wannacry | hxxp://google[.]com

Analysis

max time kernel
566s
max time network
567s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD201D.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Executes dropped EXE 56 IoCs

pid	Process
800	taskdl.exe
1768	@[email protected]
4512	@[email protected]
2144	taskhsvc.exe
1468	@[email protected]
2948	taskdl.exe
4688	taskse.exe
1712	@[email protected]
4812	taskdl.exe
2960	taskse.exe
4000	@[email protected]
2784	taskse.exe
2764	@[email protected]
4676	taskdl.exe
2108	taskse.exe
696	@[email protected]
3452	taskdl.exe
1624	taskse.exe
940	@[email protected]
4528	taskdl.exe
2916	taskse.exe
824	@[email protected]
4136	taskdl.exe
2376	taskse.exe
624	@[email protected]
2924	taskdl.exe
2024	taskse.exe
2988	@[email protected]
800	taskdl.exe
4296	taskse.exe
1328	@[email protected]
4604	taskdl.exe
3944	taskse.exe
4608	@[email protected]
724	taskdl.exe
3844	CCSetup.exe
724	CCSetup.exe
4640	ISBEW64.exe
5008	ISBEW64.exe
4804	ISBEW64.exe
1564	ISBEW64.exe
1032	ISBEW64.exe
5264	ISBEW64.exe
5296	ISBEW64.exe
5332	ISBEW64.exe
5364	ISBEW64.exe
5396	ISBEW64.exe
5436	taskse.exe
5444	@[email protected]
5492	taskdl.exe
1628	taskse.exe
4908	@[email protected]
2084	taskdl.exe
2480	taskse.exe
3532	@[email protected]
628	taskdl.exe

Loads dropped DLL 15 IoCs

pid	Process
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
724	CCSetup.exe
2628	MsiExec.exe
724	CCSetup.exe
724	CCSetup.exe
724	CCSetup.exe
724	CCSetup.exe
724	CCSetup.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4828	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\laliykmzxf220 = "\"C:\\Users\\Admin\\Downloads\\Ransomware.WannaCry\\tasksche.exe\""	reg.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	CCSetup.exe
File opened (read-only)	\??\T:	CCSetup.exe
File opened (read-only)	\??\U:	CCSetup.exe
File opened (read-only)	\??\Y:	CCSetup.exe
File opened (read-only)	\??\H:	CCSetup.exe
File opened (read-only)	\??\I:	CCSetup.exe
File opened (read-only)	\??\J:	CCSetup.exe
File opened (read-only)	\??\N:	CCSetup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	CCSetup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	CCSetup.exe
File opened (read-only)	\??\Z:	CCSetup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	CCSetup.exe
File opened (read-only)	\??\S:	CCSetup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	CCSetup.exe
File opened (read-only)	\??\V:	CCSetup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	CCSetup.exe
File opened (read-only)	\??\L:	CCSetup.exe
File opened (read-only)	\??\P:	CCSetup.exe
File opened (read-only)	\??\R:	CCSetup.exe
File opened (read-only)	\??\E:	CCSetup.exe
File opened (read-only)	\??\W:	CCSetup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	CCSetup.exe
File opened (read-only)	\??\B:	CCSetup.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
192	camo.githubusercontent.com
193	raw.githubusercontent.com
216	raw.githubusercontent.com
217	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
409	api.ipify.org
413	api.ipify.org

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133731627303637172"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878641211-696417878-3864914810-1000\{A6A14241-DED5-4B2D-8C69-3C54C2957193}	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4552	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5040	vlc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
640	chrome.exe
640	chrome.exe
4688	chrome.exe
4688	chrome.exe
4688	chrome.exe
4688	chrome.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
2144	taskhsvc.exe
3560	msedge.exe
3560	msedge.exe
4344	chrome.exe
4344	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5040	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe
Token: SeShutdownPrivilege	640	chrome.exe
Token: SeCreatePagefilePrivilege	640	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
1468	@[email protected]
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of SendNotifyMessage 57 IoCs

pid	Process
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
640	chrome.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
5040	vlc.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
4512	@[email protected]
1768	@[email protected]
4512	@[email protected]
1768	@[email protected]
1468	@[email protected]
1468	@[email protected]
1712	@[email protected]
5040	vlc.exe
4000	@[email protected]
2764	@[email protected]
696	@[email protected]
940	@[email protected]
824	@[email protected]
624	@[email protected]
2988	@[email protected]
2188	OpenWith.exe
2372	OpenWith.exe
1328	@[email protected]
4608	@[email protected]
5444	@[email protected]
724	CCSetup.exe
724	CCSetup.exe
4908	@[email protected]
3532	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1156	640	chrome.exe	83
PID 640 wrote to memory of 1156	640	chrome.exe	83
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 2536	640	chrome.exe	85
PID 640 wrote to memory of 4452	640	chrome.exe	86
PID 640 wrote to memory of 4452	640	chrome.exe	86
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87
PID 640 wrote to memory of 4852	640	chrome.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1864	attrib.exe
3432	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xe8,0x104,0x7ffb5ea7cc40,0x7ffb5ea7cc4c,0x7ffb5ea7cc58
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2864,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3068,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3060,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3336,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4856,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4992,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5420,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5412,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4916,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4972,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5508,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5444,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5288,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6020,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6064,i,16208900489992131476,1286162245985520716,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x380
1⤵
PID:2632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5100

C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Downloads\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:2972
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1864
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 301361728689296.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4272
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3432
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1768
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1256
- - C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4512
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2948
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4688
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "laliykmzxf220" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "laliykmzxf220" /t REG_SZ /d "\"C:\Users\Admin\Downloads\Ransomware.WannaCry\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4552
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2960
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4000
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2784
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2764
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:696
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1624
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:940
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:824
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4136
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:624
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2924
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2024
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2988
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:800
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1328
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4604
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4608
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:724
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5436
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5444
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5492
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4908
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2084
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe
  taskse.exe C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480
- C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3532
- C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:540

C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]
"C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\MoveMerge.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5040

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\@[email protected]
1⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault910efe07h9b95h4eeahb2dbhab3d25ee1fef
1⤵
PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb526c46f8,0x7ffb526c4708,0x7ffb526c4718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16203178779570342549,13308747356094814462,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16203178779570342549,13308747356094814462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16203178779570342549,13308747356094814462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xb8,0x11c,0x120,0xf8,0x124,0x7ffb5ea7cc40,0x7ffb5ea7cc4c,0x7ffb5ea7cc58
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3404,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3712,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4564,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4800,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4988,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:4304
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff785174698,0x7ff7851746a4,0x7ff7851746b0
    3⤵
    - Drops file in Program Files directory
    PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4412,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4792,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5560,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3508,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3580,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:3696
- C:\Users\Admin\Downloads\CCSetup.exe
  "C:\Users\Admin\Downloads\CCSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3844
- - C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}\CCSetup.exe
    C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}\CCSetup.exe /q"C:\Users\Admin\Downloads\CCSetup.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}" /IS_temp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17A01C90-9059-46BB-A3E3-2ED79E8B6112}
      4⤵
      Executes dropped EXE
      PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{69A5FF63-ACE8-479B-B10F-A627CD67F7E6}
      4⤵
      Executes dropped EXE
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8934F3D8-0323-4F4E-97FA-AADEA94B4A0E}
      4⤵
      Executes dropped EXE
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C6B228C-1801-4892-B40A-AE6F7B355220}
      4⤵
      Executes dropped EXE
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8EC3458-CF29-446C-BCAF-1A35BC971270}
      4⤵
      Executes dropped EXE
      PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59084DD3-CB3C-4747-95F1-186892533A4A}
      4⤵
      Executes dropped EXE
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26021E82-676D-4BA4-AF79-2B9D3CC88503}
      4⤵
      Executes dropped EXE
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7DFF5C1-5B89-46F4-AA0D-3EF24F3EA7FA}
      4⤵
      Executes dropped EXE
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8C7E1047-0896-487E-93D1-177943922390}
      4⤵
      Executes dropped EXE
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8BACE0AB-D50A-422D-859A-11630684707A}
      4⤵
      Executes dropped EXE
      PID:5396
  - - C:\Windows\SysWOW64\CMD.EXE
      CMD.EXE /C driverquery /v >C:\Users\Admin\AppData\Local\Temp\drivers.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
    - - C:\Windows\SysWOW64\driverquery.exe
        
        driverquery /v
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5656,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4448,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5700,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5960,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6212,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6228,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6392,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5752,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5736,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2832 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5804,i,8598105482381687344,12697241288625171539,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:6116

