Overview

overview

10

Static

static

1

osu!install.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    523s
  • max time network
    524s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-10-2024 12:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    osu!install.exe

  • Size

    4.3MB

  • MD5

    7a3a8644ed7d24c5aeadc265d2fa6fca

  • SHA1

    5649dedf5ddbe67454019730ea9b36948095665b

  • SHA256

    87ec7c7901234a7d6b65d37789f089f1f124c524ed7a7861188684354d0a32c6

  • SHA512

    6aa3d14b0e21775434d78290a6e337d3ab4fe830740c5bd60acb1d84c1386685bbf0883d9bf6db53b1cc8015a642b3903fba0fd775e422a12603478c82eb5470

  • SSDEEP

    98304:PNmKfYgREMJFBDSEtkARdVbNZYXNfRKHkxRxpDOhi:PNmKfYgREMJFBDSEtLbbNGX2oii

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwareworm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 35 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Network Service Discovery 1 TTPs 10 IoCs

    Attempt to gather information on host's network.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\osu!install.exe
    "C:\Users\Admin\AppData\Local\Temp\osu!install.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3692
    • C:\Users\Admin\AppData\Local\osu!\osu!.exe
      "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Users\Admin\AppData\Local\osu!\osu!.exe
        "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Users\Admin\AppData\Local\osu!\osu!.exe
          "C:\Users\Admin\AppData\Local\osu!\osu!.exe" -repair
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:884
          • C:\Users\Admin\AppData\Local\osu!\osu!.exe
            "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3360
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:4912
  • C:\Windows\System32\GamePanel.exe
    "C:\Windows\System32\GamePanel.exe" 000000000007005C /startuptips
    1⤵
    • Drops desktop.ini file(s)
    • Checks SCSI registry key(s)
    PID:4560
  • C:\Windows\System32\bcastdvr.exe
    "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
    1⤵
    • Checks processor information in registry
    PID:1536
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:3536
  • C:\Windows\System32\GamePanel.exe
    "C:\Windows\System32\GamePanel.exe" 000000000009021A /startuptips
    1⤵
    • Checks SCSI registry key(s)
    PID:4152
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:2432
  • C:\Windows\System32\GamePanel.exe
    "C:\Windows\System32\GamePanel.exe" 000000000004025A /startuptips
    1⤵
      PID:3680
    • C:\Windows\System32\GamePanel.exe
      "C:\Windows\System32\GamePanel.exe" 00000000000A021A /startuptips
      1⤵
        PID:208
      • C:\Windows\System32\GameBarPresenceWriter.exe
        "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
        1⤵
        • Network Service Discovery
        PID:2372
      • C:\Windows\System32\GamePanel.exe
        "C:\Windows\System32\GamePanel.exe" 00000000001102F8 /startuptips
        1⤵
        • Checks SCSI registry key(s)
        PID:3668
      • C:\Windows\System32\GameBarPresenceWriter.exe
        "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
        1⤵
        • Network Service Discovery
        PID:3404
      • C:\Windows\System32\GamePanel.exe
        "C:\Windows\System32\GamePanel.exe" 000000000011006E /startuptips
        1⤵
        • Checks SCSI registry key(s)
        PID:4740
      • C:\Windows\System32\GameBarPresenceWriter.exe
        "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
        1⤵
        • Network Service Discovery
        PID:1980
      • C:\Windows\System32\GamePanel.exe
        "C:\Windows\System32\GamePanel.exe" 000000000009025A /startuptips
        1⤵
        • Checks SCSI registry key(s)
        PID:3216
      • C:\Windows\System32\GamePanel.exe
        "C:\Windows\System32\GamePanel.exe" 000000000012006E /startuptips
        1⤵
          PID:4252
        • C:\Windows\System32\GameBarPresenceWriter.exe
          "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
          1⤵
          • Network Service Discovery
          PID:2416
        • C:\Windows\System32\GamePanel.exe
          "C:\Windows\System32\GamePanel.exe" 00000000000C0276 /startuptips
          1⤵
          • Checks SCSI registry key(s)
          PID:2072
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            2⤵
            • Checks processor information in registry
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2356
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.0.435444065\1162533597" -parentBuildID 20221007134813 -prefsHandle 1732 -prefMapHandle 1724 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d7914f-d625-4f27-9630-959b916456da} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 1812 208c9fd8f58 gpu
              3⤵
                PID:2460
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.1.1485296306\714535180" -parentBuildID 20221007134813 -prefsHandle 2156 -prefMapHandle 2152 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9513eb4e-cf9e-40b9-8cc9-b09e479e871b} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 2168 208bee71958 socket
                3⤵
                  PID:4912
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.2.1854688203\336021362" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2992 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eadaf8d8-4db2-4ccf-91b7-98b707441e26} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 2968 208c9f5a158 tab
                  3⤵
                    PID:816
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.3.1725993527\1208904011" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21aeb672-ceac-4930-af17-6718f2740399} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 3576 208bee5be58 tab
                    3⤵
                      PID:3404
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.4.2063632495\237508396" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3752 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ce65257-9e41-4f21-919f-c2b5b80884cf} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 3784 208ceedb558 tab
                      3⤵
                        PID:3776
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.5.1219900505\1028275222" -childID 4 -isForBrowser -prefsHandle 1596 -prefMapHandle 2724 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {592f2211-497f-4fde-aafe-7d37f89e0b4c} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 1620 208d0294858 tab
                        3⤵
                          PID:224
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.6.195965726\554134175" -childID 5 -isForBrowser -prefsHandle 5080 -prefMapHandle 5084 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b90657f-cf08-49df-97f4-c6948ed91536} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 5072 208d0695958 tab
                          3⤵
                            PID:1480
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.7.1084177830\344456088" -childID 6 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf657fa-399c-4cd5-be15-6582dc357fe0} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 5212 208d1174258 tab
                            3⤵
                              PID:3748
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.8.161380583\1074991834" -childID 7 -isForBrowser -prefsHandle 5084 -prefMapHandle 5092 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {012beece-d68d-4d75-bbde-7d233265cdf9} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 4792 208d2518158 tab
                              3⤵
                                PID:3040
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.9.981505076\643076408" -childID 8 -isForBrowser -prefsHandle 1612 -prefMapHandle 1604 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e167dc4-222c-444e-ad62-43196cf791f4} 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 1576 208d2f35258 tab
                                3⤵
                                  PID:684
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:5808
                              • C:\Windows\system32\notepad.exe
                                "C:\Windows\system32\notepad.exe"
                                1⤵
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                PID:4444
                              • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                "C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                1⤵
                                • Drops startup file
                                • Sets desktop wallpaper using registry
                                • System Location Discovery: System Language Discovery
                                PID:5508
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib +h .
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  • Views/modifies file attributes
                                  PID:3004
                                • C:\Windows\SysWOW64\icacls.exe
                                  icacls . /grant Everyone:F /T /C /Q
                                  2⤵
                                  • Modifies file permissions
                                  • System Location Discovery: System Language Discovery
                                  PID:3328
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5632
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c 75941728043799.bat
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5528
                                  • C:\Windows\SysWOW64\cscript.exe
                                    cscript.exe //nologo m.vbs
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5820
                                • C:\Windows\SysWOW64\attrib.exe
                                  attrib +h +s F:\$RECYCLE
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  • Views/modifies file attributes
                                  PID:5864
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected] co
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5248
                                  • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
                                    TaskData\Tor\taskhsvc.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:316
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c start /b @[email protected] vs
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5308
                                  • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                    @[email protected] vs
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5364
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4832
                                      • C:\Windows\SysWOW64\vssadmin.exe
                                        vssadmin delete shadows /all /quiet
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        • Interacts with shadow copies
                                        PID:4876
                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                        wmic shadowcopy delete
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2352
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4664
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2808
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4624
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\tasksche.exe\"" /f
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4564
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\tasksche.exe\"" /f
                                    3⤵
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:5708
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5604
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2752
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4020
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5192
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5200
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5092
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4788
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3164
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3344
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5180
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:6116
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4284
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3356
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5300
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2352
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskse.exe
                                  taskse.exe C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5932
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                  @[email protected]
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1240
                                • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\taskdl.exe
                                  taskdl.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:6056
                              • C:\Windows\system32\NOTEPAD.EXE
                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                1⤵
                                  PID:6116
                                • C:\Windows\system32\vssvc.exe
                                  C:\Windows\system32\vssvc.exe
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4444
                                • C:\Users\Admin\AppData\Local\osu!\osu!.exe
                                  "C:\Users\Admin\AppData\Local\osu!\osu!.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4692
                                • C:\Windows\System32\GameBarPresenceWriter.exe
                                  "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                  1⤵
                                  • Network Service Discovery
                                  PID:1972
                                • C:\Windows\System32\GamePanel.exe
                                  "C:\Windows\System32\GamePanel.exe" 00000000000304C8 /startuptips
                                  1⤵
                                  • Checks SCSI registry key(s)
                                  PID:5952
                                • C:\Windows\System32\bcastdvr.exe
                                  "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
                                  1⤵
                                    PID:932
                                  • C:\Windows\System32\GameBarPresenceWriter.exe
                                    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                    1⤵
                                    • Network Service Discovery
                                    PID:768
                                  • C:\Windows\System32\GamePanel.exe
                                    "C:\Windows\System32\GamePanel.exe" 00000000000604FC /startuptips
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    PID:5492
                                  • C:\Windows\System32\GamePanel.exe
                                    "C:\Windows\System32\GamePanel.exe" 00000000000404C8 /startuptips
                                    1⤵
                                      PID:2924
                                    • C:\Windows\System32\GameBarPresenceWriter.exe
                                      "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
                                      1⤵
                                      • Network Service Discovery
                                      PID:5180
                                    • C:\Windows\System32\GamePanel.exe
                                      "C:\Windows\System32\GamePanel.exe" 00000000000704A2 /startuptips
                                      1⤵
                                      • Checks SCSI registry key(s)
                                      PID:5464
                                    • C:\Users\Admin\Desktop\@[email protected]
                                      "C:\Users\Admin\Desktop\@[email protected]"
                                      1⤵
                                      • Executes dropped EXE
                                      • Sets desktop wallpaper using registry
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5372
                                    • C:\Windows\system32\mspaint.exe
                                      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\ResumeReset.dib"
                                      1⤵
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SetWindowsHookEx
                                      PID:6096
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
                                      1⤵
                                        PID:736

