Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/E...

windows11-21h2-x64

10

Analysis

  • max time kernel
    2692s
  • max time network
    2595s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25-09-2024 15:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Endermanch/MalwareDatabase

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 12 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 8 IoCs
    evasion

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa49bccc40,0x7ffa49bccc4c,0x7ffa49bccc58
      2⤵
        PID:1460
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1748 /prefetch:2
        2⤵
          PID:2244
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2064,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2088 /prefetch:3
          2⤵
            PID:1444
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2152,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2376 /prefetch:8
            2⤵
              PID:1724
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3104 /prefetch:1
              2⤵
                PID:4592
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3132 /prefetch:1
                2⤵
                  PID:1136
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4420,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4572 /prefetch:8
                  2⤵
                    PID:3516
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4988,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5044 /prefetch:8
                    2⤵
                    • NTFS ADS
                    PID:3468
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1040,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5000 /prefetch:8
                    2⤵
                    • NTFS ADS
                    PID:3064
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5256,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5512 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4052
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5948,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5928 /prefetch:1
                    2⤵
                      PID:3384
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5708,i,7981640641113171463,3748436607602287307,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5912 /prefetch:8
                      2⤵
                      • NTFS ADS
                      PID:2572
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:424
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:1284
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:4896
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\Fake Infection\fade.gif
                          1⤵
                          • Modifies Internet Explorer settings
                          PID:4332
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Fake Infection\index.html
                          1⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of SendNotifyMessage
                          PID:3380
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa32a23cb8,0x7ffa32a23cc8,0x7ffa32a23cd8
                            2⤵
                              PID:3228
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
                              2⤵
                                PID:3732
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3708
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
                                2⤵
                                  PID:4792
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
                                  2⤵
                                    PID:904
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
                                    2⤵
                                      PID:2060
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3304
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3536
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
                                      2⤵
                                        PID:4572
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
                                        2⤵
                                          PID:4256
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
                                          2⤵
                                            PID:1616
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                                            2⤵
                                              PID:3316
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,4943921908777362806,8606496407556449359,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3592 /prefetch:2
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4092
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:464
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:1784
                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
                                                "C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
                                                1⤵
                                                • Drops startup file
                                                • Sets desktop wallpaper using registry
                                                PID:3116
                                                • C:\Windows\SysWOW64\attrib.exe
                                                  attrib +h .
                                                  2⤵
                                                  • Views/modifies file attributes
                                                  PID:1892
                                                • C:\Windows\SysWOW64\icacls.exe
                                                  icacls . /grant Everyone:F /T /C /Q
                                                  2⤵
                                                  • Modifies file permissions
                                                  PID:2488
                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                  taskdl.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:1240
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c 86231727280266.bat
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4504
                                                  • C:\Windows\SysWOW64\cscript.exe
                                                    cscript.exe //nologo m.vbs
                                                    3⤵
                                                      PID:1028
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +h +s F:\$RECYCLE
                                                    2⤵
                                                    • Views/modifies file attributes
                                                    PID:2016
                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                    @[email protected] co
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3688
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
                                                      TaskData\Tor\taskhsvc.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3048
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c start /b @[email protected] vs
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1172
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                      @[email protected] vs
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:824
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                        4⤵
                                                          PID:1992
                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                            wmic shadowcopy delete
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1684
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                      taskdl.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1072
                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:2620
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xlpabxbmfhyivu622" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
                                                      2⤵
                                                        PID:2016
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "xlpabxbmfhyivu622" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
                                                          3⤵
                                                          • Adds Run key to start application
                                                          • Modifies registry key
                                                          PID:4012
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2984
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1000
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1548
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4292
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        @[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1016
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2976
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4024
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1140
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1576
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4412
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:488
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2488
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4680
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:776
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2100
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:5052
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3408
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3216
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1536
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1784
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2348
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2304
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4664
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3984
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1952
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1556
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4484
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4976
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1340
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:904
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3060
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2840
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        @[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1248
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4204
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:3880
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        @[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3516
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4572
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3544
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2752
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3840
                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                        taskdl.exe
                                                        2⤵
                                                          PID:2620
                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                          2⤵
                                                            PID:1140
                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                            taskdl.exe
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1316
                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                            2⤵
                                                              PID:2416
                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                              taskdl.exe
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1284
                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                              2⤵
                                                                PID:908
                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                  PID:3896
                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                  2⤵
                                                                    PID:676
                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                    taskdl.exe
                                                                    2⤵
                                                                      PID:1656
                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:700
                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                      @[email protected]
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3384
                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                      taskdl.exe
                                                                      2⤵
                                                                        PID:4916
                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1420
                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                        taskdl.exe
                                                                        2⤵
                                                                          PID:4700
                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                          2⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4164
                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                          taskdl.exe
                                                                          2⤵
                                                                            PID:4684
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1360
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                            @[email protected]
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4408
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                            taskdl.exe
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1996
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3408
                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                            taskdl.exe
                                                                            2⤵
                                                                              PID:420
                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                              2⤵
                                                                                PID:2180
                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                taskdl.exe
                                                                                2⤵
                                                                                  PID:4800
                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                  2⤵
                                                                                    PID:1900
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                    taskdl.exe
                                                                                    2⤵
                                                                                      PID:4088
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                      2⤵
                                                                                        PID:2768
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                        taskdl.exe
                                                                                        2⤵
                                                                                          PID:4156
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                          2⤵
                                                                                            PID:1844
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                            taskdl.exe
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:872
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                            2⤵
                                                                                              PID:2816
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                              taskdl.exe
                                                                                              2⤵
                                                                                                PID:656
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                2⤵