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:884

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
PID:2680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C73E9F3589CABF07E3723F5246665E88 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
186ccc6761714f7e88de1fff069b95fb

SHA1
c7dec1fff5e2f359cccf94875265f96757865b34

SHA256
abb5c7113a03fa5d3a4d6d25007f875d5189c85054252a03a3c9d2cc64a5f59e

SHA512
5f346abd0068d56df1bc7236a8f8ae6e0397cd35c7e8a6554f90724bc4936ed6a1f127aef797391d34ab458ba9ff3337bade05334155aae7473e6c463b0499c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32b67475-7705-41ac-9e21-6f5011aa04fc.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
37KB

MD5
1b6703b594119e2ef0f09a829876ae73

SHA1
d324911ee56f7b031f0375192e4124b0b450395e

SHA256
0a8d23eceec4035c56dcfea9505de12a3b222bac422d3de5c15148952fec38a0

SHA512
62b38dd0c1cfb92daffd30d2961994aef66decf55a5c286f2274b725e72e990fa05cae0494dc6ad1565e4fbc88a6ddd9685bd6bc4da9100763ef268305f3afe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
37KB

MD5
fed3d674a2f247d846667fb6430e60a7

SHA1
5983d3f704afd0c03e7858da2888fcc94b4454fb

SHA256
001c91272600648126ab2fd51263117c17f14d1447a194b318394d8bb9b96c5d

SHA512
f2b9d820ac40a113d1ab3ed152dfed87322318cd38ba25eb5c5e71107df955b37448ab14a2779b29fce7ebd49cc0bbafbd505748786bc00cd47c3a138aefdddc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
20KB

MD5
a6f79c766b869e079daa91e038bff5c0

SHA1
45a9a1e2a7898ed47fc3a2dc1d674ca87980451b

SHA256
d27842b8823f69f4748bc26e91cf865eceb2a4ec60258cbca23899a9aef8c35a

SHA512
ed56aaa8229e56142ffa5eb926e4cfa87ac2a500bfa70b93001d55b08922800fe267208f6bd580a16aed7021a56b56ae70dae868c7376a77b08f1c3c23d14ab7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
19KB

MD5
7eab02c9122098646914e18bd7324a42

SHA1
5e2044e849182f1d3c8bcf7aa91d413b970fc52f

SHA256
d58d66c51a1feb9af55ba4a2dcf2c339b7976dd011fbd5d071ca86b9d7f58a42

SHA512
dbb0f94de62d7d77d4bfe6c298043c559a0d4bc117bd7dc1d627caabffa8e712cec5e3adb4a737b350429493ac0ebfb81c8759aebed41b30218d0e7ff6f3196f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
59KB

MD5
02240241c502c60a601fea4d1ddf616c

SHA1
654602ee1bbdcade5912f9b727473f592ddc3237

SHA256
2c57c29f743821138afdd7d3e75f38f4b3912f60bb7a3c5e0170bd79adc1709a

SHA512
8b135da031724d41b7ed6fc4e6b78568c915f900a9ad35f09f98cdffe58d0f1e611232b46c78c1fc0eec6acdbaff1822887e2cdfff2ffe6aa3f5fd897261b62e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
17KB

MD5
89b14043a36def333f547e45b88b36be

SHA1
7729f36422740316ae722cfe5b6e5fe3d731d021

SHA256
e13e0d24952c346806b3c5bfda2626f51886baf807f96f58efc82a6d88b00e81

SHA512
3489698d642de8232fff37b4e289110670dae623f98222dc4635ca0e6e4252911a7d499169dbd37cc8e9e777d0ce410ff7176c50e7b0dcfee8b2a67a429315fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
99KB

MD5
b6b2fb3562093661d9091ba03cd38b7b

SHA1
39f80671c735180266fa0845a4e4689b7d51e550

SHA256
530eb1f6d30ce52b11c3844741721eed669decc69060854ddb6666012c6e9e20

SHA512
7c3f88910bb87eb58078104290d0a6fc96bb34705974bf93e6dffd928160a9f28e34d879f015f0a05754f56aeacc462e27ba3f332e9dddd6e3879c5d97db5089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
38KB

MD5
bf95b000a1f52c689cebc5fa260f201e

SHA1
ebe21a68dd7d8321b540757f246ed6e10a18683a

SHA256
0abded4712a9ab59e84a24ec40179ed475eded446a082584d22c2f7708db6c40

SHA512
151752d4174ff487b3895535521e38071a729e7853b3b2605928b14350ff4106d2d73aae14f7c9a69843d417648a2dfcb9b295a254391c18d99f354c39e8c32b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
273KB

MD5
78b3212ae74e0e14cde6bb9cf032e03d

SHA1
b75641e3d5934e7bbdab538df84b615437417cd8

SHA256
9df6ac648bea04064976af64e4a433019c4b61593da6e6bde99950e826920811

SHA512
33ff9a9f7f60fcc7d386f3d2429fe45ba05eb264f633c6c8949099396eff15c05b66b66b03b3b280ae71947adc5bbe09c874e9dbcd72aea05a502d8a7249b8f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031

Filesize
954KB

MD5
1d17b5bb3dc45ae65cb09b037d2a447f

SHA1
a03c630c514c5c0433a8b772ec8e23aebe2ec40b

SHA256
fac66650be9c20054107bc928a3fef2b18e5d579a7179315e0034745c62d3eec

SHA512
9b7455cec1e55e71a754132ce932669fa524ea3e77d09a92b81d4c842292b9e7af562a539d92f15d06efe63e3ebf5f243757b560f2beff3b7bda7552a3be0be8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050

Filesize
19KB

MD5
ca39c956585ff3441ed99f219a95908e

SHA1
c17d8ac3a1fa156abb4d7d6f4799bbabc09966b1

SHA256
c23e03e141a70b1967f6d62a272ecbc588655211752e250f9173bebcc61127df

SHA512
57b5cbce513d2f1c698e4ca82cb9b2ba1c26d7b80f21e4efa77493d0053943bd5a8eaedc3dccb23192c0145dc411a99a86356777e95afa78ac616ce3f5189a5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000064

Filesize
3.4MB

MD5
fe50297191b241c60616f04e2febb8bb

SHA1
27db17dc474df0a37ddbbb335d7b5802e671c77c

SHA256
e8adc6e787862b84a865b06a8efaecb272f618cc8733b9ae686496418ba6b35b

SHA512
452779d3d3b2b7c9e086f2921b7bf03250492f1514453bc173c76376d6b988380c807af7e7692fd68983c08fd312c85dc70026a354b20a0388dd0967f330444f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
c8f0528a38d88db0440a711d41b25925