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Windows Management Instrumentation

                                      1
                                      T1047

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      1
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Defense Evasion

                                      Direct Volume Access

                                      1
                                      T1006

                                      File and Directory Permissions Modification

                                      2
                                      T1222

                                      Windows File and Directory Permissions Modification

                                      1
                                      T1222.001

                                      Hide Artifacts

                                      1
                                      T1564

                                      Hidden Files and Directories

                                      1
                                      T1564.001

                                      Indicator Removal

                                      2
                                      T1070

                                      File Deletion

                                      2
                                      T1070.004

                                      Modify Registry

                                      4
                                      T1112

                                      Subvert Trust Controls

                                      1
                                      T1553

                                      Install Root Certificate

                                      1
                                      T1553.004

                                      Credential Access

                                      Discovery

                                      Network Service Discovery

                                      1
                                      T1046

                                      Peripheral Device Discovery

                                      1
                                      T1120

                                      Query Registry

                                      3
                                      T1012

                                      System Information Discovery

                                      3
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Defacement

                                      1
                                      T1491

                                      Inhibit System Recovery

                                      2
                                      T1490

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
                                        Filesize

                                        2KB

                                        MD5

                                        8871cc755ee905a059b14f45bf7e53ab

                                        SHA1

                                        c5715b676a5decf88c254d7b852f06e6ac06d300

                                        SHA256

                                        6783460800dcabff687f6eee55ee85bd30fcaccbf688ae6586d79233900789c5

                                        SHA512

                                        359f1a1755b2963bb3b9982717f8a3c0d1ebe860d3a7f7af6ae31827925af16cf1f5d459bee5ad07432e8a46cead06be617a09c47c583930771cb8f7b268f84a

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_ACC1A26A3F5A815A00C8D5589432921F
                                        Filesize

                                        2KB

                                        MD5

                                        0e9610afd775dc028c02824047f34d00

                                        SHA1

                                        5d74da542f872eb54024a9b03e63c3d8e36c5ef9

                                        SHA256

                                        66047f51faeb78db1e12c08068a6c540ea2d666aed9287aee72547d54acd73e1

                                        SHA512

                                        6cf3ffeda254d15883233ff99d212ada17d88802f21f4bc401f4ed598f54eddb1b77e1fee9e0f6ee052ddf44eeb41b814dd85b2bb50a6fd6840783041734c8be

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD96F9183ADE69B6DF458457F594566C_2A1629F6AECF33AE85C1B354602587EE
                                        Filesize

                                        2KB

                                        MD5

                                        de79a61b4bc050cc368a9c6cf77b8ec2

                                        SHA1

                                        765bc839e760b60f844c3705e7382b3d6f5e1f59

                                        SHA256

                                        cc5a457554b5c5a688b7ed6bc3dc5b9521c2108d8134bbadaae5f15849982d4a

                                        SHA512

                                        94a4039b34fbc5f2026d2eefd59b7ca6fafbf7ceb3860742b513c5108b5985bb657f8709f244f1d1aaa71a2fc22da3ee5113801a2a78e7d72a556125e5942a00

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
                                        Filesize

                                        556B

                                        MD5

                                        5473343b9e488f50252405ac0dd3a782

                                        SHA1

                                        36d13eeec7dc52a8ab814fa3450cb64d2bb754c3

                                        SHA256

                                        dcff7cf7ca14002ddf9a1740e480fb4f4e0b9a6ace6fafbccd4759e25b809c65

                                        SHA512

                                        4b0408b2ca97c6b1752c363b1c7e475c4104f576e50df39e8efe17e8edd4d77cb8da010ef9b87b441876c2e80cccf221ec6dc62b7781d0f23c114a72e3719abc

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_ACC1A26A3F5A815A00C8D5589432921F
                                        Filesize

                                        564B

                                        MD5

                                        8e0c9528f0f13a8d7cf90a7dbafd75f3

                                        SHA1

                                        45b4c3065d49f8d472b251e1330e1e8fcfa2bd70

                                        SHA256

                                        eac7b0bf7c295d8016678fc1cf868f655e863234174604626e686abd0c51e63b

                                        SHA512

                                        f24e64538275a48455fa2dc9727f0111fd5f60528ba4d44e6b98d0f8ceedec748b00564cdb2b739caf043d74a2234269a678a21535e594e7c10c6f6f6b5aa71c

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD96F9183ADE69B6DF458457F594566C_2A1629F6AECF33AE85C1B354602587EE
                                        Filesize