                                                                                                  PID:3740
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                  taskdl.exe
                                                                                                  2⤵
                                                                                                    PID:4816
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                    2⤵
                                                                                                      PID:4592
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                      taskdl.exe
                                                                                                      2⤵
                                                                                                        PID:2812
                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                        attrib +h +s F:\$RECYCLE
                                                                                                        2⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:3216
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                        2⤵
                                                                                                          PID:3524
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                          taskdl.exe
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2348
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                          2⤵
                                                                                                            PID:1788
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                            taskdl.exe
                                                                                                            2⤵
                                                                                                              PID:2232
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                              2⤵
                                                                                                                PID:1140
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                @[email protected]
                                                                                                                2⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2640
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                taskdl.exe
                                                                                                                2⤵
                                                                                                                  PID:3108
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                  2⤵
                                                                                                                    PID:3684
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                    taskdl.exe
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1936
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                    2⤵
                                                                                                                      PID:3372
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                      taskdl.exe
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:1132
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                      2⤵
                                                                                                                        PID:1972
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                        @[email protected]
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:1472
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                        taskdl.exe
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:276
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2472
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                        @[email protected]
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:4728
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                        taskdl.exe
                                                                                                                        2⤵
                                                                                                                          PID:1012
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                          2⤵
                                                                                                                            PID:3852
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                            taskdl.exe
                                                                                                                            2⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2580
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                            2⤵
                                                                                                                              PID:1536
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                              @[email protected]
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:3024
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                              taskdl.exe
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5052
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                              2⤵
                                                                                                                                PID:1140
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                taskdl.exe
                                                                                                                                2⤵
                                                                                                                                  PID:1404
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                  2⤵
                                                                                                                                    PID:2748
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                    taskdl.exe
                                                                                                                                    2⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1668
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                    2⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1376
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                    taskdl.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:3976
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                      2⤵
                                                                                                                                        PID:1476
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                        @[email protected]
                                                                                                                                        2⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:1892
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                        taskdl.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:276
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                          2⤵
                                                                                                                                            PID:660
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                            @[email protected]
                                                                                                                                            2⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:244
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                            taskdl.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:1012
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                              2⤵
                                                                                                                                                PID:4484
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                taskdl.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:4224
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2100
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                    taskdl.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3212
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4856
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                        taskdl.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2444
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1908
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                          taskdl.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3172
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2304
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                            taskdl.exe
                                                                                                                                                            2⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4936
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                            2⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5020
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                            taskdl.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4748
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                              2⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1972
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                              taskdl.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4332
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3424
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                  taskdl.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2536
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4484
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                    taskdl.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3548
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:580
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                        taskdl.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2436
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1516
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                          taskdl.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2212
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                            taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4068
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                              taskdl.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1212
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4804
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                              taskdl.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2304
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                2⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:960
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                taskdl.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:464
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4620
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                    taskdl.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4712
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4144
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4732
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3624
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                            taskdl.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:652
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4428
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                taskdl.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:344
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                    taskdl.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1444
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                            taskdl.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3032
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill.exe /f /im Microsoft.Exchange.*
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:1868
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill.exe /f /im MSExchange*
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:792
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill.exe /f /im sqlserver.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:616
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill.exe /f /im sqlwriter.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:1284
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill.exe /f /im mysqld.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                              attrib +h +s F:\$RECYCLE
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                              PID:4656
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2512
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                taskdl.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4072
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                  taskdl.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2280
                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                  attrib +h +s F:\$RECYCLE
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                    taskdl.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                      taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                          attrib +h +s F:\$RECYCLE
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                          PID:4272
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                          taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1476
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                            taskdl.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                              taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2664
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                              taskdl.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                attrib +h +s F:\$RECYCLE
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                PID:2240
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                                taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1148
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                                  taskdl.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                                    taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                                      taskdl.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                        attrib +h +s F:\$RECYCLE
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                                          taskdl.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:2244
                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                            "C:\Users\Admin\Desktop\@[email protected]"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Sets desktop wallpaper using registry
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                                                                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:2400

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1047

                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1222

                                                                                                                                                                                                                                          Windows File and Directory Permissions Modification

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1222.001

                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                          Hidden Files and Directories

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1564.001

                                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1070.004

                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1217

                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                          Defacement