SHA1
b31cb0169e7e84ae37c39903d495666e21a1a433

SHA256
14c36864b83260767dd987c09722de1aa945151e57a1d85c727d0e69bab9f2b5

SHA512
01c960dd2aa4703f0f8c1d1ff6d39dc67cd5b45d1e8408ef5aadd9a16b8506ad290117335e3218afc2eb296216bdc1a9db77c826e6df2ab8c9571cdfdfd858fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
3caaddc2769ca4abe7f9c3fb0bbdcbcd

SHA1
e3c825c7b4242d9a79ceb2f3e89ce0ed24fb2ca0

SHA256
2e43b929590e3122988e237ac528eab57bb63549a4120971c643ac0d376d2f6e

SHA512
8bb7f399814f0cd91a58d66531911691094d991eb0f5e6cd39ae5d5beae143c138f1f24766706d81d270e04b8e63a8d4add8b0449f8f604e2abfff66ee6fe1d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
8KB

MD5
fdeab76f8e79817603bab112b50e2708

SHA1
1e490a868a0568d27169a81c3100c9729f52fbee

SHA256
f531a893170df25bef7e48b2ef12e306d6097918eeb33c6916a61cee736821ff

SHA512
bdcd139dc6eaaf2058baf5fe5797bdecd51c3998ff387bde3e9d0fbc432a6c87f67f0a2b0a4e848b0de4aa2a9be6677c0fe4d5c09acfa0f8e2e3262a50b21c7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f2f08.TMP

Filesize
8KB

MD5
11250ea5d6270a7d06d361bce5f26eff

SHA1
ce60225b6d4fd549186d466eee0b04c866400f79

SHA256
4b4c7b85b711436c6f5e420f77ce90bd3c2e8c2d5b68f5949ffb3683df959bbb

SHA512
f5c43a10273faad99d27b81b8a33fbf862d2d3f1948f2c2cc6f69c5a8f3ebe0acf083cf8beace9388d014464e181d17f48826fb4bba138fa5135972b86b366de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
e44116db2bae21e86666389fa8ac28e8

SHA1
30a3211b0b79f3aea3482ef830486ccb66faf6b0

SHA256
7acf57edf73c6712726861090931bc5099bb4297746e57be6091938606554d47

SHA512
98c08b72bcce253d643f6e550600669e38ffb5059b1ee2480e9ff4a2f4f57015e3ec6156129ac8912083d8074d2448a07b14c8cf273c2e4c03ed40bf1b745a73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.reddit.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_x.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
f103ba66dec1e8434ea6eeec623b655f

SHA1
90ea1ec0ecff33e23039f1200023bf6a14b803b5

SHA256
ead3c5560d72b8866908d58a5fb7a12e186ae976ee176aacbcc0e10fdd8920b2

SHA512
edc914568c0308e783c3487dd01e4b7e58a58c6e383b2b9c2049b75f66493299aaea561b177a893d4e59e364138ed680a499f0aa588873cbf47c2e872ed63ec5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
779dcc37e4a09a83c309165c7b10396f

SHA1
f8399e7f300e5af61196fdf3a9e07e4f51375af6

SHA256
a5287b09cb6fa09e0aad2f3ffb4dd4de2b1815429235f44b34198cb04d358428

SHA512
75077283ddd596376520f1765cfc8f12eee07f2ac276645608de040fbb8a8799ddb58e8ed6914397ebb8b65bf51541d4c38fc3f7e70ca1866dce5b7a3024eaa4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
1d54c4467428764a3d8dd2dcaf699554

SHA1
00abe58f95212fd76575182c3cf269e93d1e964c

SHA256
036e78ee16c4725a26bdad24221e77e752214507387b652e13b5b10e2e4e05f2

SHA512
2ff7005c7bb556525221c15de15f6144ac1c91b96c634225189730e5b5b6895281d3a389a1c70f132ce3a1ee2c1fdd547a81be0d76071503b92b49a26d30f271

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
8f10f3244afadde05eac59207f28f356

SHA1
e615bbd21ade47ad7ae7bef5978ad84d233f92a3

SHA256
9086691aa93fffd30a7ad5bad30e48c4af7e764ec64a6b581cb6774a7db57f5d

SHA512
471b50cc92f46ddd0e1eb853309c09600cc60e2779c34e67909cc478ce593470dc39fcbcbe49cba67c585cb1601f20a1a43258a36e9469ce4f8a7fbe43ada8e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
37f3a9838324ff8e0af6766bb68e47cf

SHA1
2add888793d5fb8de4fbd76e8947c5f2d205e2b0

SHA256
c523f00be9a0fc72a4ef3c797c1129539dd55934c66010fd49098217febf65b9

SHA512
c5fa227a6fb6ab0cbb6c0435a2b35cddaef575cf1e9bdc422e0cdb74af3a137fd0b59bb6baa98d6c3f655ac6ee17a7fec947c5269f747309bf3eb26564bf8a59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
30ac3ec9bce2a937c8d62c86584b3b7c

SHA1
8a5f1c13bacdb4121edc61526e3537d78a2497ee

SHA256
1284845d69d970fe9674924683fa5dfd0174b33ce738cefe7f9c9b9b88f5fae2

SHA512
17c87dbb142e032ffc78d1a2a93b9e037b8b64fb05feb26f3f008d4882751eb242bdd99b8fc07b59cdab6adf508ada4fde8698e99836e54d3eeddfc6a6ffdaa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
340458d86db701fd8b1b87741b7c1e50

SHA1
4e10a56ba0980276eae8d2af6f08f1f21c2c5cd1

SHA256
1d2c9288d534a571bd8a1e281f45b1cd1c108a1ea2f4a7586b28c1fee56ac05d

SHA512
e31625bb695b274e470758dcfc0846576d40d5337ebdea941a49ad10a4f85de3a2c4f70b9bdb9fd9eb5bef2cd479e938c569a9347f58ba61f4bb7007a16545c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
1ddf15b248d738ef89860fa94d049607

SHA1
46035f9767f75129042436e36a032006674a463b

SHA256
95fb1403bd1f456b2023a2690848a1cb90c6b5435878e3be368cb50a8e3b3965

SHA512
4f8b7f41fedb44a44469ec272cde57cfa790cc88eaeb2ef69d6dfcb7a6a384e3e8047fa23d47a092b62424ef3d0947d044bb47e6f87bde48786dd34c5681b609

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
2a16b130fe906c417790a4c434c1e042

SHA1
689c8065f056eaee1df4447101ea77e915dbdda0

SHA256
c68528cae2189e33e76b26b86fbd5f70444ea57f5471acc79c77c5ee987514f2

SHA512
20787a31e0471558c3eb21523a61e95726ba09a73fa11ad503dcfefcc704abd2fb77afcff7ca256c6e43c6fbd2af72b96ac19dc92a28c40841168e98b2cc12d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c98d3bf590bf3f292a63d997cbe6ff0b

SHA1
fa30f719d0fa019bfae8ac49a370211861e7dce2

SHA256
0716610a9dfc760dd7527339ab4a57f7d118b12dfc82a66a179be7a397dca332

SHA512
02b4ed134bc804060b17c938f9020c4547802fc2c86a1d68e136b46f839838302ea2bb5863b213117d667f90647f140047cde9f372b6b612be24c602deb52963

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
7719474b3348344c56dc15535c2e4602