                                        564B

                                        MD5

                                        d07912038f9bdb6629364e1f7e4219b6

                                        SHA1

                                        e4800357d07203a3927b42490c848e17d0cdf7f7

                                        SHA256

                                        b9bce80328501dd053dc20eb65a9ef9a8649c39ed7005d8e54574e8741913b26

                                        SHA512

                                        4edf4df374f6eb627d74e68e0932e29552b2c16510623f798f0d6e51d61c2df8d34e023a1374b5bac1862c871ba095f6ad31692521279fccdd796fc8356af3fa

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\osu!.exe.log
                                        Filesize

                                        1KB

                                        MD5

                                        5f5ca80c1769820df625bba2d3980926

                                        SHA1

                                        3c2769fab3455997e7aae7dabced748eb99d77e4

                                        SHA256

                                        348900eb8f9256b58d96c9983637ecee63a41b2721303e60ba53795e74346e8d

                                        SHA512

                                        7084ba23af28701fb93488c30da3c47077a23afe662c5edbb547848917635c89b6ecf1be51040dadde031c61e3c49c938311dcdd8be0065cc6e739bc90f554bc

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\27288
                                        Filesize

                                        15KB

                                        MD5

                                        8741f2722484abbc38f80d5b85c18d95

                                        SHA1

                                        8bd44351ffb08c0263837eae90d0cbe240209eb4

                                        SHA256

                                        440f86fac4c40675935765bbb0563e8a3f9d3246effdfe3fafda92d4d42c092e

                                        SHA512

                                        48df48b7c52284c69808cb21aff804d1e4c8dfad4ea4d1632b7ae57e51245a7cadaa24daffd1ae290cb441480621e38c0770bfc36aa22e1f115ed8aded7f4fee

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\doomed\6203
                                        Filesize

                                        15KB

                                        MD5

                                        d4ad6b14a1c03b8b6b478e97fe3d6f81

                                        SHA1

                                        8c2d26818b8a8b7b90b28e2d42b132a9dea6ce46

                                        SHA256

                                        dc5ed3f2388fea764e85d1629d3e12d8175767804d9539d127a19d40dfdae918

                                        SHA512

                                        284d846af3da87d4b48265431bd1977854126b098038ff3026a49618b5d67b83ce167b60f4d5254f7f842acada61e0aeb2fcfbf69656fdb9663aed8c7a835985

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\6738ED417ABC15DD7993802EF2A4ED577E300AE2
                                        Filesize

                                        61KB

                                        MD5

                                        dc0411a799d177f8df061bcf97c3ff1c

                                        SHA1

                                        8dbeb9f638082663b362f094894bdcb9d57f0796

                                        SHA256

                                        3c91d44b442b1aaf57d334d0a256a3cd469e249a04b48be96dbc9c17f7d36953

                                        SHA512

                                        ca2d9f290420b1dd165a2b32efbad23246fbf577324852f908dc7407ad7d3a7698e6049e9cfd0b35615b4bae2e5b7d3d17d0e5c3c515a40b1212b302437df107

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\79679B23E6BBEB689E1C79E27C32C20C5EC9DF47
                                        Filesize

                                        22KB

                                        MD5

                                        3616f8bc1bd82e00a5f721525b32a411

                                        SHA1

                                        113e9f333662d2ee31635f9d8fa3a7abc75e2274

                                        SHA256

                                        14f304c8bbdbe7a1912db2682fbf20405ee8898f79bb52007c4a4030f0ad30b8

                                        SHA512

                                        74979879ad6d880d3dab55faabc6daef239e18a87006daa22bf2da7de1b95a1c5d9bc07d09af52f47349e7dbebef7b6ecfebaabccdaffa5072b45c7c1ae71f50

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                        Filesize

                                        442KB

                                        MD5

                                        85430baed3398695717b0263807cf97c

                                        SHA1

                                        fffbee923cea216f50fce5d54219a188a5100f41

                                        SHA256

                                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                        SHA512

                                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                        Filesize

                                        8.0MB

                                        MD5

                                        a01c5ecd6108350ae23d2cddf0e77c17

                                        SHA1

                                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                        SHA256

                                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                        SHA512

                                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\osu!auth.log
                                        Filesize

                                        256B

                                        MD5

                                        385fa453e31ac51f18aab930e2e04019

                                        SHA1

                                        2eca6164a0ea56c4b005d868c3eabcaac39b1f90

                                        SHA256

                                        d48019445b92df694af8c1d092526a26354e82062fb816c8b397abe8b32644d6

                                        SHA512

                                        72efbf56780944d71827835cca5fe37aa64ae2087e970f17e9b42f86c4fa7a726f354287c7ad3f8202d31cf3a0687cb99b9bb7956af471cb67a6eb3cf8695d79

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        908B

                                        MD5

                                        b78ff3ebeef9a4130e1799385738d276

                                        SHA1

                                        8d02125021ccab570dc2cd0dd1dcb634619a09bb

                                        SHA256

                                        241b3129a1b303a307cee5bc7c122522fbf62aea280288f8b24e06fa89e7745c

                                        SHA512

                                        52f4c5f1ad41e839140647209fe704cc69dc9093af6392fad64cf87f2d86977cde0754df0eb79168c75f285b6b39505de3c9549fdb793bfe1ab4158388ddb951

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        1KB

                                        MD5

                                        ec0e0c2db338f9884fa7d4d2d7cecbf5

                                        SHA1

                                        e51b71ebfbe82d0bf8f92082c813789ca563e86f

                                        SHA256

                                        43ef0653bb4cd26380b305edf1fbdc40a87fe04a99aee4d9517b2d52fe01f608

                                        SHA512

                                        fb7e9bb0b0a7fe57a9372d2eef3be607745e593df0806755b9e68ed759a3a94fb8f157c6b46eb9fdf9b9b6d13b8181a37c0becedaae1ca1780eacaf1a2896968

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        325B

                                        MD5

                                        2ba3703eb2e1fc5153f45d0a95d08004

                                        SHA1

                                        7d6ab12cf11fa91bd1d8e96be0ea0bc3d3b6eb8c

                                        SHA256

                                        c01c60bf66ad407716ae588bd90adbe70dc70de0a1e4143ba30afab051caa0bf

                                        SHA512

                                        5e5f19896a2a31856a713d933fa1173fb9f82f3cb6152ad05da5da2de4f8ecfbabf53c6fb6aa861157458cfc39e0db88e276a780ec4f8cc12cd69fc50e239a64

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        583B

                                        MD5

                                        d013e6b797e0bc09538549daf60ab7c3

                                        SHA1

                                        df0fd4f252856f39e59f6ed8ff2fbe63de5ac135

                                        SHA256

                                        d3a6c2dbcbdf9444e916113a09e1f926fc8ae2878cc714d190ca37bf3f2de3ae

                                        SHA512

                                        5b8af27f1883a16d4dfc88459108339f9fce50de75d86d0a04e9e843a473bdfa400c53d00dd4d612b7f0b245d8cb39dfc5db16aec96c7ad60be5fce4709913ae

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        4KB

                                        MD5

                                        f5579a0b41726d020522e7365b198267

                                        SHA1

                                        fcb68e4b30cb503ea822c5306167084c846d3289

                                        SHA256

                                        38c65f649075f4abe74dc04fd9853dd563774584602ddb37f8b7ba25ff4c4b5f

                                        SHA512

                                        926ea019734e9f03ac83721a3003f21dc6987d316735e3f804b885941c5bf5790fdc32112e44b0ca37dc1b368770fe0aa8177d4ef84b00cfab4f252cd20a275d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        370B