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1491

                                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b5ad5caaaee00cb8cf445427975ae66c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1008B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d222b77a61527f2c177b0869e7babc24

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            649B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            098905d613db23bc4a6a82a418bda88c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            534dba6abdca898a06a9e81d762b9e7b11e00241

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            15b55826348c244df362db0b8916514ebc5c82b1be618b211b26ead0659e991d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bbf007a9dbc1a16b1e4b52eb275cc7978dccc6dc6a4f11141bc1a75fe42ffff7a4cd461cda02c85a891a98ba18773c6d8ae97b9b3316a465a7d1acdeeef7dcbe

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            31e62a59350c91a9d0296b4ce202dc0c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            bd0b0e5f59f34ab572a90b171bfae0a03d7052fd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5c3ca00ecd7e2f4cddc217bf254097243aca3cb0a273c3f36a42f542e236333f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            62c9678c3227a31b8c5724d40bcee009cabec46b16fadae4fcd69c0f3bd799e9398a92d6b8864826667ce95e06f7deb872a22301e259e6812c68eb14f968b68f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7efda03a3146394aeab25222c26a044c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d98f373a5c29771142b02c5e408e563502e0edb5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7c5b0724bff7c1f7fe90cbc4a73a62264ab9d9ddf54300e4a996307f75f88c6f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bc11d3e527c60b107f3132872ccecd71198679f03bc83b2270915488591e122f99b0683e15440d751da0dd8b72fb54662911294f432a9059572fc836d97807d8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            a5b9f4788381712e2d7f7547e1dbcf54

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4809b17cadd2c961e689f7f11d40b338d3ed2a1e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b5f905991db4822388a420cffa3b4fd165c9757af84ca645ffb0b65fa63b48f0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a238d8716fdf912659ad893b3de47425ed522eb38da1ec2f903dd8e36a35518f1eedd563022383dff9defe057cf95f8f18984fba5a81ed2e9cde19b779be99dc

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1a61fc957e6d8c739d487c89b9cd03ca

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fa0652c83f3a1b9dda85be537db2bc3cd359bcb4

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a973cc68e76f7c9c67cf95878421766f3cbc6838e776aeb6a9a1b10b927d6777

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7396300188be1d00b8d000916e9994788160c7f9c7a53a8602146d26a500c5b7602cc00efc108b3f2b6c565dfbb6b050ceb45e80ea4207cc20acbf7dd1dc8995

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c7a75b93032fb5c11eae5da131b96da0

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            94c3537dc990c729ca5692f96f6b3b32018e9f5d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            47ce7a9c921c76f3c9b402833d4cac22cd363c8635b68f09401be3582415de14

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1c55aca88caf89b0033c94424ef420f5101472ecb9a7d6899adeeea34f2c0d7ba25864f5acb25f11dfa06bc9be2bce190b60f3075f81562147811b5682891e90

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\594c8750-9c33-4020-9b63-ca09624b8c08.tmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            beb98c42e35e5e88994a3e80de418f3c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b59ba5696924777e83f9504145ef24f6eff1d796

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0d981ccef9414832e2d1ce1edb02d641d236e8bdb8331b4300c846c60144d041

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            29078212e600c0f2be680e836c7098d24019b21388d073c12eabb4265be21f03d9e3017e98b2fcdf604f2123030d052faab7662f73c71c1d648245c97e6ee294

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e1c37fe7cf91f7111f586ed47dec5721

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3e73b6732baa823dabddf2888b3abb03f1d8115a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f50d72080ccf4350da3a908a9c5f145ae51e7eeea350ed74ff726e68f77749c1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bb1acabd14ec91cb5cc31ce25107d6c1b405cdda759286a29dca041aee2560f5c0bbd80ddb2340eca8faed8743294245f2d15afdf237000fda90759853f51c55

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            bd0c8954398e2b1a5378347511e860dd

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fef83f6225597e8cc1a9ae8abd90ed4528ceff31

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a488be140c213b95a047d20866a20b476c03e302469178a3fc669ea37521fc52

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7195a50779691eaeca31d046155c7a933b76a32a0957b8c5fb7ebd7712ad764d8cd5c27ffdbd423920b4365f02cd5c770a46279d14c8da849285c185ea3c50b8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            81ee5429bf273bdb6488b2185d4e0a7a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2fb481b9e74646f23ef525d361486645842b658f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ecb14c72dbf4573aaf9ea59caeead18a9b0c8f155e231c8dc876513abab64ed2

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            60e15e74c581ed3fe040399e9f89f523a1ff9afab3d6a9aca276907f598006714c41d1fb22053d17a6f77fb9c0194afcb7250592e0342ce8215dc8e975b14f1d

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f7addf0747aa394705a70a552cda609b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3ff29cfea2a63fa8bfa13db879f88e62ba1a3ec3

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            fcd6292549b9c1edbb884a5690b501989dc7e61e903ab1b345560a85135d0153