SHA1
9d2e21319ac1cef9f5d1b79913f930df1230fd99

SHA256
e4e3f783b3ec286a09ed581b5e724ace673d54ab58a7189f83b807ce86b65693

SHA512
7254201f3615faa171d307457afd1ce3fd0721f027000b40bd1c94a35bf53036f298bf87606b8b39b9ce276da97ea376eec35047ef086aa8dcaa573dc3b12ae9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
82ab3576753c01ac7378a48e91f49cf2

SHA1
841f69ca22f77f10a19b0b3bc959e6c46f14bfb4

SHA256
67378b89a376c1ca1f259e3bde112b2960f5b5d5dc395b86f22329b70805e0d2

SHA512
078a399e493e483ae3ca075b0e3c885d2a1f1e65e758902aea21738fd38f5bb95edbb610bd7322da2387e4bc49b901e1c5477b062103455e6a85fe3ee54aa627

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
ee54de4197e7dfaed3ee6975cfd698d7

SHA1
5dcc1270ce1cfa9ca9a1998ff5a860f49f250fb7

SHA256
702a1920c3a707f4c8efd9ad124f8e3466ca5777415aa22ffba1d2047425e663

SHA512
e83c03b29001689e92f541aeca0a54f16c26b1fd84d7715bb7959fbc844fe7e25efee3695d66124d2353c4cfd8c2291de3c8ef9e3866760dca64b509f1e2f1c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1dc39fc079bb6a77c88e2c818b8c5532

SHA1
68df482de3872735e7c461087339f4e4a4e14a7a

SHA256
16a7a93b65d8a4aa434683952f59e398e5df79f461350c207367c2c3014bf70f

SHA512
f162d271f80f1a98fb21920cb5d7eef719063e1ec0891bf5e67f94bed7ed27ab19a502c6b4f9a528b33468d4fa3b1623db6a208044feebab0a9603a643d357fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
0d269c5fffbc3d912eda45d08d5dbad1

SHA1
5087da7c7b8eeb0481b6f40bf0957703bcbd6197

SHA256
986015ec3702604dfefe9559208513a47b1ddbff12319a575d03f7ce20822f26

SHA512
f393e727a15d6671de371044c52d61cbc282b82129e9d5b4fae0a4884ab7fdff5a12d5ff4f9dd23e10957c219841562a262618682106a0abdd0bfc123eb62f1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
67470f07ff9c52588d0ca2edb79438df

SHA1
bdf21428eb2805b4dac3212a88d54cc9f59b8003

SHA256
4208973eeb334395d025b0abf3316efcc67f940a27e06894564b9d3761ebb8b3

SHA512
815fd34cd63a4790ad240f7d816c42b664b51b56e5602143ace0ed4eef69cd9bbbbc698c10241574e95fa1f23ea7fa9872a5a8dcb7931dcd5d98f53a138bc78f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f83dba4755588137bddcaa0808e36ed6

SHA1
ba82d08f00f73662b90bfabea7421ab8493fe4c3

SHA256
70c1a62ab497d574a4e1fdb2635f3a1972cfc08671f37c62740e25b9eae086c7

SHA512
5661ff60fdc05d13461953f540c1aab5e4b4beb634e0bf228076aed771b6c2d2937c2154fb6a1dd964c4f005053f51c4638401aa4fe9be34896a74b1c91c75cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
a160f3da49311628ddb0dbc87d1f9293

SHA1
87f5e4ed3c1baa123baf10c9372e8e8850b1f009

SHA256
bb14aec8bb07f2b9584ab390a6064d27a28338340296a8e518d86d717fe93ac9

SHA512
f89cf592e4d1ab9dac95fa8c97f0f403593b57dcd2eb123867c4016f79af79fdab27287758947e9bb35434df5e4092b5419131ab136036b41604e19747385330

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1117fd55eb51a35c95f9fc69b200018d

SHA1
ad903657b54ff0c8c43cbc4475de1253fa4da74a

SHA256
926f5deddca8191c1befeb40db810f94109dc64b2a4fd73b28e81c4aba19411e

SHA512
54141409fba4fa1a71557b71649214f62d606b436bed253ee5017510b5d2e3f563fd0e4a39c8c101b45818c11232af87e7ed4f72dc718b2980c742fb17b1fd63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
1b83cc710d5208bad0b15d673dd96a92

SHA1
934a2f0ff9069970ffd75be078bd53f71e67370e

SHA256
85de26898f633ca551ec3e9a224a10b42451713008be44e7b7190fe58071e54e

SHA512
fe1ba7a5eb9fc8f115b9c926e36c71d5363462d467b8c1c6545871b631e0d740ce7478a3a1d1900f20b52fa2daf91bd0c1f9a3ca83ca86874e1a5f236710073e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
744634d5592671d5271dc8d436c979fe

SHA1
798739b4673222be61522ba2fdfe8f0ed99d6c89

SHA256
162c12158d361327e6ca25e8514b11d57f9d6cf26218a1b94516c39ad1e3b8ec

SHA512
c016a7ffe15229d49b61d20685a047afd2f2788b99dbf2ddb3c943ab3bc378cb4a4f0e3fcb12cfa6efd458245197cee36be110260a4defe348b050ba15478515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
caa7268dff01af3e8309fe7e0d5c3816

SHA1
3991117753418067ba18f7dacb51399bbdbc7d0c

SHA256
44ae06f377830e2e5a1734d8531a2b17fea9522711e70baf4e29216ae4fbee2f

SHA512
19959cc671e491ce08040f7dac95074c742effa0136a244afc75ab919f1c5cc9d36cfb36f8d7ebde9100749d9a8bc52e3b30077ee84300e1a737f7fc3d392df9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
49999792dacc67796dcacb4ec4ef52d0

SHA1
1750fc413990d237604858ee268fa3fd32ac69cb

SHA256
fa0aa2577331da7ea72d6b0b41005c5f412b819a3416f752ca76cd1ccc0cca16

SHA512
150ed4ab0a51e355590888c4c01f09abf54993da9f4f4ea43c08f9029497e9c8188c197b31f5216dcf1d966d7bf7555ffef8c071bd0abf9f72e4abdea019e7ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
eaac8e5ef56558982b12ce797fa2b51a

SHA1
759b4ce94a72e84c5cbe04e29901f3010764a86b

SHA256
336283a85b73444f940343302408022dd26cc61756bc3f850147dbd196d4d824

SHA512
d7893bd8a41fff91d323673d0374231b76a9768fe7f7b160d641c134679942637e466d1010a22556ffa45a0a165f42bd75cfa50c69934df71d39b3c4354b9574

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9754e083a382db00d4af43efca94e409

SHA1
380d1d559c1bdc1549f13d411eaacc1787784d04

SHA256
9eed33d13b3a3e196bdc208902a82bc0b9cc5c76afc73412ba65f48549fea63d

SHA512
10580dafa3c534ac57a024f5fc2dc02598c624cb539d7adc9fd4c8eaf514b0a8bde540286cc8f800a041d109e14b97bd984c1099a3e4a0196c691c354379bfa9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e74c0c61a3d9a1db7e94de545e684d90

SHA1
59a0b455b2b75b2a98bc59312cbc442e54471da1

SHA256
e3d361a29dd88b6ffb3b305b2710c7daa4a408a8fb0cecd942c462828bdbbab8

SHA512
1c49ec17923d14a008ea9eb4ba270db58c140b3e7ed41e7b9f9e0456e6f5f4d385a1610353fc2f6160e03857b1fd6e4728563a65b4b0951e82b5d262bfab68ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
2a9d8b4b0df85f118bb699d82eb08732