                                        MD5

                                        2195565a073d2a139fcd6113c8a185f7

                                        SHA1

                                        d96a0d8725169d9eda2772318fff4dfe9afd2c34

                                        SHA256

                                        0a22663086c8f237ffec8b7feb8604d30df8427b361b9c01b7845aabe0f55581

                                        SHA512

                                        de0deed611f43751f8e7e8d01a5bbc74d6382f2c910b58ac845ebf63dccdc12ceaaed77e65807ab97ca9f73c873be5c5efdad0c645201480da00a149161412ae

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        616B

                                        MD5

                                        04e70097a5b24f9b41475fcd50688298

                                        SHA1

                                        b28ce5e77bd38e2e220adedb178fe8d8db57ee64

                                        SHA256

                                        786e1f5b1c394b86810485fbe497e76ab88f06239ab3682957ec18d0cf522bdd

                                        SHA512

                                        ac28f1365c1862e1d4fad4670d28244c5c83ebf20ca063e7eab8496d6a37d9eca0f98a5a9fb555d138902ca6bbda9e22ed545a07fb604c3521f86b211afdef43

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        1KB

                                        MD5

                                        cdad9f748cb8a23757fa452ed717545b

                                        SHA1

                                        b21ffa3158fbf1abd970adbd66ba805bb0f21d68

                                        SHA256

                                        f8652277b95e9b1e5294575d04073dfded8ab1f7c1ab5c6ec934f6ea754f5aaa

                                        SHA512

                                        adc31a900a7f7acb7fa3c348e243f9883eecbbead31b86859a6d1eee7a281fb086c8a03ac88b35aede52d15c90142b5a11a9a9b8e88c786ffdb582e35cfe9849

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        325B

                                        MD5

                                        276dfa24448ea52c936975344a32788e

                                        SHA1

                                        a9afac0204a1978349a9587bd79c4de1686ce68e

                                        SHA256

                                        28a66beac57de60ab86eda2cfc79f7aaeb3604ad730faafd14cb8049b80eb192

                                        SHA512

                                        f965bb0c98767851675b79ea3bc17a8032ce5f78a866a137da6e436d185295c0007fe348298095dd7aa6ad1a56942884fa190ebe6f8e33a3704e73383559cd21

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        583B

                                        MD5

                                        5fc6c0d6ce8ba5a350fdf6ce9526f78a

                                        SHA1

                                        bd59566574be17251c9b25135118c0be14ea1913

                                        SHA256

                                        774c3b8aeb87f7bcb4e3da0f7a2e1dadb11d3d4c689da27a0528f4e0644c992e

                                        SHA512

                                        55308fd492e0fb6e65a076c3226f8f10b4e6e5c23c0417d8781dd0ab2cfe3d5182659b8a9aef4b10d558b082dd05d9ebabf5cdfc228f7a196fa6780bee1dc7d3

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        673B

                                        MD5

                                        b5c8564e63385c1a74725e79aca4c2f4

                                        SHA1

                                        4a985a9139afd6493b87c00c35998a5159cc5d1a

                                        SHA256

                                        7b01b3df426dc286062a4cf0580b516c0d786d0d90b00afbf904d9ba68b4e11e

                                        SHA512

                                        d6a3b13be0f4d744b77a1cd8ba6482ef98d14a8fa319e9c3e3786a99e8c659130dc479c72cf7d1b569cf42455694636c0dc8628c14b1de7dbfb50ff2036d2351

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        998B

                                        MD5

                                        3521a6ee03f6d824c607214806ab9183

                                        SHA1

                                        2bea9f4cc89a3253015f9d463edbb3d548f38eaa

                                        SHA256

                                        6c9450e546f657f66ac1b6c3ca376a94b081b5539cbda4d7e77a0fd357498c7b

                                        SHA512

                                        d3120e115de0763b9cbcf5860b6b341949790fc87fe7b7a718ab460d8e58732247f7fa4925a879988e961642df6e6bebe819720171d36d707cd7073e7e45ad4f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update.log
                                        Filesize

                                        1KB

                                        MD5

                                        0c380cbdd3e1023f47fd43c60d6475b9

                                        SHA1

                                        1304b810caf31c5f1009153304860d92a4d5e4bf

                                        SHA256

                                        dec469ae3f8bb026034fe82edc223282b107c2104cf2cd44b00b12649c6348b2

                                        SHA512

                                        e9392612a7dfe935ef02b006cc8137eedcb24d40302054e6a129af342d683cb20002bbdeb4cb686a04f02c6ee8bcf8d5c453466b94ba331202d77c601b6fb319

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Logs\update_success.log
                                        Filesize

                                        6KB

                                        MD5

                                        5e198ec4441a72da4d8a7eba1889fbb2

                                        SHA1

                                        1328a8290bc6326eecc916b5be9cc21da61b4f33

                                        SHA256

                                        419b5711c8da9adb6e2940afa41839425aabfb3e7daee1894514aa2bdb5fec3d

                                        SHA512

                                        29bd1286e02c7b215b19176ee746919f1563a31f4cd48aed7e10a9b77029ee7e1402640b121e963f6329f7617d1ebb16b1b1fddb6f37b6e62d46ac1beabe4e0c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\Microsoft.Ink.dll
                                        Filesize

                                        456KB

                                        MD5

                                        82d4ee89f4a39c764fa6297a95ebb10e

                                        SHA1

                                        87b1f581ad017bf62604d8071a23fde8b81550e1

                                        SHA256

                                        1081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d

                                        SHA512

                                        904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\OpenTK.dll
                                        Filesize

                                        4.2MB

                                        MD5

                                        b4d949571134fc3ec6c28f1af7a75e49

                                        SHA1

                                        07eb5685ff4f19ff8ed466c68c2426e2ead69241

                                        SHA256

                                        b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511

                                        SHA512

                                        7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\avcodec-51.dll
                                        Filesize

                                        4.2MB

                                        MD5

                                        b66478cc0f9ec50810489a039ced642b

                                        SHA1

                                        992ede70f0fee5cb323b4b810cc960bf2531875e

                                        SHA256

                                        e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702

                                        SHA512

                                        ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\avformat-52.dll
                                        Filesize

                                        711KB

                                        MD5

                                        c00b30289cc427caff97af5aa3d43e03

                                        SHA1

                                        8e70885a62b0fe510422c2367b1f6de489b67e6c

                                        SHA256

                                        b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867

                                        SHA512

                                        3a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\avutil-49.dll
                                        Filesize

                                        77KB

                                        MD5

                                        47c83b958951331ba409d6b80316250c

                                        SHA1

                                        ce14566676a27a0899079781a41888a2f1303127

                                        SHA256

                                        e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064

                                        SHA512

                                        58408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\bass.dll
                                        Filesize

                                        125KB

                                        MD5

                                        7623474a8b9bec1e3ffca813cdf93bc3

                                        SHA1

                                        4a1c0ecf8cbed18d0472136a7096ee8c3c2fa774

                                        SHA256

                                        67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3

                                        SHA512

                                        b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\bass_fx.dll
                                        Filesize

                                        50KB

                                        MD5

                                        3ad3c0fd4dca001a2f9e707b74544919

                                        SHA1

                                        c6176415ecd3e8f38f976e4234325452fe1fd2a0

                                        SHA256

                                        81111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04

                                        SHA512

                                        436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\d3dcompiler_47.dll
                                        Filesize