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5d374b6217c564084a6aa5f4eab8e2309a2b4bf0e1aad4128be55dc4eabbe5ad5b5e367f6ae2329397ffc157c88742009a7ebbcd6640b24a28e32de98e5b99b1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d0d29e54d21d5eed4b76009e3c0c9fd2

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4715fb9c12f7f478d8e7a64f7b00994ad24c4f31

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c8595131d91f9c700294ab8a6975ef9e42d39a006b4ee97b344e51fc909afebe

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            051c301139caaff98b76f89efb460d99a7ecff17d148b4fb23469e0fc1bd6e45b08b7dc65ecab570733dabf65aa3b4ad40f7619f35eea0f7ad233ea73967da7a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            62366adefa272b062c5d72440c9a53aa

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7e6b27b577568de4ea3ddd6872248b4581352a8c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d7e6b00dfd913894cd4707ed0fb35b8eff09d46e12a5402fbde804bc962d7ac2

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bec2868807876131fe522e18db149a0abc4fd713d95d8cb9b608ef984987b2ec8acb00cc4abf9a40b8ae356709f3ea4c9bfb5284d475c7e4959eac191383d159

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1c2c1c4929825174af33f32d1402d472

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e51f36afdc284b0b56f46f5441f8a92b1e991168

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bf4c3a12b332ef2be0c73fff82b35b5e123e8d819c3d27b3c40051f5985901fc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            387178fa14f985c3b3526bef15f910db0d64a63f7a7873b2b142ead67ab7f90cae8252cf6c1aad9588b73529c64aa7e114733c07a1494f83e674d55daa8408e5

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d95f65d668d35e78f97cdb79e90077f4

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7bea3e3c5fe78a8574ef82c67c286432d997c915

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a3e6d1faa5ed7ae5c263cfe8e58bd2b5a59ea68c7f9787c5edb6fddf3cbbc445

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f54669518d0ed39bf81bcac91b008aa5cc5233a62e8c7672ac37a66230508618204dcd80110965c5a14dd60883b6e7eb41425f82a0bf3cd19b85e0e7b479e694

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e4876ca42d3daecc9b76ae159e147d01

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            13f9a2213f5ea468fe94aed405a7b14cdbf7e66d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ebf97f5c2a63c8592ed47da3feb38b4a82f1171fa4c8c82e124aebfe28a6ff08

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3aeb9e88db0b1362a3897ddc5f4b1e3474b7b4ebe8aca496961aac394573f9fecbe63645967b9fdd308a69fd66922c073226f605037bc3e026452466de26e75b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            66dee936e5639fbaf663e9ee312f0d15

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            1557e0d4b60024ec340ae402780a7e9841f65dad

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4fe86a2f0daac6033fcfb5b9d679d79c2433839cad8f67ff17a948d5431171e6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7197f4295cfe7b9e02a8f95365852811671e7cf2bac197039453860ce2ad76979aab5aa4b6044b5d85c488f847e75270224584736b3c2b219fbc0057a961c208

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f93f1100b56e3f7a2e2e0c6c4bb9c636

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a7380950f9dab548b89cce273b7f1b0889b1c463

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9db9a77cefa99c3b8e70c427be6d9021a43fc7513fddc539fb13275562bf18eb

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a8d4652c2686b68584b1fea0d34b6c0a24682e079987bf25b9866373a7dc2340619805c788bec09a699b5aadaf0ed5769c6da75946e2c7e1688370e3ee1b172a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            aad812e6a0e1812628184769c10722a5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            c41c635ce9c75f2a9e1c172b2632127942822c53

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a84cc95d22ffb70af19b5a631186ada2a33e18a85d1cbdd396c814bd7fc97397

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            798596a672afa7a135cb3c6628aa187cfdd9d6d71ccfb58387634c53ad67c731f4aaf416f0d7ed16d2101a4d213cbc2917c741316313adfe5a55cdf28d7cd14f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            790519a0d2429adb4833ad5c73550faa

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8777056b07c898363875e38155e6a3f06619de19

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b1fbf32bbc0d38b00cca4c9f32af47700da270cfb632ce9b348d1c037438f31d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0fded6ef528f46525f4b4e696bd4dc7ba88d990dabf35ecd775443e0434ed3c7dfd8036407ec3554801b211f7c688e69ee501dd9092f69483418e19455208d6d

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6fbda62af2e3c2c33f773dd4157ad202

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            67b2460a5b0b0f5df0fa84a1b8384832b31d5fb5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2b22f9a28612995775286bb8b8fc9cb33dcd7304c5def9a44021d1650e3d6e56

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bdb72b938d464be076f4d02fc29b332942b6ac05462652a418e2eda14fbe052ea8692d9fa23f96b21c98e3c8de0a0ccd290ef85df27497561959336d98759598

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            19317d61df53233a9ccdbf17dab6cbd9

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            38129bd6427e7ed74dbd0848e101d6d8c923e7ea