SHA1
6e3e8221489c748cbb4dad2da168fd1fb0de3966

SHA256
3615998918e51e5c53ffb1c6c228557ee3813d53b8c3f6ed3d8c6b1cc7b8b258

SHA512
a080bf6febfee118c7a33f558ca16a56bef95643c85ca181a3aa9ad298a84e991062e90ff4b6a6bfbc2895fa0b9da9a0427e1a9ef06af50e32f761c534ac08d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
07ea0c4f5ef6373439857333bcba2164

SHA1
f74792c2fd42b61f56ff404af6e2014ee0c7fd8e

SHA256
bf104a63905a00b28d9ede28d21ccde794d12b495260aaf9c9f1852a1701cead

SHA512
fcc2e71d2dcee14b3b54b1b3563152b880643739cb5d52b921dc60f1198443a74b74a1137b027442d806e1edf94bf45f0c76ea491e5737694173cdaf589f1573

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2d5f8ad838e8dc570b724ac884e7e5b0

SHA1
602751c4679054e4a5d36cfb826eceffed105a98

SHA256
2f03a94855342895c5893d9d284dc4decaceb1f61c27d9b6afbbf56cf4477cb0

SHA512
ebefc95201965977288cf7d70edce9d9e25eae2f8e2ef9e9ada3dcab2b4dbcf736cc8c5662b51cadd9090a1c08351f661e8791608ff5a7fedd2a82abe61cecc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1953300f0b6523e6c813f1dc06914b3a

SHA1
6b3b2d4ba3f5863e66caf4e5b26a631702e6d15e

SHA256
519c9962a65a64ca0da113280a939728ad0f000aae68fed263c9b1d9d0d8cfa8

SHA512
8ebf2f4c3090f69f959e65e72cf043c9d1f5ef71975381f8b2fa0109656e22a91cd871b421906ff9e6e13c96a1fdea708e521977f77561c155625ead9d19f41d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
20706bb1ca48627b08004b054dda5d3b

SHA1
f2c0ef1a83bd93206919cc99279f9497a13b29cb

SHA256
0ac0db4ef253bf10e73e9e5e2d42c5d418e5fe60df99f70bf4cc6c2c113420c9

SHA512
7535e14c87f4a2ff8be52a91aedce27702231a2f14c5bfaddbc466d486cce72f1ba10d4386408bc7591ba30207b2bf2fe7637af034b6cd67f57a86a6d4ee09dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
c19b66a1364dcc44ae5f530898a71440

SHA1
10f8e666e8745d185e078ef1878f57a2e453598b

SHA256
40292537aed110436bfa96dbe8d593b1c2d843d3dc09166767e9ccc0fdce9ff9

SHA512
322574b674dafe664fa1eab4cd59290621497bf61bb5245bcee01c5761ed9a43d9ce2c4c5bfbfd4d9736551df6bade856950c9bd5355629759f610aaf332e282

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a2257d14f098a916074578dff44bbaa2

SHA1
e8dfb9db43cf2332896a889e3125f4fd18a1d0b0

SHA256
9959bcb1a57435f845674f5d94a87052683a6c92eb07aab02ad870a0cf1cce1b

SHA512
59ec4c54ec872bf8505b78b61e71ff4020a07e5401499109aa1e9093ad625f0e34ffcc04ec7e432fa28bd172b66e7b3cab49b6ff658147502093498fbe129047

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
c9cf4af277f1a5092e242ef13866582c

SHA1
1a74fcc07321737330e4319ee46e2a906973f1e0

SHA256
f5e1904c26d9dbab8faa4a790206049cd71fa4b9b9efc25d1299941a8e0bd2d9

SHA512
65661d986e3694cc70d2cb5a4c06bc0ca49507d2c21ad2bb87781b37dd2c56b2ca1fc49024ed11a57c0af59722d29bf4ff611172dfa6498ace876aa4b1f1b903

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4bb8dcef63a812ba3e4376890ebfbce9

SHA1
f39de2019eb29615b04bcf4e9a16e5891e063cec

SHA256
621ea57064077016dd60c297db41cda8b518b51c6903e02f9dfdc07923412c82

SHA512
11278b0c1b28bc97dde0f95765b8a80308909f94d45832c4c44e5118e4bd00ac6c53bdfa055e0c3d81d3e6484a5ae4913035b01d78bcf090c981e6993abca2ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
081947e539ef49df943edeb6c34941b9

SHA1
8e0054168ce1796276cfada711191e33d6dfe301

SHA256
041fb10f4e915e06ac56e6bd9e1b0557be0758a5d81b6e35ab637e2f2bdd1d01

SHA512
825de45953cd7a09ef264610a033312e35be372189c6c3f73fc6ae482d45447ff074692b6fc1c855f66e32878e0745f7238f0dc7baffddf946dcc2195ce1fd1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
fadb37c8ce063c0f32e12152abb245da

SHA1
33aab3e59f31f4b037803f93a3264c843d26c8f5

SHA256
18d4253710afd8ae34804e44e4eb52442c35346c2f48edfe062f7b2d614b10df

SHA512
05a7ae4681ef7685612f512accac4cbeab61126b9879b17a06ade189f14cbefb4b597a78166bb367a099ec302523ebeb45442c83151b5a3a509dc0d5f5968d97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
c67b56cde1e78b0be71d99c80cde0124

SHA1
b1ea0ba8e183c3f5eae1a3fc24db193da3d63ba0

SHA256
a9e1ccf5deb6cced905074bba28aafa597994c4fdc189644843c4c5240b854e3

SHA512
3698a97d4b88394bd6a44866ec9a08e748ecd0e1c2a75c6c338ce3ff8c82e9f189e55d8bc3b0711ffe0caeca7074367537576fa0d89cdcbddc0dd6043ca69148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
530f59ab5eecbbee27588c4a8209671a

SHA1
9ada2d3900f06e8c7c4197853fbc069e6b333bbe

SHA256
697ba02b517b14ec8313b3f686214ad9d5055e172340e151f76df0f213d09b81

SHA512
0a5cde8c7cc826d8ad6a87aecaaa4fcf4eecb6d5701dfdfbdf7467aa8115fd118c045f1200378e9eca2557dbb034354e14689c47fc23cd6adf45feb0de9d3965

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
3515bce24a662465de9eb5cfe6ef695f

SHA1
f0cebca0fd469b4993714eb4267f3bccc8ab4352

SHA256
8d2d291c156577b4652990153c914bd708675f3d562ea036f655d50c3555de5e

SHA512
3384903ea9f8dabb754df235affbd57955a27d966bbc28de57af12d87d4be016eeb6ee58e20e7c68ccadbd52e64f4ec598e7ee1cf7aea60ed81a8022dcb7f395

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt

Filesize
76B

MD5
568e7e61523398473af556dae2918fb7

SHA1
4091b1e52408b3ab3d34683f0b442fa35e661f9c

SHA256
5a4c156e40caf101ec0a0cc726e631af8baee8c05a74c2822d16a4d9d824f541

SHA512
e58b30b6b81c7992eb7754974941b789b465e9caced2cb4fc27709c77da9eb0ec6375f1f4294ed2d3419abb7d13224dbb96bb93008ef94308670f2daa580cbb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5f9738.TMP