                                        3.3MB

                                        MD5

                                        c5b362bce86bb0ad3149c4540201331d

                                        SHA1

                                        91bc4989345a4e26f06c0c781a21a27d4ee9bacd

                                        SHA256

                                        efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f

                                        SHA512

                                        82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\libEGL.dll
                                        Filesize

                                        146KB

                                        MD5

                                        9f7f22cef980ec272a9b73bf317500e4

                                        SHA1

                                        ae11d7cdfa84a242e31efd6f03b0ef764d5f900c

                                        SHA256

                                        041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072

                                        SHA512

                                        19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\libGLESv2.dll
                                        Filesize

                                        3.2MB

                                        MD5

                                        a4dfddff62d1e917ebb0688cf8d96be7

                                        SHA1

                                        9376bfa069a72da76733cc72cf90386920815142

                                        SHA256

                                        cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f

                                        SHA512

                                        97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!.Admin.cfg
                                        Filesize

                                        4KB

                                        MD5

                                        07fe94f230fa8603f619fa36b7fcfae5

                                        SHA1

                                        333068b55495fcfdb5e0076c25323c0b9178940f

                                        SHA256

                                        3e90bdd90033c3ec43089586f7ca9003dab5ed806eae4c929dd13bb09db0f86a

                                        SHA512

                                        4748d0931e5f8cf082789dee984936cf0891b7f33ea96885f647be97c69ba641687338c7d9bcdd189ed8fba409b69be1331c75740578f8dc06d3b39405d5ef4d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!.cfg
                                        Filesize

                                        878B

                                        MD5

                                        be0314915f9fa2fba6200b4e6af6fc49

                                        SHA1

                                        cf934c6296657fb0c574a3bdb3511ebdf18949cb

                                        SHA256

                                        c8d3738145d40fe86b89dd635755458f117099156a099ccce3d2a08bc8c2c338

                                        SHA512

                                        356182c81d50421a5382db68a3c0f5bcf834250caf9bd5c9fba8fa34f35d87cbd21ce4a5318d933c8a5867035fe2bfe9abe0620d3324bc7a881a90d017f9454a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!.cfg
                                        Filesize

                                        856B

                                        MD5

                                        90be0a9d06b232a0b0c255222575393b

                                        SHA1

                                        9cb1072c620cde36126f7fadae71013e5d59329e

                                        SHA256

                                        2d20336e755f3df1f2061b21ea69a244a0ae3cf3bf488adda2883da30becd920

                                        SHA512

                                        bc61a01d1195baabc8d5efe718abf6626dd2266b145d0619d03d2162bb8ce98d2d3838461e14b9d22f59122c6f2ab1319c24b4301d6b05c2b57e867b405c8c14

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!.exe
                                        Filesize

                                        4.3MB

                                        MD5

                                        7a3a8644ed7d24c5aeadc265d2fa6fca

                                        SHA1

                                        5649dedf5ddbe67454019730ea9b36948095665b

                                        SHA256

                                        87ec7c7901234a7d6b65d37789f089f1f124c524ed7a7861188684354d0a32c6

                                        SHA512

                                        6aa3d14b0e21775434d78290a6e337d3ab4fe830740c5bd60acb1d84c1386685bbf0883d9bf6db53b1cc8015a642b3903fba0fd775e422a12603478c82eb5470

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!auth.dll
                                        Filesize

                                        9.2MB

                                        MD5

                                        c7198a6b535acb7a831e0e29d16ff0e9

                                        SHA1

                                        d0b80294a314c6e4c9717a3f77e7cce5317e1ebd

                                        SHA256

                                        368f30cee1c864d6269942d7cc17ff4d76e46e6aa262fb9afbc69640e33fc9b2

                                        SHA512

                                        d673085ea1dd03a7bd6e731f52d6eed9cfddb8403818cce556c9bef1db954baa5556da9b4bcbb9d3d995cd006ddcabc16d79c269e0113406a4b1b90e280c1f6b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!gameplay.dll
                                        Filesize

                                        30.4MB

                                        MD5

                                        4cb98d63f1b2b9dc38e10e9901ec52d8

                                        SHA1

                                        42c0e8b8e5c7a4113e38a977221f845ef8406722

                                        SHA256

                                        ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87

                                        SHA512

                                        d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!seasonal.dll
                                        Filesize

                                        2.8MB

                                        MD5

                                        20082752d6c5fae8d08071aaf242b739

                                        SHA1

                                        70e8c7499507e8275c2ac06c372bde3b84f4c763

                                        SHA256

                                        1fae9cd8610a6d666c9b42d91440b493a257adab2126dd7c77f5d5098d678b8b

                                        SHA512

                                        6d9778f29ab522e45cee8a3d5aad6f4e65606675479cdf782844f5d162e13a8d42837ffe6d7533d8a29c71f10ce648cd2f859db55e7f8d00a4638ebea0b8ba46

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\osu!ui.dll
                                        Filesize

                                        24.6MB

                                        MD5

                                        72fd66c4ce090346c113b72990eb7d86

                                        SHA1

                                        038c06b41cee82578f5b6a0b0298570bc8969e8d

                                        SHA256

                                        c382d8319f5ccf7faa6517bfa53a052ebb7d8d16f335d5925ae777270c93e50d

                                        SHA512

                                        9973f0a33aa3e085ff5bdba469859cf5b6df7c8d60927e229c2cea2648e8ce0c7a4ea96f9861735e2bff8d2207dee55fdbc90f3534d50d009559391d9ff7f2ec

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\osu!\pthreadGC2.dll
                                        Filesize

                                        75KB

                                        MD5

                                        00678eb6be3b52d562b66218c93e21a8

                                        SHA1

                                        ba583d1520da22f3d3b89196c981279ecda58648

                                        SHA256

                                        b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f

                                        SHA512

                                        58d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                        Filesize

                                        17KB

                                        MD5

                                        87d3463d1333dea291fe8838a3ed7093

                                        SHA1

                                        eb79325a601bee64e86b8caaa384043118eddf4c

                                        SHA256

                                        e415286eb13cb5f53b7c6c52cfdc62d8d9f48a21b983fec0a4d94d86ae338d42

                                        SHA512

                                        22e0673a698f372986d647eac2ea2f2906d71b00b5c1b2920523c687260696b4734f8f1b90726daaba55c2311291da22977a51d9c5ae2ce4e285280052a54ac6

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin
                                        Filesize

                                        2KB

                                        MD5

                                        c2a93a48512b78e023bf3533ecc0b854

                                        SHA1

                                        134845d272a1e5088bd8a27ab4c5af3027d3c057

                                        SHA256

                                        0850dfddaf28113be88dcfa598b97ca6bf0d004b1bf01ae5b66839a42687fb86

                                        SHA512

                                        b9cc9d8fd6e6812a0443ad47c31ba04552d4b9983675031dadfea1d7f631ce1e8f59f6a3e6fb5af22407f786b94487cf8eb8d287e8742df150825667fe208beb

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\6beddbd5-7eba-4774-8df7-1a7e124efc67
                                        Filesize

                                        10KB

                                        MD5

                                        07fc6e4a2b5afaab8e6d631f6e063096

                                        SHA1

                                        5823486fda6feb6c5a2dcf37e679261985098d74

                                        SHA256

                                        1516de5c1ea235f915cb5f3c1fb405a0d6b923b403e137b7d10b4cfd3593c9e0

                                        SHA512

                                        43eb06e73110156248832d2f8034ea76e8b58f432ef84c90eb384ef4dae0ad5e36f082d75eabb1cffc60aa03d7366902c0a0e66a4bef777c371c6ca96141d261