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            118c42c230bbb04e2e1bcaad3592196baf76635ffaf2f31529c82ea0d7f561b6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            57b5d14eb28cf1baafe1865c28c5747dd8931a6e937048ac43dcfd44aadfe6693b1cd1ef8c694d1f11f14a9408b43a2b467a8c56a832837c5046f41dcfcb7717

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6d648dee597718b2a9c4ee0d2c522a0e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            752cadcce47ba7987e06e43301c830a8913d7a48

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b19078a7881f0029fa600d1d3e2c9e025b660fd2d371e2e6311ac6d25dff3092

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ff6f92a73a8825716b45a0881ce85f4f067e535252e9156453f320938dc7f23f5ecd0367c42001ec974382b27457b52febbfbc49cc7197ae4db638e688e95d5f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d5d4945350fe25dde0b39d0867317dc1

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5a589ad0f48af3f03a05439a1d32ca0809990d4f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            42e5331c467dd878447f7a075a960468a21ab7cb4fecee394cf61c2799929052

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7fb08eb49500bb5d80179d601a069792724534ed3a4ff0672b7add64d8935a75b18300eea386f4cee3e2b10d80c8f15779ec09a1fbbc017d9da9e1101869da5f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f5af99bc1bfd004ded9a66032a74704d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            edef38483ae90228afcbd05a907c85bb6d7ed5aa

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            91a525dccdab67d715e6f7e81df6c009773837aa9f5037a9e5bd983ef0b9a971

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c8e2634c05fabe49cec3f090c2938ce270c3f6e71e46552c4859718ad40d953491963f33009b75b752a93727d6e546a4e42ca9954bae8293b22f64e648fb7566

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b3565f0a6633f0cf6389617e4103ac08

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4a711fd44b634a73af9a5a3c27fd70f804ae3b16

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a68fbab1eb824223192ab240fbfef33473e97afcc570d00fad66ed05a8c2b641

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2d50218ba6e025d07487233e20f3ea6ccb3789c598d37e0019289cfd1606d50f9f0c3f637c03575566eee777953c93feab90c55fcd65f300a744e0bc45529c45

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7561a74dfbfc2b40e26046ac53022712

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3422a19bb30a9c0e531a0c40c6794298c6ac9dd8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            15047fe2307b237fa5e08fc5c3e89f9f7947ae9088f7379cadbfa5980d71868c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            591d08e2589240ddac22158bc36320a8f170438aedfd6d93e1461d3ba941d75b389bd97f29d8e7ad6cc212b6905788ce2edb23bae8bab9a8ff5eaf4a2acd3e91

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            df902ded99f682a9fc2d6a7c1bd67670

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d656e8b69d5ed0e8863c3822b01bba924ae43cd6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e32cd0acc257fd4aeef477f0831bf495067804698059fc5b2218ce9c1910b270

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1b48a4860e9367c0ee35c0fdc3ab1d92ff935f65b1418d4e32edf96d2af8b8d401cd0cd1043c9a677467e13549f0fea692728726d93bcdd74a35dd2ba3989973

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d526ff6349b2fc7ecfb89dbf11d958da

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            be97c049b8f6e83802ac981a187a79915b4f500d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ddde1aff6591f665250fc751cfac0dc3a79c0ef45aab84bb2f64b562b6e1d9f1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4db263dd83eef04e9e9eaf3f4b122eeff737b22fe18e35e521b6aaa9605476ad17efd9f82349a553f5d2a4eedd43e93c53928723c3dfc60c077d019cbcff5bbd

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6a433d5d5aef63801f4f1eee8865c8df

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            ee06a345385c86969dcf8b73491f9b106f06613a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6a1db966571a58bcc4991e63b79d53e7c2f71510ca1e85973b431836cec1384b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            79323793e069c86539e74f98df488b5573fe21c595d01f55cb384bd174eed24a796022ebe13c202a3de05fbe99655ca7edc02d82adc498b7d3233b9834e1abf8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c75fcfb8df27ac0f5e916bdf1cd10404

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            641977c784cda5c1a39926c51c8f7f2074a07774

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c9b3e59ec3dcb4f05515f196d04a95df9682b280e5bc0bd726cb1bbea3ccd9ec

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            07934e7930e2d85da88925722652e54f207147b3d5f76f3dc4325e30c81a389dfb7f752aca6cb1c444bae26a92030428960bf5515ca4f73ecb9d6e5ea3c945ad

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            36f1d2c048a5d08b135e47a515f74db7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            83aa675ce948b271c61cecd4bb4b0a4467e7e1b1

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            50703764294f02e62a917fa3e14e6ef149bda959b460d63ba6d713cf0cfe373d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            aa275eebf461b4626f586883ccd1af93c6724def64033d8e0ae980547c91e438e3551a202204de5a82d05755f0853e566c1cdd9b548e637d48668c6b5ab36c09

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            04b78913c6d449b010ee7155e89bdc83

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b0e66b0f984424f681270e9cd18ac12956ac89fc