Filesize
140B

MD5
3a60c500a0724e3093d457f599713eeb

SHA1
412b8e2321bc5f689c46469982c8cd2ba9866c23

SHA256
6a0fcaaa24a1ebf312044a35e927f8d385b8268447be8f4af3895b937695a209

SHA512
b449903f3f6aae904e19723bd4430ca51dc573fdc8a63eaf9982a70b3b113f91dfe8d6f892b4a529c8125da5fccbc4bded08e541b89341587f1c329dd021498c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt

Filesize
87B

MD5
e8ad8360b81a102bcf329cc38c444515

SHA1
5bd38e1adaabe9af1e650975a52c83b395042e54

SHA256
d86816b884ad09b4c6337fcb092eb11a879c81bdbe009cb57a484753bab81604

SHA512
42763ffac18668d2c633f6034a2c68d8f23845bb4e18d47a4102a27d916a4a5c4485147e0fe8e47825b13dadac461551f1517345d9d5559750b3527eae560969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\5\CacheStorage\index.txt~RFe6015ed.TMP

Filesize
151B

MD5
a8bfb0d631a7b79385e7ca380e3ac762

SHA1
1b3df4b7493e1739a45e9627130462cf7d56a870

SHA256
f1a46e5a30c86c6fcda79baba46689147fc2614ea2b6d70941f6997f605b3309

SHA512
1f4cd85d09137744cda404671d50871cc8e29ea3098432bc24d3d04cc2fd2783b415af2c875bde4144956b6fc6429bf7903ba502bd04d5713bcbba2c97d17e87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
179931296b1a43439239ecbcf8e73567

SHA1
f560e9068738b23270213b3a6f4be549f4833675

SHA256
46eaa094b03c1f32b369c1861f43e01cc823c85b355da27d3d1e40efe098fd9c

SHA512
393e27d471f10dfe45a9e265a1f930c60f5781061dedf97852db63ad8a8b57c5995eae2beac74d22377607799dd5ce836d8a9eb8315e2ddbde85df8c9c71c801

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
013ee4e297796da6776ed11027a49cd8

SHA1
ba4f50d647ebc4df27b09b4e44c8945a958e4fd3

SHA256
8281ca6a46f2f587fbfe5491b9e4d4d58260fca763402fd85b1546f2d7686dd9

SHA512
a10857cd1b90b2f4170db05d26bd3f0cb088f419759d47d73c6c8d78305f1f6a3a397dcfa3aefbd4ce1b07cde681718d8a4c4d79523f4430f3501009bb545dc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
14b60e87dcda28452f0ae18e545ad8ff

SHA1
381eaa2ba9351d9e88f70d0735ab721d28da8756

SHA256
dc44b30c2a4a1f82dc6b52fc479977b68eb4acda134ed275bee7730acedc6b29

SHA512
bd9809df1dab02d3a84be2b44d3bed32d3f492bb24549efd4a6397f5881aaabb8d154afb4f3ed6222bf815ad5ce6ae721a4259f9da6675cce23ac0724193e818

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
cf0bd3e4ed763138ab6c735642106d1e

SHA1
cced9a91a6582f5674f3ea04f758e077c8133b32

SHA256
1fa8419eb591fd8fa3c5d177405458bd26beaecd29bd21a5ba6477ccd455390a

SHA512
b271080be330b1c67c6f17fc902f8808e1a2b143d512d9f4c39390dd1b4ff7284f334c08b030942fe03c56276d1fd6370ca11050616015ac3783d93390ccc257

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
2e195e7e2ec376532dbb100192a609d7

SHA1
15e4eb0b9c215d6afebae598fbe7eeef0c858b91

SHA256
d3a9a8b2bc12bbea8260d9d93e5d69dedfc91038f151451e35519498e7f39786

SHA512
b6ed9d33113d6d8d359a5a057a2cfc3c7b1bcc737b02f874346f8b053994e0242acf9ec2703c351cb1c546d579351aeac784cfec50abe76d9185a863579cf89e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
c7dcf68414a37ead5c8b92a428ed19dc

SHA1
ef19c3a8b61d889240deb088b85153e1be4f270f

SHA256
9f727755f3528d7886d41496710ae6ebd40325195950093dd9ad9bbfadf5f924

SHA512
a0ddb5142feec93deebea3c79d9b732533e10a1e56acbf372eae9a53a85c6e1dfff811f960b59ac54756fa5c0b0944021a50ebb56827318c49c166bb72622fa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
377445b8cc5d75c8b6a6d1170adb2231

SHA1
d22b40dbe856cfa26eb981d0f05172c6bf2ba8d0

SHA256
e9ef831e02533f8a963033b5f1bfe9b53635ad1e8ce955962bf8d4dda7c539a9

SHA512
a4f232976d95a1525fd2a9fe3484fff79e423887a1acda079649d851b88f6574fd64edd708328556c0ee84e1c147cf976809098997c4efe82ffc4f292861afa4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Filesize
48KB

MD5
5a1706ef2fb06594e5ec3a3f15fb89e2

SHA1
983042bba239018b3dced4b56491a90d38ba084a

SHA256
87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd

SHA512
c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36f67177498002b119e12b0375dcdf96

SHA1
fc397ffec02208eb5d4808bf7fc5824a2b4477f1

SHA256
e5e71f40bbbdc09d9c2709bc8735f0327765d3be0e73127fa1f6aad50d899280

SHA512
adef029766ac6385ea98ebd0da03564cabf3af04192cc17c10e775021ff1ad77c4a9b9fa59720c7f17256eaadf3f220253929b3a128d498ce77d5831f82dbbc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f94a7b1dd2698adf068db50769db13e9

SHA1
fe9b6d012db5069255034741447ab36b40990955

SHA256
0deefea94f158a948620988892a345495ff4b328a74c480162bd9e5f5d69f586

SHA512
477b6c71d565dd9dde67ea311d460c86ebfccfdfd830586d233edf5c6c285d05f063121d56f04a3b74a9d63eebf826a4b5b108235d70cfe4e71664b1731f42d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}\CCSetup.msi

Filesize
1.5MB

MD5
efcad86241e5215071f90eb1e158925d

SHA1
db7fdf0ff9e92fa90954d474343487d9c803f80a

SHA256
ddcc94d8d33fb38f10e5630b3fafc0d92180379c2f7019cd5e89421cc74aeb55

SHA512
9a22c2687a17e7b2fb77dc85ec7ba45fc59c8de3fc67903feb1406fef51be3c59714118a3e770623fd5813864313e057c40d5076e3b01437439c043e48f53589

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}\ISSetup.dll

Filesize
3.0MB

MD5
a415c19f90e68b0069587e6304eba4aa

SHA1
e3fcebd19dd8928fcb3b1c476c19e316b70b1193

SHA256
9bde2457c7f22a67d240978f82ce0b811d714c0be6c463441d8695af228df7fe

SHA512
642b5fc4538e5ab1701915766e94f4f3a8c03246951604db8213f698a1608fb0d258ec1be99df37f7e1cde03280b72d3ba277b7d2c541d20fa0c95ec6d268474

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1D9C1A84-F33E-4BA0-87E9-1BD3370DF9FB}\_ISMSIDEL.INI

Filesize
600B

MD5
922128aeb1938d765fe6d39e862db4e5

SHA1
f8142755262342a7376263f6a6f38c069b67e473

SHA256
41bebef1d4c43cd0372c7fc4c55914b4907d81cf2683a9496fd5aff72dea500d

SHA512
215ee1bb959a9b2a7f820758cb753cfeb6ecade451e03a715975b805d012e5dceb6a1f2361a7a4fc8dba90dc9f137eaa5e011d6f077f2d1df806e4f8e1d1d7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\ISRT.dll