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\c6885087-cce1-43d0-9dc4-f32ae528e688
                                        Filesize

                                        855B

                                        MD5

                                        6a2a0c590eee0541e8a20ef28df10b3f

                                        SHA1

                                        c8173769d96219ccea45f06558392dbab3a06c25

                                        SHA256

                                        00bdcd0c9f1c3dff4ab0012daf1112c7679e6bef1ac28930e0894d1a9d558f2d

                                        SHA512

                                        b643de282c4a7c98526303a596e3faba3a4444ad538c8c81098794f983bd1d860db8e23b97d150b3bae4dea93ccebcf45adf491c9a47a892074b1df20e20c50a

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\ee28a978-5fe8-41d4-9562-f27bd6101d91
                                        Filesize

                                        746B

                                        MD5

                                        a1c7ccdf612bc84516f62274447bd428

                                        SHA1

                                        d86b10e68cf6745beddfb97eab4c602e22b0d6e4

                                        SHA256

                                        7cd0080cdebbae8b58100f4c268c49e7f2eb37d66630a0c1acd9bae311b330a9

                                        SHA512

                                        4b16ea0fbf4620083c08d95765be3c1ab657a1522edbe331db970aeeb8c698125acf767834c8d12c9e0912ae5b37d8b7ede1902b2e9d42074a24902f568c1f86

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\fcc74049-4caf-4dc4-a076-01fd54d6e047
                                        Filesize

                                        595B

                                        MD5

                                        d8842bdd216c8927c681056a69191efa

                                        SHA1

                                        9f6dab3fd5dbf14d937519ddb9964e056b16da0a

                                        SHA256

                                        6886cb5fa8af15a4c4345cc370b5f04ea7f00231ab9f5cded50c29e86d7efc36

                                        SHA512

                                        3ccf12acf98936bff4a01f953f38a7be41c35516f5737812e741418ab63ba7c75b461748791831c3ff68789f83ccba1d050ba161d060b9aa77351bd6e7cc2696

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                        Filesize

                                        997KB

                                        MD5

                                        fe3355639648c417e8307c6d051e3e37

                                        SHA1

                                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                        SHA256

                                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                        SHA512

                                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                        Filesize

                                        116B

                                        MD5

                                        3d33cdc0b3d281e67dd52e14435dd04f

                                        SHA1

                                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                        SHA256

                                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                        SHA512

                                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                        Filesize

                                        479B

                                        MD5

                                        49ddb419d96dceb9069018535fb2e2fc

                                        SHA1

                                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                        SHA256

                                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                        SHA512

                                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                        Filesize

                                        372B

                                        MD5

                                        8be33af717bb1b67fbd61c3f4b807e9e

                                        SHA1

                                        7cf17656d174d951957ff36810e874a134dd49e0

                                        SHA256

                                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                        SHA512

                                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                        Filesize

                                        11.8MB

                                        MD5

                                        33bf7b0439480effb9fb212efce87b13

                                        SHA1

                                        cee50f2745edc6dc291887b6075ca64d716f495a

                                        SHA256

                                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                        SHA512

                                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                        Filesize

                                        1KB

                                        MD5

                                        688bed3676d2104e7f17ae1cd2c59404

                                        SHA1

                                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                        SHA256

                                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                        SHA512

                                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                        Filesize

                                        1KB

                                        MD5

                                        937326fead5fd401f6cca9118bd9ade9

                                        SHA1

                                        4526a57d4ae14ed29b37632c72aef3c408189d91

                                        SHA256

                                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                        SHA512

                                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
                                        Filesize

                                        6KB

                                        MD5

                                        f9baf3aefed4774273c9be872c4029a9

                                        SHA1

                                        18e50ac4ae80fbcfec3ac18ef493d05316a43fb8

                                        SHA256

                                        5d6c66c2d0c35458b9324dbf97f04ef8da1548ef21c87d1cae583e0eed6ee50a

                                        SHA512

                                        38623ba0b5f7c9da241da645f09bbd578d64437bdededd46c2a933a8339eec1b243a5fb2dae7a4d54e6e73e0cc620f6cc59297710addf77aa9782ad00a63c5ed

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
                                        Filesize

                                        6KB

                                        MD5

                                        ff6d79610f14f43dfa0b6b482c314dab

                                        SHA1

                                        c4fcd28397d091e155df362c839366c0d0c0dd38

                                        SHA256

                                        c71324f34bdcb2934ddc2a644f4c8c699f657293acb43951cd8282ad536d2d53

                                        SHA512

                                        ee76edb8605eb5d6871da7e5a3e08559ff77ea4256291b6dbaa36e4097fb0911aab1405f024607f2aafeb82166d3ac09c6242dc2c885f6592e65b41e14fb56b7

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js
                                        Filesize

                                        7KB

                                        MD5

                                        2a8031e0b85a967e3aa2e1305b1d7618

                                        SHA1

                                        4e4eeb8ff071cf30ce6f4d5be6a93e5a21db11ba

                                        SHA256

                                        4c52ee31c193eecc402930566020be8b896a3b8932f506dc368239b848b2366f

                                        SHA512

                                        d65fe19f29c5e6aeac19b9de18795c16f0c246c2cd2e07c415388cd80a0d0249161265072cecf48dbd898459a5892065718868cf15ba5a9403bd6157cb7f430e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js
                                        Filesize

                                        6KB

                                        MD5

                                        0191d73e1b273d99cf500f216eecc558

                                        SHA1

                                        5fe835c707306f4ee2768cd683b56379c33709cc

                                        SHA256

                                        e83e030233b4e2fe30a972d190edc972c02063456aa05afc0625eea0cae19b93

                                        SHA512

                                        f51d3233d9d7f4ce4a8ed0bd43d3a5e6d3db4cc5b6d576b87c426ea39fdc5086109ba95f30c3408cf91e1f8a8872096a659443b02db1ce6e2adf8e2a66dfeaae

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        4KB

                                        MD5

                                        89a0675f2578e699367c1d1ec67361e8

                                        SHA1

                                        7a30e07da67cf84ef7d90cd98433a2b9c6ef5682

                                        SHA256

                                        4f1a58cdc39fc19ff72b1a83127e08607519af7b426b26ee773072d27ace5089

                                        SHA512

                                        d4e2dca4449270de6cd2fadbc667cd7b80600366b7199e647fd4499677ecc843dd9d78c7d93dd1ad858bbbe93415c958d2907586759af5b7c4a9c22c27ac3ca1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        8KB

                                        MD5

                                        3c99e996bd4c87ba64e463f4bfde4f1f

                                        SHA1

                                        2023de55853f3370eb62c8a5697e6a43306c50ce

                                        SHA256

                                        adad9ebff4a5688c177d5948b9aedcf9f1f364a5ca528ff6e07e91aa73ee85c7

                                        SHA512

                                        04495f9377ac93211c1bc5dcfe008fba803f525b729490d61adf53e29bd68bf0b2d0bfd0c72ace2789c6c83f58c653fdf0cb1d6a767df96ce5ac5b0710a55c37

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        11KB

                                        MD5

                                        a28a0e58e4f50b3a0f048aba2decd81c

                                        SHA1

                                        b772bb319ef01dea56bf028c205ae52cda074f17

                                        SHA256

                                        2d2121b6419a5f678dbc8b561ab5da7442db6f7843d952f9bc5fc36ff162f8ef

                                        SHA512

                                        7542dd0891534906aaeb2055dda3e3204dfa173a6807c4804242d6f9dcb8d3d9f7055c509afc684c853b11e03e897e564a22fab7a4e9f13fd1994e1e786c0037