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            12f002556104278b754af096a96cce178de18162fc7d066cb71cae34aab663b0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            052177f9d3c32eec8ffa01b4c6dfa0988e37b240d16ee1c8ec58c54abb00a513b90ace84b89f8df1a371e4b32fc7f1ca96b010edf293994b3def94b9d239086b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ce5a1e56d4547c2abd95432abbd9aa18

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7f1f9f61a1f27ee53eb56e44309b59a561614d95

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0404597d09ffadd6ccc30f8f7a00c9f1415470985092c789c616d20f91304eef

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            419fa285f16263a82d50f2edd61425ad537a56833f6aed15a8358cbc09ca81fab23d8b88f402fc78596a76f078e33a5a1454415c05850b55c049735d7f09ee36

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0312550318cef1c8597a4c035945310f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3e4ba59e3f4a10e10c0709d64292175e87c115cf

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            24fd0c6c4fbb88c31bec7649415b3ba9738870e2bba3993790cd07d5acabbd75

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2a2a682a952bde06059eb939bd3a9782dbb44dc6b4240b183f786ef5cb2c87b49eb2dc6393a51aafdf8c6a8f66b1013cd4c9cfffb4d3958d08ef435783ac46c8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            434ef1a8c6e579d8af6c9ca1106c8ff0

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            59e272aeba4f92451473bbae857f12a5b10666f4

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f884fb2d76766eb1cf09000f81c64767901ae8e8dc31745fbd17133e20112617

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8fbcede942090ea038ab837e21c718b4bedb42a5851378c4dcf26e788b20eb4a5ac5803a514955b22c3755bde350d31e8ed86ecf735b6f848f9528af8137d695

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c2992599e8349f135a26e230da7f3211

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e21aa7542f86b9e412b666a71779e82261ec71f3

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5c9eb6bf9ba120bb208582bdc28c0ec94f27f54d5addc0dc4932e434409b070a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            46da41a638b49f9bea4dff0bdd5716135208aabbe4f646d0977861d851f9ef01617713f931213af63320e2c25a254b5f99bcb33194a3669dde225ae0ecb59bda

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            31539f586ddd66dcf0b8aff64f31c43e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            bbb5fa11d9835bfb9f40553c5f1c8eb372fe1363

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            505850770107212c3efd254c0c6052a04ba7cf9f179795c81619a5c8cbd2ec80

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            91bc12c8d1b2d154e14589b692b0d8017ad87f64bd0650f23cd4ab3206872e344e9cc830fcd7db8ce599ba0dee54ebc7a78a81014e6ac532fbe6faf8302a30bd

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f6310448602ac5bc162c1a9a94a3e8be

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            80277d5d01da7d9cdbaaea30fc9a169b1a40be98

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            abf6a13e799ae60b7500ea5ae866fc87770be439718e9aa49e530a8dfcf87bf0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            27a2089490e69798a3d57caacf55dec155e6aa63db9cab3f097b8612f5041d289a63eb8aac2e694eaa59fd4ecc9ba4a40b1cc9433d5ac93cec68f2984008f511

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5d8e92c257d641a9023bb8c4323cbd31

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            eab506b8f6f303562b29b87b13b8029f4ba1dc84

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3ff0afa95e1fdb62f9f5b9b36e25e24dea56493a9e8e7b81fc9d438223bf0922

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            526c9e6a99d4843e97bc6010de747f1df3e5e0d13c4410dd2c8eb5db36592e7e6f3d460b2b3d42d2b4a98dd1c6dbbee4014c2e9e7373f6be3bc518e61c74a19c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            96fd8bc6f45ee11dd89c534ea4b8a710

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3b399644132570bec3d9b7905aafa93e6871b744

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9d9dcdc81f7f3add457b2d6ba8bda8380651367429cb43635936dc7ce7831c75

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            995dc5d5b00c0be1122ceefb4ce2bce6a5b9d2ef4b211e89f30afff4445eb17240be1485a179a0a23119457581bdbe73221a39b9b0d38c11c7aa4108e3e26723

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            99KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9c6c4f828bda66ade33baca145636a32

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            c93c021df53772a0e4b9e5b9009c9573d83134a9

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0277d6ef8442f6a8a1ad672dd58e028e325805fc70943e966ff8a37d57d935d9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0282b936fbe79ce41b4ef59a3e5893fe8fbc614d66acff4969c2067228286032de7ce114039f5c051594f8b0978c3c5afde47892b41c42e6dfc5128d1ddc6927

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            264KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            483dcfb0e5893777b6d944eebc356e7c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a14a00fc20ed8252b2c718a5f7df1ea4e16c7311

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3ca0ef8ba5aba6b96e9a8ed2cdf8c455b9e79ba17daad7269bf70c670d313054

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b5c4bb77da8664d83cc80c31fd796f7e34614c211bbc8613fc7c1cf649eb01fd753ebbc014fb1d6b9f4587e5230e5fbeeb09bff9eeaa3c34143f9108dd8af69d