Filesize
426KB

MD5
b4171921e8339f2c5712b3c58cd86965

SHA1
146ac8f91f65780269b9aa12ff90079159578275

SHA256
d72c678d0265d44898f6f85ae0a65ad5429a10564ee5070de93a75511f438f2a

SHA512
8d009c6863e782ceeeabeb8f1a39cf594e916fb94eac4a215e4cf9e82174170fa5eead12312801f3e787c7e7ad9badd20f5a03c7302cc63a2d33dbd0d77f4536

Download Submit
C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\_isres_0x0409.dll

Filesize
1.4MB

MD5
cbf32e9e7482eda0ed5490cbfcf42fd5

SHA1
3c411155e102f44003da3a981e833073243fcad5

SHA256
6b458dcf8e27154328f5ba1c6496a6ec480a3af6fd85aa2ac438dac822a1f128

SHA512
c4ba46040f346308975fff55704f435f7cd5bd9c21b50bce2e750364017a0639390e5b7e6588100b903f8eeafca74144429e28136e53cbe49fc7101952a201e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\_isuser_0x0409.dll

Filesize
1.0MB

MD5
0ba8640ac748b6585ba428c2c03a75d5

SHA1
6312cde3c3925ba7c68c65409cfd1515f5ccb6fa

SHA256
fb1918b290efd737bd06cc37c3208eed2276f06473eb3fe18d26b448259603d1

SHA512
624ad202e2cc051c39de556b96fa32df9c2e9a7f7ebbedac4a57c8b5597a735f09bea6f8c2ac0c28ac8e78b0496076cce852db1bc9f01efb14cb79793417d828

Download Submit
C:\Users\Admin\AppData\Local\Temp\{CE9C60BD-B023-4C76-9F50-0705AF2708E2}\skin167f.rra

Filesize
2KB

MD5
7568981428a026c5597569e15c918764

SHA1
61b70714f95713c7d48bea3e815801713a1a2254

SHA256
60296347d78f52d5ccd20a8cfc426719f4821ecab61463c59ed32362d63d7646

SHA512
e498ad274dc6c317e007df03379e92edb1741fad641b4aefacbbea267abdb2e09fbf54e990c1330ea96a7b2a92583cfc18f6c1eb3618e773cc7e8375916c1111

Download Submit
C:\Users\Admin\AppData\Local\Temp\~D2A.tmp

Filesize
5KB

MD5
e8c4db7e72f0c84a72e6e08cf8e7d10b

SHA1
6280e66a804839ee5abe0b8aa83406e6b49ca583

SHA256
5bf7b082ed0f731c57ea5c1a63cb30df9c68100a8acc37ee4568dc1fb891ef33

SHA512
47f1d67b94086588d0c543dce253a6c41dd21d83ef52f031d306d4f920fe366218deb67e8a4627e72f1cba5e26a33cc40074ad78ec042c5241be051c5fffd903

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
14.8MB

MD5
b082f6d5c45308fe8c6f494dbe46343e

SHA1
21c3ace714c8bfe4064eeec0c61ed2d4172acfba

SHA256
4e8826e363ba286feab705b0e8b449722cef09fa98bc6b13468ebfa39b5606fa

SHA512
a101d8234516f3596eeddbc104226eba5900a15200f160054bc2ffe9f188700b568769b046e18c0dce2c24d35354799d6be1a25322b37dca7cecc41473feb5a4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry.zip.crdownload

Filesize
3.3MB

MD5
efe76bf09daba2c594d2bc173d9b5cf0

SHA1
ba5de52939cb809eae10fdbb7fac47095a9599a7

SHA256
707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

SHA512
4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\00000000.res

Filesize
136B

MD5
7f10e140bb7ad6d61400d9732b04325c

SHA1
a6bbf00494287c4ee44ac9dabb862bf91b7cd30a

SHA256
673bafec48f0cd391b5c8e51e56927792bc40d87b65b13ba6afaf68d38e1a6d3

SHA512
248d1e850af5663dfbbe424234b3b8915c77a0d8ea18516f673f8fcf3b314e42962da688b67f3dc595f08ed7d86048727f3d782bc9d6777d424d412eeb6d4db3

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\301361728689296.bat

Filesize
362B

MD5
fe9561e52b9a2cad33eaa33fbdaee8f4

SHA1
2bc1b267837017ec84edec64e2ed5ab787a59793

SHA256
6cf7e177e05490a3326a71f20a6640edef1d92936601969df22b0ea5261b1d44

SHA512
e734e185a32b0d2109cb666c8bf217096fffb9804578b97d8b108a7edae01ab129c7e6bf20174faf67c5ec493e9ce0e98d85381017fd3b879fe7232a36430261

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\@[email protected]

Filesize
721B

MD5
b0d3b7f713729870760fcb15ef4bea9d

SHA1
8625014b4e1042023b4fcbf76731178fd9d6fa30

SHA256
57a5f28c9ebb5b515596c58434c6651eff970b3231391ff70e36034e2c10cc27

SHA512
e19c09f786360ee19d7c215dcb510af3206b75bd3ace5c21a050643d78debe1ee7b1ee9883bf576650b0b53709e3abed730c3f33059ddfda23d260ba546b58d4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\b.wnry

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\c.wnry

Filesize
780B

MD5
93f33b83f1f263e2419006d6026e7bc1

SHA1
1a4b36c56430a56af2e0ecabd754bf00067ce488

SHA256
ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4

SHA512
45bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\m.vbs

Filesize
241B

MD5
cb8af050def8bd8ff07b6fece0b09530

SHA1
8faf2a240203f7dc8739952672c788a0fb2df973

SHA256
c97d8fc0de558b033cbf088ef69122addd364e65a49111aec218465549bf1227

SHA512
5ccb09d7e199f31e4a9a92621755c6514e8aae6187b6bef8aba2b6644834776941401188646dbf552639a13124285de15b18e6ff12acb57f91cb7d204cafdd57

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_bulgarian.wnry

Filesize
46KB

MD5
95673b0f968c0f55b32204361940d184

SHA1
81e427d15a1a826b93e91c3d2fa65221c8ca9cff

SHA256
40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

SHA512
7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_chinese (simplified).wnry

Filesize
53KB

MD5
0252d45ca21c8e43c9742285c48e91ad

SHA1
5c14551d2736eef3a1c1970cc492206e531703c1

SHA256
845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

SHA512
1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_chinese (traditional).wnry

