983b9fe25ac

SHA256
6c489ed496acccd4c68bc39c95e805dc63ccfd8cd0cf1e6fa644edf76a50037b

SHA512
523f5f79b555af1cb66ea8763d9e403331b3093061ac152c65aefbfa200635647df3cea9797195e1a8358bad6b2450c4f320fb3dfb0d004a49ff4a59a20e2ac5

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\_R_E_A_D___T_H_I_S___IDPC34X1_.txt

Filesize
1KB

MD5
fe73b1c8a974ccc54a2d60885a689384

SHA1
b4481027350d9b37b50d23f94f697d5f63982983

SHA256
a5abaf9fd2b83301db096e34c954aec3ab5490941de0bfeb5a331723c49a2003

SHA512
9b8990f878fe7d327557bb9bdab105101326ca01581159c9acb893b6cae4266c5c22b624aef69a29b8d1eac14076afddf347f744066f9d04f34c35d894db00ce

Download Submit
C:\Users\Admin\Documents\_R_E_A_D___T_H_I_S___8GXE_.txt

Filesize
1KB

MD5
cb088a915979dc5f1cde633733934667

SHA1
fced04aad6dbac0a96c541fb48cd9830b4e24868

SHA256
73115d86efda887f123f32c92fe09958484638fe79ac2d7290d8643ab3685dc0

SHA512
e73bf09ad0521561871075caa91db7e405917ba532fdab2dd8eab1765a5d262958c06714bbe3745ee3305719e54abfb5cd77eedf8c1679396bad93a1ede6fbb2

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main.zip.crdownload

Filesize
15.1MB

MD5
e88a0140466c45348c7b482bb3e103df

SHA1
c59741da45f77ed2350c72055c7b3d96afd4bfc1

SHA256
bab1853454ca6fdd3acd471254101db1b805b601e309a49ec7b4b1fbcfc47ad7

SHA512
2dc9682f4fb6ea520acc505bdbe7671ab7251bf9abd25a5275f0c543a6157d7fa5325b9dce6245e035641ab831d646f0e14f6649f9464f5e97431ab1bf7da431

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\120121719241807.bat

Filesize
476B

MD5
b56088614bdb5dd77d2b685383c3ab6b

SHA1
4d9c8e9b54469f4b6f3afb3d4ea1811f2b6eef9a

SHA256
10c9c568cb9a20be5d15d1203b12ed7cf85678f22fcf74d98221141846d2c7e3

SHA512
fb514384fd423551cd9d50081df710e41ed58373315b1ff40bee6fbddfca986945f0c90a8369bd49d7af1e6273fbd3b4e88dae4c523e621d1a8f7bff505164f3

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\@[email protected]

Filesize
1KB

MD5
c7f659e154a428bfeca636d3c900e25b

SHA1
5c4d04ae655f6fc9b61c74fd1d7d3a0a5630fc6e

SHA256
f704bad7b42ea3087060686dede20ad8d7694e90ce8191baa95476f8e2a3abba

SHA512
a566db42130bebc30c734e2e66844041936663987c944e343bc0e8e77af9e79b2e0c5c54b3553183fd5c86e2f99bd50d52a7d0fd8129c099a6a83e8623fafe86

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\c.wnry

Filesize
780B

MD5
383a85eab6ecda319bfddd82416fc6c2

SHA1
2a9324e1d02c3e41582bf5370043d8afeb02ba6f

SHA256
079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

SHA512
c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\m.vbs

Filesize
355B

MD5
a88a125581a81575619ea1f2c6c8457a

SHA1
11870eb53d107ac739ad66e7e84bc7805508b746

SHA256
8533ebdf1658de1c0fca691645547b7b9ba8d12135aec5bf07b1e61045b3ff4d

SHA512
4937d3c4cd9bccafee728ef5e08e05193191cd9fe6c6044132880fb156a9c97f7715d7169cf1c4d653c71d2a8bb766c5720bf06b59fc3372b7b355810f965ca9

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\Ransomware-Samples-main\Ransomware-Samples-main\WannaCry\Ransomware.WannaCry\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Windows\Installer\MSI600F.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{B3E62E1A-4891-4F2B-BFBF-066EADFE23AB}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
memory/1084-727-0x0000000000440000-0x0000000000451000-memory.dmp

Filesize
68KB

Download
memory/1084-726-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1084-698-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1084-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1084-306-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1108-2446-0x0000000000A30000-0x0000000000AA6000-memory.dmp

Filesize
472KB

Download
memory/2976-2445-0x0000000000A30000-0x0000000000AA6000-memory.dmp

Filesize
472KB

Download
memory/3572-777-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5984-2444-0x0000000000A30000-0x0000000000AA6000-memory.dmp

Filesize
472KB

Download