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            152B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5578283903c07cc737a43625e2cbb093

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f438ad2bef7125e928fcde43082a20457f5df159

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            152B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0487ced0fdfd8d7a8e717211fcd7d709

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            598605311b8ef24b0a2ba2ccfedeecabe7fec901

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            854cfa35c925672a43f8680d6a7ac021

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            66edaab3140966e80e2f8e599d357aeeb7239689

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            815adb43704a5d226c43b13fbac1b9beaeced9322f276532562c9f1abbcab3f8

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            869406b5cf148491bb664e0cb56a12776de4f3ed19374bb8bc501468073065b484f52f9b8cb3390dc36ba572ea9aa7f609c9d40b8b4c4d1b58ffc13d87920e9a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9c1c4d6ce98d8a67a92814afeb6d3afb

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d08c78b7b60f257428f016334dc47807c6890382

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            169278d762d79d933f85decb1d81ef7a6e55aba5860d1ee13916120b7160e7a3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            74d8ad180efe7e55bb36b5d93efd1b697bd7e9bb766e3b5d282cfe4440b9c93f64f3ec52aa28e80b08b8b22fbee34334e27fc3054659c05fa5976cb4dce53e6e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f10172438b1d276c9ecde73a74af19cc

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            bcc6bdc8a768c978d9da646f6986fa5ce0be1e15

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a452458ec8ade7e5723ceb8c744e963507a9fdd47fb80a340239a493a4cdfd30

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e58635a4612b1c3f8b3ae71be99321381e377d121ed874a67cd858463189fb59aa4b3e4fde093166cc4d3abbaffd2fbc6ce91cf89239b7c8de52db3c46c7d935

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            16B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            11KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4a2fcc62885ed1e6ba4693d80d158de2

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6175963ed3c532727652f55007b7526c40b7e128

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6654885965ae0b54b0b996bc28b6f6beccaa8b7ef96337a43bd98f9cd8bc9453

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9aba417943fdc68899be5ad914282d122d638792f46fab5de3df392197e3f47ec75c39f993a4549925d31e88d2fe546d8ff18d1d4a599b07526e0b95c1210194

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5e2249d42d87e6947280388ce685dd4c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2ab9d9a5c9aa36cac94fb216cfcaff2c268f0ed9

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f3f194fdb7ec49815ac5c91509cc2b0fb658f4a54b4d11cedf229ff0dace38ce

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cc4f374b5f6ea7ee5ff4869a986f4df2a8da285dad03f029e6f9280f3685596597f004af1a1a5b71149835ddb62323c41b5d06bb0ee938d08f738cf3c922ae5a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            933B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7a2726bb6e6a79fb1d092b7f2b688af0

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b3effadce8b76aee8cd6ce2eccbb8701797468a2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\tor.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\b.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c17170262312f3be7027bc2ca825bf0c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\c.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            780B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8124a611153cd3aceb85a7ac58eaa25d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            c1d5cd8774261d810dca9b6a8e478d01cd4995d6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0ceb451c1dbefaa8231eeb462e8ce639863eb5b8ae4fa63a353eb6e86173119e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b9c8dfb5d58c95628528cc729d2394367c5e205328645ca6ef78a3552d9ad9f824ae20611a43a6e01daaffeffdc9094f80d772620c731e4192eb0835b8ed0f17

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_bulgarian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            46KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            95673b0f968c0f55b32204361940d184

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (simplified).wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            53KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0252d45ca21c8e43c9742285c48e91ad

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5c14551d2736eef3a1c1970cc492206e531703c1

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_chinese (traditional).wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            77KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            2efc3690d67cd073a9406a25005f7cea

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            52c07f98870eabace6ec370b7eb562751e8067e9

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_croatian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            38KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            17194003fa70ce477326ce2f6deeb270

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e325988f68d327743926ea317abb9882f347fa73

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_czech.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            39KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            537efeecdfa94cc421e58fd82a58ba9e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3609456e16bc16ba447979f3aa69221290ec17d0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_danish.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            2c5a3b81d5c4715b7bea01033367fcb5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b548b45da8463e17199daafd34c23591f94e82cd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_dutch.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7a8d499407c6a647c03c4471a67eaad7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_english.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fe68c2dc0d2419b38f44d83f2fcf232e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6c6e49949957215aa2f3dfb72207d249adf36283

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_filipino.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            35c2f97eea8819b1caebd23fee732d8f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_french.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4e57113a6bf6b88fdd32782a4a381274

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0fccbc91f0f94453d91670c6794f71348711061d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_german.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3d59bbb5553fe03a89f817819540f469

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_greek.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            47KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fb4e8718fea95bb7479727fde80cb424

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_indonesian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3788f91c694dfc48e12417ce93356b0f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_italian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            30a200f78498990095b36f574b6e8690

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            c4b1b3c087bd12b063e98bca464cd05f3f7b7882