Filesize
77KB

MD5
2efc3690d67cd073a9406a25005f7cea

SHA1
52c07f98870eabace6ec370b7eb562751e8067e9

SHA256
5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

SHA512
0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_croatian.wnry

Filesize
38KB

MD5
17194003fa70ce477326ce2f6deeb270

SHA1
e325988f68d327743926ea317abb9882f347fa73

SHA256
3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

SHA512
dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_czech.wnry

Filesize
39KB

MD5
537efeecdfa94cc421e58fd82a58ba9e

SHA1
3609456e16bc16ba447979f3aa69221290ec17d0

SHA256
5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

SHA512
e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_danish.wnry

Filesize
36KB

MD5
2c5a3b81d5c4715b7bea01033367fcb5

SHA1
b548b45da8463e17199daafd34c23591f94e82cd

SHA256
a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

SHA512
490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_dutch.wnry

Filesize
36KB

MD5
7a8d499407c6a647c03c4471a67eaad7

SHA1
d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

SHA256
2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

SHA512
608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_english.wnry

Filesize
36KB

MD5
fe68c2dc0d2419b38f44d83f2fcf232e

SHA1
6c6e49949957215aa2f3dfb72207d249adf36283

SHA256
26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

SHA512
941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_filipino.wnry

Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_french.wnry

Filesize
37KB

MD5
4e57113a6bf6b88fdd32782a4a381274

SHA1
0fccbc91f0f94453d91670c6794f71348711061d

SHA256
9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

SHA512
4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_german.wnry

Filesize
36KB

MD5
3d59bbb5553fe03a89f817819540f469

SHA1
26781d4b06ff704800b463d0f1fca3afd923a9fe

SHA256
2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

SHA512
95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_greek.wnry

Filesize
47KB

MD5
fb4e8718fea95bb7479727fde80cb424

SHA1
1088c7653cba385fe994e9ae34a6595898f20aeb

SHA256
e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

SHA512
24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_indonesian.wnry

Filesize
36KB

MD5
3788f91c694dfc48e12417ce93356b0f

SHA1
eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

SHA256
23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

SHA512
b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_italian.wnry

Filesize
36KB

MD5
30a200f78498990095b36f574b6e8690

SHA1
c4b1b3c087bd12b063e98bca464cd05f3f7b7882

SHA256
49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

SHA512
c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_japanese.wnry

Filesize
79KB

MD5
b77e1221f7ecd0b5d696cb66cda1609e

SHA1
51eb7a254a33d05edf188ded653005dc82de8a46

SHA256
7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

SHA512
f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_korean.wnry

Filesize
89KB

MD5
6735cb43fe44832b061eeb3f5956b099

SHA1
d636daf64d524f81367ea92fdafa3726c909bee1

SHA256
552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

SHA512
60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_latvian.wnry

Filesize
40KB

MD5
c33afb4ecc04ee1bcc6975bea49abe40

SHA1
fbea4f170507cde02b839527ef50b7ec74b4821f

SHA256
a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

SHA512
0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_norwegian.wnry

Filesize
36KB

MD5
ff70cc7c00951084175d12128ce02399

SHA1
75ad3b1ad4fb14813882d88e952208c648f1fd18

SHA256
cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

SHA512
f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_polish.wnry

Filesize
38KB

MD5
e79d7f2833a9c2e2553c7fe04a1b63f4

SHA1
3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

SHA256
519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

SHA512
e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_portuguese.wnry

Filesize
37KB

MD5
fa948f7d8dfb21ceddd6794f2d56b44f

SHA1
ca915fbe020caa88dd776d89632d7866f660fc7a

SHA256
bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66

SHA512
0d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_romanian.wnry

Filesize
50KB

MD5
313e0ececd24f4fa1504118a11bc7986

SHA1
e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d

SHA256
70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1

SHA512
c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_russian.wnry

Filesize
46KB

MD5
452615db2336d60af7e2057481e4cab5

SHA1
442e31f6556b3d7de6eb85fbac3d2957b7f5eac6

SHA256
02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078

SHA512
7613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_slovak.wnry

Filesize
40KB

MD5
c911aba4ab1da6c28cf86338ab2ab6cc

SHA1
fee0fd58b8efe76077620d8abc7500dbfef7c5b0

SHA256
e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729

SHA512
3491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_spanish.wnry

Filesize
36KB

MD5
8d61648d34cba8ae9d1e2a219019add1

SHA1
2091e42fc17a0cc2f235650f7aad87abf8ba22c2

SHA256
72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1

SHA512
68489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_swedish.wnry

Filesize
37KB

MD5
c7a19984eb9f37198652eaf2fd1ee25c

SHA1
06eafed025cf8c4d76966bf382ab0c5e1bd6a0ae

SHA256
146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4

SHA512
43dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_turkish.wnry

Filesize
41KB

MD5
531ba6b1a5460fc9446946f91cc8c94b

SHA1
cc56978681bd546fd82d87926b5d9905c92a5803

SHA256
6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415

SHA512
ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\msg\m_vietnamese.wnry

Filesize
91KB

MD5
8419be28a0dcec3f55823620922b00fa

SHA1
2e4791f9cdfca8abf345d606f313d22b36c46b92

SHA256
1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8

SHA512
8fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\r.wnry

Filesize
864B

MD5
3e0020fc529b1c2a061016dd2469ba96

SHA1
c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

SHA256
402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

SHA512
5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\s.wnry

Filesize
2.9MB

MD5
ad4c9de7c8c40813f200ba1c2fa33083

SHA1
d1af27518d455d432b62d73c6a1497d032f6120e

SHA256
e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

SHA512
115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\t.wnry

Filesize
64KB

MD5
5dcaac857e695a65f5c3ef1441a73a8f

SHA1
7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

SHA256
97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

SHA512
06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\taskdl.exe

Filesize
20KB

MD5
4fef5e34143e646dbf9907c4374276f5

SHA1
47a9ad4125b6bd7c55e4e7da251e23f089407b8f

SHA256
4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

SHA512
4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\taskse.exe

Filesize
20KB

MD5
8495400f199ac77853c53b5a3f278f3e

SHA1
be5d6279874da315e3080b06083757aad9b32c23

SHA256
2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

SHA512
0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

Download Submit
C:\Users\Admin\Downloads\Ransomware.WannaCry\u.wnry

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
memory/724-3512-0x0000000010000000-0x0000000010114000-memory.dmp

Filesize
1.1MB

Download
memory/2144-2871-0x0000000073A10000-0x0000000073A92000-memory.dmp

Filesize
520KB

Download
memory/2144-2873-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2904-0x0000000073A10000-0x0000000073A92000-memory.dmp

Filesize
520KB

Download
memory/2144-2903-0x0000000073AA0000-0x0000000073AC2000-memory.dmp

Filesize
136KB

Download
memory/2144-2905-0x0000000073990000-0x0000000073A07000-memory.dmp

Filesize
476KB

Download
memory/2144-2901-0x0000000073AF0000-0x0000000073B72000-memory.dmp

Filesize
520KB

Download
memory/2144-3050-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2906-0x0000000073770000-0x000000007398C000-memory.dmp

Filesize
2.1MB

Download
memory/2144-2922-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2910-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2900-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2902-0x0000000073AD0000-0x0000000073AEC000-memory.dmp

Filesize
112KB

Download
memory/2144-2944-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-3056-0x0000000073770000-0x000000007398C000-memory.dmp

Filesize
2.1MB

Download
memory/2144-2985-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2869-0x0000000073AF0000-0x0000000073B72000-memory.dmp

Filesize
520KB

Download
memory/2144-2872-0x0000000073AA0000-0x0000000073AC2000-memory.dmp

Filesize
136KB

Download
memory/2144-2992-0x0000000000120000-0x000000000041E000-memory.dmp

Filesize
3.0MB

Download
memory/2144-2870-0x0000000073770000-0x000000007398C000-memory.dmp

Filesize
2.1MB

Download
memory/2144-2950-0x0000000073770000-0x000000007398C000-memory.dmp

Filesize
2.1MB

Download
memory/2972-1312-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5040-2941-0x00007FFB52F40000-0x00007FFB531F6000-memory.dmp

Filesize
2.7MB

Download
memory/5040-2940-0x00007FFB66C00000-0x00007FFB66C34000-memory.dmp

Filesize
208KB

Download
memory/5040-2939-0x00007FF757AC0000-0x00007FF757BB8000-memory.dmp

Filesize
992KB

Download
memory/5040-2942-0x00007FFB51C80000-0x00007FFB52D30000-memory.dmp

Filesize
16.7MB

Download