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        4KB

                                        MD5

                                        72842c458eec29af6d0da6207597e5ef

                                        SHA1

                                        37168b608be08102153fe4bc0b8373e1cfc8e51c

                                        SHA256

                                        7fcdd4b7083165c07ced4bac84e5c4eca9ce0fc674e489de5e65920572e8573a

                                        SHA512

                                        ca1c8f2c5c2daa6fca7fc02971fba2840f9399f152bc8ffcb00ebbf061050c01d429db871f33b6a460eefc31f6404d8de7f4902614e588249e19d915644378f3

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        3KB

                                        MD5

                                        601ec61a7189cb780455335a6c8764bc

                                        SHA1

                                        92fae21a124e42469fe553aa6e26cd5b0dce0ff9

                                        SHA256

                                        248b1db41a1e700f8cfce3b595e23e7feb3b8b8cd8c59c291d898a7e79cc6749

                                        SHA512

                                        6fd9dbf74a5dd9186a65ab44db97d26216c4a3b56209f1bc3978365a0db71a70b5bd780d27aa4a44c346c07da81cfb98334bc4546624ef726e567a56cd2a7db0

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        4KB

                                        MD5

                                        147355f340872ff4169a32452de53c3a

                                        SHA1

                                        201304e57a6cb27fb747ad91e25c32d0a60e934c

                                        SHA256

                                        9b2f89321cebafa06ac18eea39a45406aa10c85f081cccf8085586909750bd16

                                        SHA512

                                        1b2a0a56dc511fd30af08b63ea82acdcb0a39e439f0a664da5ae1f9ba80028009e7a048333a855caf6737b54eef8df0472a1425c566b023ea6a8d943ee61f282

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        4KB

                                        MD5

                                        8010700ab598e70f6038edd1e00895a3

                                        SHA1

                                        6c49c900c7124bee5a49808586bdc17e6dcf90c3

                                        SHA256

                                        5326619a86ff9c239836deee76f3273b1a4dbf7f9dcd285c786b6ed702748f2f

                                        SHA512

                                        127e6e30f23398ff4f6d0e5915df57f05cff9faf6d4d40097a2dcd30e8294638e1c138ad612eeef525ad19b00f806ba2fc8a0b4c09dcee66fb4fb55792ea0669

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
                                        Filesize

                                        11KB

                                        MD5

                                        4d77676b697c5305e76f7a507361c1a0

                                        SHA1

                                        641875e7da482f54bdca1aee413addc789a94c97

                                        SHA256

                                        aad1be5de58e4084ab9eb202c83031e361c0441388f3de249c0daaa5f55ae7db

                                        SHA512

                                        1b4ce4e7062679cc8bf4b6f0e80b0143d58f815924a8adee87302f5fdf613351a56e4eb0b893293bd170f5eb230ba6c567fd7f9f5caab99ced2244ec21cb83f0

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                        Filesize

                                        192KB

                                        MD5

                                        c8f3cbcb749ff8f81f81901354331d7b

                                        SHA1

                                        9b26198b8d5d4fe209c67cb76004c68daed51c1f

                                        SHA256

                                        2814b6b35ca1578e74ab3a0528b9d940a737748a645d63ab5cd88c7f64535339

                                        SHA512

                                        471a5bc9bbd2b708a5f99a5510c68a8cc2bf832cc41b36e97023cc7ea19d261b79ddfd726153e0da034c68086cc59be3108acb89ed7a7a6c03ce96a8907751d5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                        Filesize

                                        184KB

                                        MD5

                                        0ed2663971e8051b2bcb574926400fa8

                                        SHA1

                                        467756bf41c377bdb07c8be10d5391f1df1d80a7

                                        SHA256

                                        0c44c9887ebd30506041e4f483422673660df0b74c7468b0cab2c69bee1f4e8c

                                        SHA512

                                        e521f02d0a4dc70e3bb33747c5113c76f18f15b4370826ef13700c4f559c8b158ed1d8ef79d7d88794bfea61496a75d653237391f2f8b5e53d8574a21f113898

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                        Filesize

                                        20.6MB

                                        MD5

                                        cb8b508d250e371fab92e3779112dfe1

                                        SHA1

                                        b172cdcaec8e7eb6e94d223a01251f5144546d9a

                                        SHA256

                                        3ebac4836fb7d1f70e5c73c1025dbdc77cfbae7e52eab4330f29f2bb99a996e0

                                        SHA512

                                        cfe7d91127d880e13acc2d3b52bfeb97e7e7726106c70cc5efcb425b04529cae39c0e093b63751d83071df079fdc3873f222f0957142909f371f66590dc1e339

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\@[email protected]
                                        Filesize

                                        1KB

                                        MD5

                                        e102dfcea02d82dea0e15903a291d79d

                                        SHA1

                                        b3e6ee1603374eaaec2dfebf7f48a7004b9084c0

                                        SHA256

                                        3407ccade11f1ff39b36eab066403143bffb2aaf743d2441bf7ecf0fc9c77ed2

                                        SHA512

                                        b38d6d988d78755e822f83340d6249c7bda4806b1de3dd2e513dd0065c50a024f5821d32d1b1f03cc8af62ead29b3e6dc2c3aa1ec047cca25385a257e2b9d7d7

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                        Filesize

                                        933B

                                        MD5

                                        7e6b6da7c61fcb66f3f30166871def5b

                                        SHA1

                                        00f699cf9bbc0308f6e101283eca15a7c566d4f9

                                        SHA256

                                        4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

                                        SHA512

                                        e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\@[email protected]
                                        Filesize

                                        240KB

                                        MD5

                                        7bf2b57f2a205768755c07f238fb32cc

                                        SHA1

                                        45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                        SHA256

                                        b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                        SHA512

                                        91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\TaskData\Tor\tor.exe
                                        Filesize

                                        3.0MB

                                        MD5

                                        fe7eb54691ad6e6af77f8a9a0b6de26d

                                        SHA1

                                        53912d33bec3375153b7e4e68b78d66dab62671a

                                        SHA256

                                        e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                        SHA512

                                        8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\b.wnry
                                        Filesize

                                        1.4MB

                                        MD5

                                        c17170262312f3be7027bc2ca825bf0c

                                        SHA1

                                        f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                        SHA256

                                        d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                        SHA512

                                        c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\c.wnry
                                        Filesize

                                        780B

                                        MD5

                                        93f33b83f1f263e2419006d6026e7bc1

                                        SHA1

                                        1a4b36c56430a56af2e0ecabd754bf00067ce488

                                        SHA256

                                        ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

                                        SHA512

                                        45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\msg\m_bulgarian.wnry
                                        Filesize

                                        46KB

                                        MD5

                                        95673b0f968c0f55b32204361940d184

                                        SHA1

                                        81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                        SHA256

                                        40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                        SHA512

                                        7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master\RANSOMWARE-WANNACRY-2.0-master\Ransomware.WannaCry\msg\m_finnish.wnry
                                        Filesize

                                        37KB

                                        MD5

                                        35c2f97eea8819b1caebd23fee732d8f

                                        SHA1

                                        e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                        SHA256

                                        1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                        SHA512

                                        908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                        Download Submit

                                      • C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.V-TKjBtD.0-master.zip.part
                                        Filesize