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_japanese.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            79KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b77e1221f7ecd0b5d696cb66cda1609e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            51eb7a254a33d05edf188ded653005dc82de8a46

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_korean.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            89KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6735cb43fe44832b061eeb3f5956b099

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d636daf64d524f81367ea92fdafa3726c909bee1

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_latvian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c33afb4ecc04ee1bcc6975bea49abe40

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fbea4f170507cde02b839527ef50b7ec74b4821f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_norwegian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ff70cc7c00951084175d12128ce02399

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            75ad3b1ad4fb14813882d88e952208c648f1fd18

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_polish.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            38KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e79d7f2833a9c2e2553c7fe04a1b63f4

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_portuguese.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fa948f7d8dfb21ceddd6794f2d56b44f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            ca915fbe020caa88dd776d89632d7866f660fc7a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_romanian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            313e0ececd24f4fa1504118a11bc7986

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_russian.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            46KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            452615db2336d60af7e2057481e4cab5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_slovak.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c911aba4ab1da6c28cf86338ab2ab6cc

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fee0fd58b8efe76077620d8abc7500dbfef7c5b0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_spanish.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8d61648d34cba8ae9d1e2a219019add1

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2091e42fc17a0cc2f235650f7aad87abf8ba22c2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_swedish.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            37KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c7a19984eb9f37198652eaf2fd1ee25c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_turkish.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            41KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            531ba6b1a5460fc9446946f91cc8c94b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cc56978681bd546fd82d87926b5d9905c92a5803

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_vietnamese.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            91KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8419be28a0dcec3f55823620922b00fa

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2e4791f9cdfca8abf345d606f313d22b36c46b92

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\r.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            864B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3e0020fc529b1c2a061016dd2469ba96

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\s.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ad4c9de7c8c40813f200ba1c2fa33083

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d1af27518d455d432b62d73c6a1497d032f6120e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\t.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5dcaac857e695a65f5c3ef1441a73a8f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4fef5e34143e646dbf9907c4374276f5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            47a9ad4125b6bd7c55e4e7da251e23f089407b8f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8495400f199ac77853c53b5a3f278f3e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            be5d6279874da315e3080b06083757aad9b32c23

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\u.wnry
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7bf2b57f2a205768755c07f238fb32cc

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            20.7MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            baee0e3d9009b65940f06360122d8919

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3073926754430ce4bcf7cb5a8b813edf012726ce

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5b8b8a385861dfa534478d104bb807edb655264bfab7aea6141637c325f360ac

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f3c266a0be81420f3f7bd675195a9da3fc82a550925f5ac5798bd74ca322b0f82b19d3b1e87acae5eba6c64fb05b5f2853d6b5c885867fb0d29faae169b07d2e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\Fake Infection.zip
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            47KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5a1d8bddab287598e0d8a76a462beb57

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            39e1c214cac28d79f02c742c8c8c66e5ddd3c09f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f708aee5ffb7f7ccc07977ff7c5efed37dc4d5736859016308c4bf3e544235f2

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            aa99221886929f2b4db4b59d63e8eaf6b2a1f3f2eb93f2bff19f66720c33bb9c3e1326c85b3af74c2fa57d34dcd1ddb8252dc3c81853c1665dcc92b86b922f15

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\Fake Infection.zip:Zone.Identifier
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            55B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0f98a5550abe0fb880568b1480c96a1c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d2ce9f7057b201d31f79f3aee2225d89f36be07d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\Fake Infection\hts-cache\@[email protected]
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9c8aec8253b7117968c0ac41af9c5ea1

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9969967904a3c0b5b89ce1fb6998bb5bb4021db8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b41b67aef30caf3a65cf252ca9fa1f9aa7501daea57206a74538c3efbc8f18ac

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            651e56d6fe255038c1567e2fb411324e78fbb235a959fd88d762663f415b5e2fd12940d0a2c595b418ea5d4e5645a45ebc9d62ad91bde7204ce6cf49c1a721bd

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\WannaCrypt0r.zip.crdownload
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e58fdd8b0ce47bcb8ffd89f4499d186d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b7e2334ac6e1ad75e3744661bb590a2d1da98b03

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            26B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • memory/3048-2104-0x0000000073760000-0x00000000737D7000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            476KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2099-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2070-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2068-0x00000000737E0000-0x0000000073862000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2069-0x0000000073870000-0x0000000073892000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2102-0x0000000073870000-0x0000000073892000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2100-0x0000000073930000-0x000000007394C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2066-0x00000000738A0000-0x0000000073922000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2105-0x0000000073540000-0x000000007375C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2103-0x00000000737E0000-0x0000000073862000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2101-0x00000000738A0000-0x0000000073922000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            520KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2067-0x0000000073540000-0x000000007375C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2112-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2119-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2125-0x0000000073540000-0x000000007375C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2139-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2145-0x0000000073540000-0x000000007375C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2166-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2173-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2183-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2189-0x0000000073540000-0x000000007375C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.1MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3048-2190-0x00000000002F0000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3116-833-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download