                                        3.3MB

                                        MD5

                                        017f199a7a5f1e090e10bbd3e9c885ca

                                        SHA1

                                        4e545b77d1be2445b2f0163ab2d6f2f01ec4ca05

                                        SHA256

                                        761e037ee186880d5f7d1f112b839818056f160a9ba60c7fb8d23d926ac0621f

                                        SHA512

                                        76215a26588204247027dcfdab4ea583443b2b2873ff92ad7dd5e9a9037c77d20ab4e471b8dd83e642d8481f53dbc0f83f993548dc7d151dead48dc29c1fdc22

                                        Download Submit

                                      • C:\Users\Admin\Videos\Captures\desktop.ini
                                        Filesize

                                        190B

                                        MD5

                                        b0d27eaec71f1cd73b015f5ceeb15f9d

                                        SHA1

                                        62264f8b5c2f5034a1e4143df6e8c787165fbc2f

                                        SHA256

                                        86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

                                        SHA512

                                        7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

                                        Download Submit

                                      • memory/316-2431-0x0000000072B60000-0x0000000072BE2000-memory.dmp

                                        Filesize

                                        520KB

                                        Download

                                      • memory/316-2522-0x0000000000B90000-0x0000000000E8E000-memory.dmp

                                        Filesize

                                        3.0MB

                                        Download

                                      • memory/316-2461-0x0000000072A00000-0x0000000072A22000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/316-2432-0x00000000727E0000-0x00000000729FC000-memory.dmp

                                        Filesize

                                        2.1MB

                                        Download

                                      • memory/316-2435-0x0000000000B90000-0x0000000000E8E000-memory.dmp

                                        Filesize

                                        3.0MB

                                        Download

                                      • memory/316-2433-0x0000000072A30000-0x0000000072AB2000-memory.dmp

                                        Filesize

                                        520KB

                                        Download

                                      • memory/316-2434-0x0000000072A00000-0x0000000072A22000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/316-2460-0x0000000072A30000-0x0000000072AB2000-memory.dmp

                                        Filesize

                                        520KB

                                        Download

                                      • memory/316-2462-0x00000000727E0000-0x00000000729FC000-memory.dmp

                                        Filesize

                                        2.1MB

                                        Download

                                      • memory/316-2459-0x0000000072AC0000-0x0000000072B37000-memory.dmp

                                        Filesize

                                        476KB

                                        Download

                                      • memory/316-2458-0x0000000072B40000-0x0000000072B5C000-memory.dmp

                                        Filesize

                                        112KB

                                        Download

                                      • memory/316-2457-0x0000000072B60000-0x0000000072BE2000-memory.dmp

                                        Filesize

                                        520KB

                                        Download

                                      • memory/316-2456-0x0000000000B90000-0x0000000000E8E000-memory.dmp

                                        Filesize

                                        3.0MB

                                        Download

                                      • memory/884-447-0x000000000A460000-0x000000000A7B0000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/1260-394-0x0000000010000000-0x0000000010013000-memory.dmp

                                        Filesize

                                        76KB

                                        Download

                                      • memory/1260-371-0x000000000D710000-0x000000000D8A0000-memory.dmp

                                        Filesize

                                        1.6MB

                                        Download

                                      • memory/1260-391-0x000000006DFC0000-0x000000006E017000-memory.dmp

                                        Filesize

                                        348KB

                                        Download

                                      • memory/1260-411-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/1260-386-0x0000000007A50000-0x0000000007A5A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/1260-369-0x000000000D2E0000-0x000000000D70C000-memory.dmp

                                        Filesize

                                        4.2MB

                                        Download

                                      • memory/1260-355-0x0000000006E90000-0x0000000006EE6000-memory.dmp

                                        Filesize

                                        344KB

                                        Download

                                      • memory/1260-375-0x0000000008380000-0x00000000083F4000-memory.dmp

                                        Filesize

                                        464KB

                                        Download

                                      • memory/1260-430-0x000000006F2B0000-0x000000006FBE8000-memory.dmp

                                        Filesize

                                        9.2MB

                                        Download

                                      • memory/1260-376-0x0000000008410000-0x0000000008760000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/1260-366-0x000000006F2B0000-0x000000006FBE8000-memory.dmp

                                        Filesize

                                        9.2MB

                                        Download

                                      • memory/3360-492-0x0000000010000000-0x0000000010013000-memory.dmp

                                        Filesize

                                        76KB

                                        Download

                                      • memory/3360-469-0x000000006F0A0000-0x000000006F9D8000-memory.dmp

                                        Filesize

                                        9.2MB

                                        Download

                                      • memory/3360-472-0x000000000CED0000-0x000000000D060000-memory.dmp

                                        Filesize

                                        1.6MB

                                        Download

                                      • memory/3360-489-0x000000006DFC0000-0x000000006E017000-memory.dmp

                                        Filesize

                                        348KB

                                        Download

                                      • memory/3360-505-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/3360-493-0x0000000009900000-0x0000000009910000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/3360-533-0x000000006F0A0000-0x000000006F9D8000-memory.dmp

                                        Filesize

                                        9.2MB

                                        Download

                                      • memory/3692-2-0x00000000058F0000-0x0000000005DEE000-memory.dmp

                                        Filesize

                                        5.0MB

                                        Download

                                      • memory/3692-19-0x00000000730EE000-0x00000000730EF000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3692-20-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/3692-18-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/3692-0-0x00000000730EE000-0x00000000730EF000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3692-17-0x0000000006970000-0x000000000697A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/3692-16-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/3692-21-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/3692-15-0x0000000006410000-0x000000000644C000-memory.dmp

                                        Filesize

                                        240KB

                                        Download

                                      • memory/3692-3-0x00000000053F0000-0x0000000005482000-memory.dmp

                                        Filesize

                                        584KB

                                        Download

                                      • memory/3692-28-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/3692-1-0x0000000000640000-0x0000000000A8C000-memory.dmp

                                        Filesize

                                        4.3MB

                                        Download

                                      • memory/4692-2481-0x00000000719C0000-0x00000000720AE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/4692-2464-0x000000000DCE0000-0x000000000DE70000-memory.dmp

                                        Filesize

                                        1.6MB

                                        Download

                                      • memory/4692-2463-0x000000006DC00000-0x000000006E538000-memory.dmp

                                        Filesize

                                        9.2MB

                                        Download

                                      • memory/4692-2516-0x000000000AF40000-0x000000000AF53000-memory.dmp

                                        Filesize

                                        76KB

                                        Download

                                      • memory/4692-2517-0x000000006DC00000-0x000000006E538000-memory.dmp

                                        Filesize

                                        9.2MB

                                        Download

                                      • memory/4692-2477-0x000000000A870000-0x000000000A880000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4692-2483-0x000000000D490000-0x000000000D7E0000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/4692-2468-0x000000000AF40000-0x000000000AF53000-memory.dmp

                                        Filesize

                                        76KB

                                        Download

                                      • memory/5116-27-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5116-35-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5116-37-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5116-46-0x0000000008F30000-0x000000000945C000-memory.dmp

                                        Filesize

                                        5.2MB

                                        Download

                                      • memory/5116-47-0x0000000008E00000-0x0000000008E22000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/5116-48-0x0000000009490000-0x00000000097E0000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/5116-161-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5116-162-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5116-163-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5116-339-0x00000000730E0000-0x00000000737CE000-memory.dmp

                                        Filesize

                                        6.9MB

                                        Download

                                      • memory/5508-1184-0x0000000010000000-0x0000000010010000-memory.dmp

                                        Filesize

                                        64KB

                                        Download